SECTION 1 – WHAT DO WE DO WITH YOUR INFORMATION?
When you make a purchase from our store, we collect personal details such as your name, address, and email address in order to process your order and deliver your purchase. When you browse our website, we automatically receive your device’s internet protocol (IP) address, which helps us learn about your browser and operating system. With your permission, we may also send you emails about new products, updates, and special offers.

SECTION 2 – CONSENT
How do we obtain your consent?
When you provide personal information for a transaction—such as verifying your credit card, placing an order, arranging delivery, or processing a return—we take this as consent to collect and use your information for that specific purpose. If we request your details for secondary purposes (such as marketing), we will ask for your express consent or provide you with an option to decline.

How do you withdraw your consent?
If you change your mind after opting in, you may withdraw consent at any time by contacting us at order@kirschecandle.haus or by mailing us at:
Kirsche Candle Haus
17 Cunliffe Street
Johnsonville 6037
Wellington, New Zealand

SECTION 3 – DISCLOSURE
We may disclose your personal information if required by law or if you breach our Terms of Service.

SECTION 4 – SHOPIFY
Our online store is hosted on Shopify Inc., which provides the e-commerce platform enabling us to sell our products and services. Your data is stored securely through Shopify’s data storage, databases, and applications, protected behind a firewall.

Payment
If you use a direct payment gateway, Shopify stores your credit card data securely. This information is encrypted according to Payment Card Industry Data Security Standard (PCI-DSS) and retained only as long as necessary to complete your transaction. Once complete, your transaction details are deleted. All direct payment gateways comply with PCI-DSS, which ensures safe handling of credit card data.
For further details, see Shopify’s Terms of Service and Shopify’s Privacy Policy.

SECTION 5 – THIRD-PARTY SERVICES
Third-party providers used by us will collect, use, and disclose your information only to the extent necessary to perform the services they provide (e.g., payment processing or delivery). These providers may have their own privacy policies, which we recommend you review.

If a provider is located in another jurisdiction, your information may become subject to the laws of that region. For example, a transaction processed by a U.S.-based provider may be subject to U.S. legislation.

When you leave our website or are redirected to a third-party site, this Privacy Policy no longer applies.

SECTION 6 – SECURITY
We take reasonable precautions and follow industry best practices to protect your personal information from loss, misuse, unauthorized access, disclosure, alteration, or destruction. If you provide credit card information, it is encrypted using SSL technology and stored with AES-256 encryption. While no method of online transmission or electronic storage is completely secure, we comply with PCI-DSS and implement additional industry standards to safeguard your data.

SECTION 7 – COOKIES
Our site uses cookies to improve your browsing experience. Examples include:

• _session_id: Stores session information.
• _shopify_visit: Tracks visits (expires after 30 minutes).
• _shopify_uniq: Counts visits per customer (expires at midnight).
• cart: Stores cart contents (persistent for 2 weeks).
• _secure_session_id: Stores session details.
• storefront_digest: Identifies password access if applicable.

You may choose to disable cookies through your browser settings.

SECTION 8 – AGE OF CONSENT
By using our site, you confirm that you are at least the age of majority in your place of residence, or that you are the age of majority and have given consent for any minor dependents to use this site.

SECTION 9 – CHANGES TO THIS PRIVACY POLICY
We may update this policy from time to time. Any changes will take effect immediately once posted on our website. If significant updates are made, we will notify you so that you remain aware of what information we collect, how we use it, and under what circumstances it may be disclosed.

In the event our business is acquired or merged, your information may be transferred to new ownership in order to continue serving you.