Carlotta
This Privacy Policy explains how Carlotta collects, uses, stores and protects your personal information when you visit carlottatch.com, sign up for our emails or order one of our cross necklaces, cross chains or bracelets. We have written it to be as clear and straightforward as possible.
Data controller
SBV Business LLC is a limited liability company organized in the State of South Carolina, USA. As data controller, we decide why and how your personal information is processed in connection with our online store. Our website is hosted by Shopify Inc., 151 O'Connor Street, Ottawa, ON K2P 2L8, Canada.
Controller details
SBV Business LLC (Carlotta)
606 Vang Ct
Boiling Springs, SC 29316
United States
Privacy contact
For all privacy-related requests:
support@carlottatch.com
+1 740 272-5703
We reply to emails within 24 hours on business days (Monday to Friday).
One standard for every customer
We ship worldwide, so we apply the same high standard of privacy protection to everyone, modeled on the EU General Data Protection Regulation (GDPR). If you live in the EU or the UK, the GDPR or UK GDPR applies to our processing of your data even though we are based in the United States. If you live in a US state with a consumer privacy law, such as California, you also have the rights described in section 08. Customers in other countries also benefit from any additional rights granted by their local data protection laws.
We collect only the personal information we need for the purposes described in this policy. We do not ask for information we do not use, and we do not keep it longer than necessary.
What we do not collect
We do not ask for sensitive information such as health data, biometric data, ethnic origin or financial account details beyond what is needed to take payment. Buying faith-inspired jewelry from us does not require you to tell us anything about your beliefs, and we do not record or infer religious beliefs from your purchases. To place an order you must be at least 18 years old or have the permission of a parent or guardian. We do not knowingly collect personal information from children. If you believe a child has shared personal information with us without permission, please contact us and we will delete it promptly.
We use your personal information only for the purposes listed below. We do not use it for automated decision-making or profiling that has a legal or similarly significant effect on you.
Processing your order
Confirming and processing your order and payment
Passing your shipping details to our carriers and emailing your tracking number once your order ships
Handling cancellations, returns, replacements and refunds
Preparing customs information for international shipments
Customer care
Answering your questions by email or phone
Resolving reports of damaged, defective or wrong items
Helping investigate delivery issues with our carriers
Legal & security
Meeting tax and accounting obligations
Detecting and preventing fraud and payment misuse
Handling chargebacks and payment disputes
Responding to lawful requests and establishing or defending legal claims
Marketing (with your consent)
Sending newsletters, new arrivals and offers, only if you have signed up
You can unsubscribe at any time using the link in every email or by contacting us
We never send marketing emails without your prior consent
Under the GDPR, every processing activity needs a lawful basis. The table below shows the basis we rely on for each purpose.
Balancing our interests with yours
Where we rely on legitimate interests, we have checked that our interests do not override your rights and freedoms. Fraud checks are limited to what is necessary to protect a transaction. You can object to processing based on legitimate interests at any time; see section 07.
We do not sell your personal information. We share it only with the service providers we need to run our store and deliver your order. Each of them may use your data only to provide their service to us.
Service providers we use
Shopify Inc., 151 O'Connor Street, Ottawa, ON K2P 2L8, Canada. Hosts our website and processes checkout, order and customer data. Card and wallet payments are handled by Shopify Payments.
PayPal processes payments if you choose to pay with PayPal.
Shipping carriers receive your name, shipping address and, where needed, your phone number or email to deliver your order and provide tracking.
Email marketing tool stores your email address and preferences if you subscribe to our newsletter.
Analytics tools help us understand how our website is used, based on your cookie choices.
We never share with
Data brokers or data resellers
Advertising platforms for targeting, unless you have accepted marketing cookies
Any third party for their own marketing
Anyone else, unless you ask us to or the law requires it
International data transfers
SBV Business LLC is based in the United States, and Shopify, PayPal and our other providers may process data in the United States, Canada or other countries. When personal data is transferred from the European Economic Area (EEA) or the UK to a country without an adequacy decision, we rely on appropriate safeguards as required by the GDPR.
Safeguards in place
Where required, transfers outside the EEA and the UK are covered by the Standard Contractual Clauses approved by the European Commission (and the UK equivalent), together with technical and organizational security measures.
Your right to know
You can ask for more information about these transfers and safeguards by emailing support@carlottatch.com. We will reply free of charge within one month.
We keep personal information only for as long as we need it for the purposes it was collected for, or for as long as the law requires. When it is no longer needed, we delete or anonymize it securely.
Order & transaction data
Order records are kept for 7 years from the date of the transaction, so we can meet tax and accounting requirements, then deleted securely.
Customer service messages
Kept for as long as needed to resolve your request and any follow-up, such as a return, refund or claim, and for up to 3 years after our last contact.
Marketing data
Kept while you remain subscribed. If you unsubscribe, we keep a record of your opt-out so we do not email you again by mistake.
Analytics & technical data
Kept in line with the retention settings of our analytics providers. Cookie details are available through our cookie banner. Data used for fraud checks is kept only as long as needed to protect the transaction.
Asking us to delete your data
You can ask us to delete your personal information at any time (see sections 07 and 08). We will do so without undue delay, unless the law requires us to keep certain records, such as order records for tax purposes. In that case we will explain why and delete the data once the legal obligation ends.
Wherever you live, you can exercise the following rights. Requests are free of charge and we respond within one month. For complex requests this may be extended by up to two further months, and we will let you know if that happens.
How to make a request
Email support@carlottatch.com with the subject line “Privacy request” and tell us which right you would like to use. Please include your full name, the email address you used with us and, if your request relates to a purchase, your order number. We may ask you to confirm your identity before we act on the request, to protect your data.
If you live in California or another US state with a consumer privacy law, you have specific rights over your personal information. You can use them in addition to the rights described in section 07.
Your state rights
Right to know: ask what personal information we have collected about you, where it came from, why we use it and who we share it with
Right to delete: ask us to delete the personal information we hold about you, subject to legal exceptions
Right to correct: ask us to fix inaccurate personal information
Right to opt out: opt out of the sale or sharing of your personal information, including sharing for targeted advertising
Our commitments
We do not sell your personal information
You can decline marketing cookies in our cookie banner at any time
We will not discriminate against you for exercising your rights, for example by charging you a different price or giving you a different level of service
How to use your state rights
Email support@carlottatch.com with the subject line “US privacy request” and tell us which right you would like to use and your state of residence. We will verify your identity before acting on the request, using information we already hold, such as your email address and order number. An authorized agent may submit a request on your behalf if we can verify their authority.
We use cookies and similar technologies on carlottatch.com. Our cookie banner lets you choose which non-essential cookies you accept, and you can change your choice at any time.
Essential cookies (always on)
Cart & session: keep items in your cart and let checkout work
Security: protect the site and help detect fraud
Preferences: remember your cookie choice, country and currency
Optional cookies (your choice)
Analytics: show us which pages are popular and how visitors find us, so we can improve the site
Marketing: help us show relevant ads and measure how well they work
Where consent is required, these are not set unless you accept them
Changing your cookie choices
You can change your preferences at any time through our cookie banner or your browser settings, where you can also block or delete cookies. Blocking essential cookies may stop parts of the site, such as your cart, from working properly.
We use appropriate technical and organizational measures to protect your personal information against loss, unauthorized access, alteration, disclosure or destruction.
How we protect your data
Card and wallet payments are processed by Shopify Payments, which is PCI-DSS compliant, and PayPal payments are processed by PayPal. We never see or store your full card number.
Technical measures
HTTPS encryption across the whole site, PCI-DSS compliant payment processing, secure logins for our internal systems and continuous security monitoring by Shopify.
Organizational measures
Access to personal information is limited to people who need it to process orders or support customers. Our service providers are bound by data processing terms.
If something goes wrong
If a data breach is likely to put your rights and freedoms at high risk, we will inform you without undue delay. Where the GDPR applies, we will also notify the relevant supervisory authority within 72 hours of becoming aware of the breach. US customers will be notified as required by the breach notification laws of their state.
If you have any question, request or concern about your privacy, please contact us first. We are happy to help.
Contact us about privacy
Email: support@carlottatch.com
Phone: +1 740 272-5703
We reply to emails within 24 hours on business days (Monday to Friday). Please include your order number if your question relates to a purchase.
Changes to this policy
We review this Privacy Policy from time to time. If we make significant changes, we will post a clear notice on our website and, where appropriate, let you know by email. The “Last updated” date at the top of this page always shows the current version.
EU & EEA customers
You can lodge a complaint with the data protection supervisory authority in the EU country where you live, work or where you believe your rights were infringed. A full list of national authorities is published by the European Data Protection Board.
UK customers
You can lodge a complaint with the Information Commissioner's Office (ICO), the UK data protection supervisory authority.
We would rather sort it out together
We take every privacy concern seriously. You are always free to contact a supervisory authority, but we would appreciate the chance to resolve your concern first. Write to us at support@carlottatch.com. You can also read our Terms of Service and Legal Notice.
We reply to emails within 24 hours on business days and answer all privacy requests within one month.
This Privacy Policy applies to personal information processed by SBV Business LLC, trading as Carlotta, through carlottatch.com. For customers in the EU and the UK, it has been prepared in line with Regulation (EU) 2016/679 (GDPR) and the UK GDPR. SBV Business LLC is a limited liability company organized in the State of South Carolina, USA. 606 Vang Ct, Boiling Springs, SC 29316, United States.