Privacy policy

Privacy Policy

Last updated: 11 November 2026

This policy explains how we process your personal data when you visit the Woncrow shop (woncrow.com), place an order or contact us. It applies the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”).

1. Who is responsible for your data?

The controller is ISB GROUP LLC, a limited liability company (Limited Liability Company) organised under the laws of the State of New Mexico (United States), which operates the Woncrow brand and shop.

Address: 2105 Vista Oeste NW, Albuquerque, NM 87120, United States
Email: contact@woncrow.com

2. What data do we process?

Identity and contact details: name, delivery and billing address, email address, phone number if you provide it.
Orders: products ordered, amounts, purchase history, returns, exchanges and complaints.
Payment: payment method used, confirmation and transaction details. Card data is processed by the secure payment provider.
Customer account (if you create one): login details and preferences.
Communications with us: the content of your messages to customer service.
Browsing: IP address, device and browser type, pages viewed, data from cookies (see section 8).
Reviews you publish about our products.

This data comes from you (order, account, messages), from your browsing on the site, and from our service providers when they act on our behalf (payment, delivery).

3. Why, and on what legal basis?

Processing and delivering your order, handling returns, withdrawals, guarantees and customer service: performance of the contract (Article 6(1)(b) GDPR).
Invoicing, accounting, tax obligations, responding to requests from authorities: legal obligation (Article 6(1)(c)).
Website security and fraud prevention, improving the site, defending our rights in a dispute: legitimate interest (Article 6(1)(f)).
Newsletter and email offers: your consent (Article 6(1)(a)). If you are already a customer, we may email you offers for products similar to those you bought (Article 13(2) of Directive 2002/58/EC); you can object at any time, free of charge, using the unsubscribe link in every email.
Analytics and personalised advertising cookies: your consent, collected through the cookie banner.

We do not make any decision based solely on automated processing that produces legal effects concerning you.

4. Who receives your data?

Shopify, which hosts the shop and provides the ordering and payment tools;
the carriers responsible for delivery;
authorities, only where the law requires it;
a possible acquirer, if all or part of our business is transferred.

Our service providers act on our instructions and are bound by confidentiality. For certain advanced features (for example fraud prevention or sign-in with Shop), Shopify acts as a separate controller; its own privacy policy then applies. We do not sell your personal data.

5. Transfers outside the European Union

ISB GROUP LLC is established in the United States, so your data is processed there. Some service providers may also process it outside the European Union. These transfers are based on an adequacy decision of the European Commission (for example the EU–US Data Privacy Framework for certified companies), on the European Commission’s standard contractual clauses (Article 46 GDPR) or, where necessary to perform your order, on Article 49(1)(b) GDPR. You can obtain a copy of the safeguards by writing to us.

6. How long do we keep your data?

Orders and customer relationship: for the duration of the business relationship, then for the limitation periods that apply in your country.
Invoices and accounting records: for the period required by accounting and tax rules (up to 10 years).
Marketing: 3 years after our last contact with you, or until you unsubscribe.
Customer account: until you ask us to delete it.
Cookies: 13 months at most; your choice on the banner is kept for the same period.

7. Your rights

You have the following rights: access, rectification, erasure, restriction of processing, data portability, objection (in particular, at any time and without giving reasons, to direct marketing), and withdrawal of your consent at any time (without affecting processing already carried out).

To exercise your rights, write to us at contact@woncrow.com. We reply within one month (which may be extended by two months for complex requests, in which case we will let you know). We only ask for proof of identity if we have reasonable doubts.

8. Cookies

Cookies that are necessary for the site to work (basket, payment, security) are set without consent. Other cookies (analytics, personalised advertising) are only set with your agreement, which you can give, refuse or withdraw at any time through the cookie banner.

9. Complaints to a supervisory authority

If you believe your rights are not being respected, you can lodge a complaint with the data protection authority of your country of residence. In Ireland: the Data Protection Commission (www.dataprotection.ie). In Malta: the Information and Data Protection Commissioner (idpc.org.mt). For other countries, the list of authorities is available on the European Data Protection Board website (www.edpb.europa.eu).

10. Security

We take appropriate technical and organisational measures to protect your data (encrypted connection, restricted access). As no system is infallible, we recommend that you do not send sensitive information through unsecured channels and that you keep your login details confidential.

11. Minors

The shop is intended for adults. We do not knowingly collect data from children below the age set by the law of your country (between 13 and 16 years). If you are a parent and think your child has sent us data, contact us to have it deleted.

12. Third-party websites

The site may contain links to other websites (social networks, for example). These sites have their own privacy policies, which we invite you to read.

13. Changes

We may update this policy. The current version is always published on this page with its date of update. If there is a significant change, we will inform you.