Privacy policy

Last updated: 13 October 2026

1. Information About the Collection of Personal Data and the Controller

1.1. Thank you for visiting the Eva Dublin website and for your interest in our store. Below, we explain how we handle your personal data when you use our website. Personal data is any information that can be used to identify you personally.

1.2. The controller responsible for data processing on this website, within the meaning of the EU General Data Protection Regulation (GDPR), is Eva Dublin. The controller is the person or business that, alone or jointly with others, decides on the purposes and means of processing personal data. You can contact us at any time through our Contact page.

1.3. For security reasons and to protect the transmission of personal data and other confidential content (for example orders or enquiries), this website uses SSL/TLS encryption. You can recognise an encrypted connection by "https://" and the padlock symbol in your browser's address bar.

2. Data Collected When You Visit Our Website

When you simply browse our website without registering or otherwise sending us information, we only collect the data that your browser automatically sends to our server (so-called "server log files"). When you visit our website, we collect the following data, which is technically necessary to display the website to you:

• The page you visited
• Date and time of access
• Amount of data sent, in bytes
• The source or referring page you came from
• Browser used
• Operating system used
• IP address used (in anonymised form where possible)

This processing is based on Art. 6(1)(f) GDPR, our legitimate interest in ensuring the stability, security and functionality of our website. This data is not shared or used for any other purpose. However, we reserve the right to review the server log files if there are specific indications of unlawful use.

3. Cookies

3.1. To make your visit to our website more pleasant and to enable certain functions, we use cookies. Cookies are small text files stored on your device. Some cookies are deleted when you close your browser (session cookies). Others remain on your device and allow us or our partners to recognise your browser on your next visit (persistent cookies). Persistent cookies are deleted automatically after a set period, which varies depending on the cookie.

3.2. Essential cookies: some cookies are necessary for the website to work, for example to remember the contents of your shopping cart or to complete checkout. These are used based on Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (our legitimate interest in a functional website). They do not require your consent.

3.3. Analytics and marketing cookies: we only use non-essential cookies, such as analytics and advertising cookies, if you have given your consent through our cookie banner, based on Art. 6(1)(a) GDPR. You can change or withdraw your consent at any time through the cookie settings on our website.

3.4. You can also set your browser to notify you when cookies are set, to decide individually whether to accept them, or to block cookies in general. Each browser manages cookie settings differently; instructions can be found in your browser's help menu:

• Chrome: support.google.com/chrome/answer/95647
• Firefox: support.mozilla.org
• Safari: support.apple.com
• Edge: support.microsoft.com

Please note that if you block essential cookies, some functions of our website may not work properly.

4. Contacting Us

When you contact us (for example through our contact form), we collect personal data. The data collected can be seen in the contact form. This data is stored and used only to answer your request and for the related technical administration. The legal basis is our legitimate interest in responding to your request under Art. 6(1)(f) GDPR. If your enquiry relates to concluding a contract, the additional legal basis is Art. 6(1)(b) GDPR. Your data is deleted once your request has been fully dealt with, unless legal retention obligations require otherwise.

5. Data Processing When Opening a Customer Account and for Contract Processing

Under Art. 6(1)(b) GDPR, we collect and process personal data when you provide it to us to carry out a contract or when opening a customer account. The data collected can be seen in the relevant input forms. You can delete your customer account at any time by contacting us through our Contact page. We store and use the data you provide to process your order. Once your order has been fully completed or your account deleted, your data will be restricted, taking into account tax and commercial retention periods, and deleted after these periods have ended, unless you have expressly agreed to further use of your data or we are legally permitted to continue using it, as explained below.

6. Use of Your Data for Direct Marketing

6.1. Newsletter sign-up

If you sign up for our email newsletter, we will regularly send you information about our offers. The only required information is your email address. Any further information is voluntary and used only to address you personally. We use the "double opt-in" procedure: we will only send you our newsletter once you have confirmed your subscription by clicking a link in a confirmation email.

By confirming, you give us your consent under Art. 6(1)(a) GDPR. When you sign up, we store your IP address and the date and time of registration, so that we can prove your consent and detect any misuse of your email address. This data is used only to send you our newsletter. You can unsubscribe at any time using the link in every newsletter or by contacting us. After you unsubscribe, your email address is removed from our mailing list immediately.

6.2. Emails to existing customers

If you have given us your email address when buying from us, we may send you offers for similar products from our range by email. This is based on our legitimate interest in direct marketing under Art. 6(1)(f) GDPR. We will clearly tell you that you can object when you place your order and in every email. You can object at any time, free of charge (other than standard transmission costs), using the unsubscribe link in every email or by contacting us. After we receive your objection, we will stop using your email address for marketing immediately.

7. Data Processing for Order Fulfilment

7.1. To deliver your order, we share your personal data with the shipping company responsible for delivery, to the extent necessary. To process your payment, we share your payment data with the payment providers involved. The legal basis is Art. 6(1)(b) GDPR.

7.2. Payment providers: payments in our store are processed securely through Shopify Payments and its partners, including card networks (Visa, Mastercard, Maestro, American Express) and digital wallets (Apple Pay, Google Pay and Shop Pay). We do not store your full card details. Your payment data is shared only to the extent necessary to process your payment. More information is available in the Shopify Privacy Policy.

7.3. Hosting: our online store is hosted by Shopify, which processes data on our behalf to operate the store.

8. Review Requests

We will only use your email address to send you a one-time reminder to review your order if you have given us your express consent during or after your order, under Art. 6(1)(a) GDPR. You can withdraw this consent at any time by contacting us.

9. Social Media

Our website contains links to our social media profiles (for example Instagram and TikTok). These are simple links, not embedded plugins: no data is sent to the social network when you visit our website. Only when you click a link will you be taken to the social network's website, where its own privacy policy applies:

• Instagram (Meta): privacycenter.instagram.com/policy
• TikTok: tiktok.com/legal/privacy-policy-eea

10. Online Marketing

With your consent (Art. 6(1)(a) GDPR), given through our cookie banner, we may use advertising tools such as Google Ads conversion tracking, the Meta (Facebook/Instagram) Pixel and the TikTok Pixel. These tools set cookies to measure how effective our ads are, to show you relevant advertising, and to avoid showing you the same ads repeatedly. The providers may link this information to your account with them if you are logged in.

• Google: policies.google.com/privacy
• Meta: facebook.com/privacy/policy
• TikTok: tiktok.com/legal/privacy-policy-eea

You can withdraw your consent at any time through the cookie settings on our website. You can also manage personalised advertising at adssettings.google.com and youronlinechoices.eu.

11. Web Analytics

With your consent (Art. 6(1)(a) GDPR), we use analytics tools, such as Shopify Analytics and Google Analytics 4, to understand how visitors use our website and to improve it. These tools use cookies and similar technologies. IP addresses are anonymised or shortened. You can withdraw your consent at any time through the cookie settings on our website, or install the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout.

12. Transfers Outside the European Union

Some of our service providers (for example Google, Meta, TikTok and Shopify) may process data outside the European Economic Area, including in the United States. Where this happens, transfers are based on the EU–US Data Privacy Framework, an adequacy decision of the European Commission, or the European Commission's Standard Contractual Clauses.

13. Your Rights

13.1. Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): you can ask what personal data we process about you, for what purposes, who it is shared with, how long it is stored, where it came from, and whether automated decision-making is used.
• Right to rectification (Art. 16 GDPR): you can ask us to correct inaccurate data or complete incomplete data.
• Right to erasure (Art. 17 GDPR): you can ask us to delete your personal data, unless we are legally required to keep it or need it to establish, exercise or defend legal claims.
• Right to restriction (Art. 18 GDPR): you can ask us to restrict the processing of your data, for example while its accuracy is being checked.
• Right to notification (Art. 19 GDPR): if we correct, delete or restrict your data, we will inform anyone we have shared it with, and you can ask who they are.
• Right to data portability (Art. 20 GDPR): you can receive the data you provided to us in a structured, commonly used, machine-readable format, or ask us to transfer it to another controller.
• Right to withdraw consent (Art. 7(3) GDPR): you can withdraw any consent you have given at any time, with effect for the future. This does not affect the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint (Art. 77 GDPR): you can complain to a data protection authority, in particular in the country where you live or work. In Portugal: Comissão Nacional de Proteção de Dados (www.cnpd.pt). In Ireland: Data Protection Commission (www.dataprotection.ie).

13.2. RIGHT TO OBJECT

WHERE WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR LEGITIMATE INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE. IF YOU OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED, UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING IS NECESSARY TO ESTABLISH, EXERCISE OR DEFEND LEGAL CLAIMS.

WHERE WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME. IF YOU OBJECT, WE WILL STOP PROCESSING YOUR DATA FOR DIRECT MARKETING PURPOSES.

To exercise any of these rights, please contact us through our Contact page. We will respond within one month.

14. How Long We Keep Personal Data

We keep personal data for as long as necessary for the purposes described in this policy, and in line with legal retention periods (for example tax and commercial record-keeping obligations). After these periods have ended, the data is routinely deleted, unless it is still needed to fulfil or prepare a contract, or we have a continuing legitimate interest in keeping it.

15. Children

Our website is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, please contact us and we will delete it.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes in the law or in our services.