Last updated: 5 September 2026
PitonJewelry (“we”, “us”) operates the online shop at https://pitonjewelry.com and is the controller of personal data processed through this shop.
You can contact us at hello@pitonjewelry.com for general questions, orders, returns, or privacy requests. We do not operate customer accounts. This policy describes processing that is necessary to browse the catalog, keep a basket, complete a purchase, and send order emails.
When you browse the shop we process technical data needed to serve pages and keep a shopping basket (a signed cookie that stores product identifiers and quantities only — not prices or your name).
When you check out, Stripe collects the data needed to take payment and to ship your order, including your email address, payment details (handled by Stripe; we do not receive full card numbers), and shipping address.
After a successful payment we receive from Stripe the information required to confirm the order and fulfill it: customer email, paid line items, selected shipping method and cost, total paid in euro, and shipping address. We use that information to send a confirmation email to you and a fulfillment copy to the shop operator.
We process basket and checkout data to perform a distance sales contract with you or to take steps at your request before that contract (Article 6(1)(b) GDPR).
We process payment and anti-fraud data as required to provide secure payments through Stripe (Article 6(1)(b) and, where applicable, Article 6(1)(c) and (f) GDPR).
We keep a record of processed payment events (Stripe event identifiers only) so that order emails are not sent twice. That processing is necessary for our legitimate interest in reliable fulfillment (Article 6(1)(f) GDPR).
We do not send marketing emails and we do not create customer accounts or loyalty profiles.
Stripe acts as a payment processor. Stripe hosts Checkout, collects payment and shipping details, and may send payment receipts according to Stripe’s services. Stripe processes data under its own terms and privacy notice.
Resend acts as an email processor to deliver transactional order confirmation messages to you and to the shop operator.
In production the site is intended to run behind Cloudflare for DNS, HTTPS, and content delivery. Cloudflare may process technical connection data as described in Cloudflare’s documentation.
We do not sell personal data. Recipients are limited to the processors above and, where legally required, public authorities.
The shop sets a necessary HTTP-only cookie named piton_basket. It stores product identifiers and quantities so your basket can persist while you browse. It is signed against tampering, lasts up to 7 days, and is not used for advertising or analytics.
Stripe Checkout may set its own cookies on Stripe’s domains when you pay. Those cookies are governed by Stripe.
The basket cookie expires after 7 days or when you clear site data. Order emails are sent at the time of payment and are retained in the email provider according to that provider’s retention. Stripe retains payment records according to Stripe’s retention. Our local webhook ledger stores only Stripe event identifiers, not customer names or addresses.
If the GDPR applies to you, you may request access, rectification, erasure, restriction, or portability of your personal data, and you may object to processing based on legitimate interests. You may lodge a complaint with a supervisory authority. In Poland that authority is the President of the Personal Data Protection Office (UODO).
To exercise rights related to a purchase, contact hello@pitonjewelry.com and include enough detail for us to identify the order (for example the email used at Checkout).
We may update this policy when the shop or the law changes. The current version is published on this page.