This Privacy Policy describes how loafandbox (“we”, “us”, “our”, or the “Data Controller”) collects, uses, discloses, and safeguards personal data when you visit or make a purchase from www.loafandbox.com (the “Site”).

We are committed to processing personal data in full compliance with applicable privacy and data protection legislation, including the Regulation (EU) 2016/679 (General Data Protection Regulation or “GDPR”) and applicable local privacy laws.

—

1. DATA CONTROLLER

For the purposes of applicable data protection law, the Data Controller responsible for your personal data is loafandbox.

  • Website: www.loafandbox.com
  • Contact Email: internal@loafandbox.com

—

2. PERSONAL DATA WE COLLECT

When you browse, interact with, or make a purchase on the Site, we collect certain categories of personal data necessary to provide our services and operate our e-commerce operations effectively:

  • Identity and Contact Data: Name, billing address, shipping address, email address, and telephone number.
  • Order and Transaction Data: Details regarding products purchased, order reference numbers, delivery preference details, and transaction history.
  • Technical and Usage Data: Internet Protocol (IP) address, browser type and version, time zone setting, operating system, page interaction information, and device identification logs.
  • Communication Data: Communications sent to us via email or customer support inquiries.

—

3. HOW AND WHY WE USE YOUR PERSONAL DATA

We process your personal data on the following legal bases:

1. Performance of a Contract: To process orders, manage deliveries, handle payments, and provide order updates or customer support.
2. Legal Obligations: To maintain accurate accounting, tax, and transaction records in compliance with statutory obligations.
3. Legitimate Interests: To maintain site operational continuity, analyze site performance, prevent fraudulent transactions, and preserve administrative security.
4. Consent: Where required by applicable law (e.g., for non-essential cookies or direct marketing communications). Consent may be withdrawn at any time.

—

4. PAYMENT PROCESSING

All financial transactions on the Site are handled directly through our designated third-party payment processor, Stripe.

When you place an order, your payment card details, billing address, and transaction amount are transmitted securely to Stripe for authentication and authorization. We do not store, view, or retain full credit/debit card numbers or sensitive payment security credentials on our servers.

The processing of payment information is governed by Stripe’s privacy documentation and security standards.

—

5. DATA SHARING AND DISCLOSURE

We do not sell, rent, or trade personal data to third parties. We share personal data strictly on a need-to-know basis with trusted service providers who assist us in operating our business:

  • Payment Processors: Stripe (for payment settlement and fraud detection).
  • Logistics and Carrier Partners: Courier and postal services necessary for physical order fulfillment.
  • Technical Infrastructure Providers: Hosting, domain, and server maintenance providers.

All service providers act as data processors under contractual obligations to process personal data strictly in accordance with our instructions and applicable privacy laws.

—

6. INTERNATIONAL DATA TRANSFERS

Because we cater to customers in Europe and operate from Singapore, your personal data may be transferred to, stored, or processed in jurisdictions outside the European Economic Area (EEA).

When personal data is transferred outside the EEA, we ensure appropriate safeguards are implemented, including standard contractual clauses approved by the European Commission or equivalent adequacy decisions, ensuring an equivalent level of protection for your personal data.

—

7. DATA RETENTION

We retain your personal data only for as long as is strictly necessary to fulfill the purposes for which it was collected, including for the satisfaction of any legal, accounting, tax, or reporting requirements.

  • Transaction and Order Records: Retained for a period of up to seven (7) years following completion of the transaction to comply with statutory tax, corporate, and accounting regulations.
  • Customer Inquiries and Correspondence: Retained for up to two (2) years from the date of final resolution.
  • Technical and Server Logs: Retained for up to six (6) months for cybersecurity and system maintenance monitoring.

Upon expiration of the relevant retention period, personal data is permanently deleted or securely anonymized.

—

8. YOUR DATA PROTECTION RIGHTS

Under applicable data protection legislation (including the GDPR), you hold specific rights regarding your personal data:

  • Right of Access: You have the right to request access to the personal data we hold about you.
  • Right to Rectification: You have the right to request correction of inaccurate or incomplete data.
  • Right to Erasure (“Right to be Forgotten”): You may request the deletion of your personal data where legal grounds exist.
  • Right to Restrict Processing: You may request that we suspend or restrict the processing of your personal data under certain circumstances.
  • Right to Data Portability: You may request a copy of your personal data in a structured, commonly used, and machine-readable format.
  • Right to Object: You have the right to object to processing based on legitimate interests or direct marketing.
  • Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in the European Union member state of your residence or place of alleged infringement.

To exercise any of these rights, please contact us at internal@loafandbox.com.

—

9. DATA SECURITY

We deploy administrative, technical, and organizational measures designed to protect your personal data against unauthorized access, loss, misuse, alteration, or destruction. Access to personal data is restricted to authorized personnel and service providers operating under strict confidentiality obligations.

—

10. COOKIES AND TRACKING TECHNOLOGIES

The Site uses essential cookies to enable fundamental website functionality, shopping cart operations, and session navigation. Non-essential analytical cookies are only deployed with your prior consent obtained via our site cookie preferences banner. You may adjust your browser settings to disable or decline cookies, though certain features of the Site may not function as intended.

—

11. AMENDMENTS TO THIS PRIVACY POLICY

We reserve the right to modify or update this Privacy Policy at any time to reflect operational, legal, or regulatory changes. Updated versions will be published directly on this page with an updated “Last updated” date. Continued use of the Site following updates constitutes acknowledgment of the revised Privacy Policy.

—

12. CONTACT INFORMATION

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact:

loafandbox
Email: internal@loafandbox.com
Website: www.loafandbox.com