Panta-Plast · Store information
Privacy Policy (GDPR)
Panta-Plast privacy disclosures: controller information, data purposes, legal bases, recipients, retention, transfers and GDPR rights.
Draft for review · Updated 20 October 2026. Seller identity, establishment country, target EU markets, contacts, tax treatment and operational arrangements are unconfirmed. These pages explain general EU consumer rights and current website behavior, not full legal compliance. Complete the marked fields, configure and verify operations, and obtain jurisdiction-specific legal review before paid orders open. Nothing in these drafts waives mandatory consumer rights.
1. Who is responsible for your information?
Panta-Plast is the storefront brand. The legal seller name, business address and privacy contact are pending and will be published before launch. Until those details are available, this draft cannot identify a complete data controller or provide a verified rights-request contact.
2. Information used on this website
The storefront saves cart identifiers and items, wishlist product handles, your display-currency preference and the last available exchange rates in this browser. These records support shopping and do not constitute an account or completed order. Our cookie-preference record stores your choice and when it was saved. No newsletter subscription form is offered.
3. Checkout and service providers
Checkout opens on Shopify. Any checkout information you provide, such as contact details, delivery address and payment information, is handled in that checkout environment under its applicable terms. A private Lovable Cloud order store has been prepared to receive authenticated Shopify order notifications; automatic synchronization is pending configuration and verification. When connected, records include order numbers, items, amounts, order status and customer contact and address details, but not payment-card credentials. Google Fonts is requested to display the store's typefaces; your browser also requests product media and Shopify product information.
4. Purposes and legal grounds
Shopping storage supports functions requested by the visitor. If order processing becomes available, the seller must document contract-related processing, accounting obligations, fraud prevention and any other applicable legal bases. Optional marketing or analytics must not be activated without any consent required by applicable law. The current storefront does not configure optional marketing or analytics tracking.
5. Retention and security
Shopping preferences remain in this browser until cleared or changed. Cookie preferences are revisited after 180 days. Order and accounting retention periods have not been configured here and must be defined by the legal seller. Do not use shared devices to retain sensitive checkout information. We cannot promise that any online service is completely risk-free.
6. Your privacy rights
Depending on applicable law, you may request access, correction, erasure, restriction or portability of your information, object to relevant processing and withdraw consent where processing relies on consent. You may complain to your competent data protection authority. The seller must provide a verified contact and a process for these requests before launch.
7. International processing and updates
Third-party services may process information in locations outside your country. The seller must verify the relevant provider arrangements and any required transfer safeguards before paid orders open. This policy will be updated when those arrangements and seller details are confirmed.
8. Processing purposes and legal bases to confirm
The seller must confirm an activity-by-activity processing record: fulfilling orders and answering contractual requests may rely on GDPR Article 6(1)(b); required tax/accounting records on Article 6(1)(c); proportionate security or fraud prevention on Article 6(1)(f), with the interests and balancing assessment documented; optional purposes requiring consent on Article 6(1)(a). These are proposed mappings, not a claim that every activity is operational or legally assessed. Only collect information necessary for each purpose.
9. Recipients and service arrangements
Observed services include Shopify product/cart/checkout infrastructure, Shopify media delivery, Google Fonts and Lovable hosting. Private order storage is prepared in Lovable Cloud but notifications remain unconnected. The seller must verify each provider's role, processing agreement where needed, subprocessors, hosting locations and recipients such as carriers, payment processors or accountants. No carrier or payment processor is invented here.
10. Providing data and automated decisions
Checkout may require identification, contact and delivery details to perform an order; the actual required fields and consequences must be verified in hosted checkout. No customer profiling or solely automated decision-making with legal or similarly significant effects was identified in the storefront code. This does not verify every provider's processing. The local withdrawal draft is not submitted, persisted or used to identify a customer.
11. Requests, consent withdrawal and supervisory authority
GDPR requests are generally answered without undue delay and within one month; an extension of up to two further months may be available for complexity or number of requests with timely notice and reasons. Rights have legal conditions and exceptions. Withdraw consent as easily as it was given without affecting earlier lawful processing; object to direct marketing at any time. Complain to a competent supervisory authority, including in your habitual residence, place of work or place of an alleged infringement. The privacy contact, responsible authority and any required representative/DPO details must be supplied after the jurisdiction is confirmed.
12. Retention and transfers requiring completion
[To be supplied: retention periods or determination criteria for orders, accounting, complaints, withdrawal requests, support and security logs.] [To be supplied: provider transfer destinations and applicable adequacy decisions, standard contractual clauses or other safeguards, and how to obtain a copy.] Do not retain customer information indefinitely merely because storage is available. Access, deletion, backup retention and breach-response arrangements need operational verification.