Privacy Policy

Russian Dolls & Toys (operated by C2A Enterprise) is dedicated to safeguarding the privacy and personal data of our customers and visitors worldwide. This Privacy Policy details the measures we take to protect your information under the European General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and international electronic commerce data protection frameworks.

1. Data Controller Information

The entity responsible for processing your personal data on this website is:

What we collect

We ask for the least we can and use it only to get your parcel to you:

• Delivery details: your name, the delivery address, a phone number for the courier and customs, and your email address.
• Order records: what you ordered and when, the amount, whether it has been paid, and the tracking number.
• Server logs: browser type, language, IP address and referring page, kept only for security and to keep the site up.

Payment data

We take two forms of payment, bank transfer and cryptocurrency, and neither one gives us card details to store. We never hold card numbers or banking passwords. For a bank transfer we see only what appears on our bank statement: the sender name and the reference. For crypto we see the transaction on the public chain. The site itself is served over TLS 1.3.

Why we are allowed to hold it

Under the GDPR we rely on three grounds:

• Performing the contract, Article 6(1)(b): to pack your order, fill in the customs form and get it delivered.
• Legal obligation, Article 6(1)(c): to keep the accounting and tax records we are required to keep.
• Legitimate interest, Article 6(1)(f): to keep the site working and to stop fraud and spam.

5. Cookie Disclosures & Local Storage

Our website operates primarily with minimal, functional storage cookies:

• Session & Cart State: Remembers your shopping bag contents and currency preference as you browse.
• Search & Filters: Caches piece count and style filters for fast browsing responsiveness.
• We do not sell or trade your personal data to third-party behavioral advertising brokers.

6. Your Rights Under GDPR & CCPA

Regardless of your geographical location, we respect your rights to your personal information:

• Right to Access: Request a complete copy of all personal data held in our records.
• Right to Rectification: Request correction of inaccurate shipping addresses or details.
• Right to Erasure ("Right to be Forgotten"): Request immediate permanent deletion of your customer record, subject to mandatory tax retention periods.
• Right to Restrict or Object: Restrict processing or opt out of any non-essential communications.
• CCPA Non-Discrimination: We will never charge differing prices or deny service for exercising your privacy rights.

To exercise any of these rights, simply email our data officer at [email protected].

7. Data Retention Schedule

Transactional records are retained for the statutory tax period required by international commercial accounting law (typically 7 years), after which they are irreversibly anonymized or destroyed.