We are Milos BG, an online boutique for handmade apparel and artisan goods, operating milos-bg.com.

This policy covers data processing via our website, apps, emails, customer support and social pages. It applies to customers, prospects and visitors.

• GDPR: Regulation (EU) 2016/679.
• Personal data: information relating to an identified or identifiable person.
• Processor: a provider processing data on our behalf.
• Cookie: a tracker stored on your device (incl. local storage, pixels, SDKs).

The controller is Milos BG (see Legal notice). Privacy contact : contact@milos-bg.com

• Identity: name and first name when provided.
• Contact: email, phone, shipping/billing addresses.
• Account: login details, order history, preferences.
• Transaction: cart details, amount, payment status (we never see card numbers).
• Support: messages and internal follow-up notes where necessary.
• Technical: logs, IP address, user‑agent, session identifiers.
• Marketing: consents, email open/clicks, preferences.
• Social: interactions, comments, pseudonymized IDs.

We process data to:

• Sell & deliver products and manage the contract (performance of contract).
• Create & manage your account, history, returns, support (contract).
• Payment & anti‑fraud (legitimate interest / legal obligation).
• Service communications (legitimate interest / contract).
• Marketing emails: prior consent for prospects; for existing customers, marketing may concern products or services similar to those already purchased, with a simple and free right to object.
• Personalization and recommendations (consent if non‑essential cookies involved).
• Analytics essential/aggregated (legitimate interest); advanced (consent).
• Legal obligations (billing, accounting, authorities).

A consent banner lets you accept/refuse non‑essential cookies per purpose (advanced analytics, advertising, personalization, social). You can change choices anytime via “Cookie settings”.

Browser settings and Global Privacy Control (GPC) signals are honored where required by law.

Any advertising or retargeting tool requiring consent must remain disabled until the user has consented through the consent manager. Before a new advertising platform is activated, Milos BG updates this policy and the cookie register to identify the relevant processing.

We measure site performance (page views, conversions, paths). Tools that set non‑essential trackers run only with your consent via the CMP.

Payments are handled by secure providers (e.g., PayPal). We never store card numbers. Anti-fraud checks may be performed (IP checks, inconsistencies, 3-D Secure).

Your account keeps order history, addresses, preferences. Support handles your requests and may access necessary info (order, logistics status, payments). Interactions may be logged.

With your consent, we send marketing emails about new products, collections, offers and Milos BG content. You can withdraw your consent or unsubscribe at any time using the unsubscribe link included in each marketing email. Existing customers may also receive messages about similar products where permitted by law, with an easy and free opt-out.

We may tailor content/offers based on browsing and purchases. Where this relies on non‑essential trackers, we only do so with your consent. No profiling producing significant legal effects within the meaning of GDPR.

We share data only with authorized categories of recipients:

• Payment & anti‑fraud providers;
• Logistics, printers/workshops for custom make and delivery;
• IT vendors (hosting, CRM, email, analytics, CMP);
• Ad platforms (if consented);
• Public authorities where required.

Where data is transferred outside the EEA/UK, we implement appropriate safeguards (adequacy decisions, SCCs, supplementary measures). Copies available upon request.

• Inactive account: 3 years after last activity, then deletion/anonymization.
• Orders/invoices: 10 years (accounting) in secure archive.
• Prospects (marketing email): 3 years after last contact or until consent withdrawal.
• Customer support: 3 years from last relevant interaction.
• Anti‑fraud / security: 6 months to 2 years as necessary.
• Cookies: per Annex A.

We apply appropriate technical and organizational measures: in‑transit encryption, access control, logging, backups, environment separation, periodic security tests, permissions and incident management.

Under the GDPR and French data-protection rules, you may have rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent at any time. In France, you may also define directives concerning the use of your personal data after death. You may lodge a complaint with the CNIL if you consider that your rights have not been respected.

Our site is not intended for children under 15. We do not knowingly collect their data. Parents/guardians may contact us for deletion.

If GPC is enabled in your browser, we treat it as an opt‑out of ad trackers where required by law. You can also manage choices via our cookie banner.

Use the contact@milos-bg.com. We may ask only for information necessary to verify your identity. We respond within the time limits provided by the GDPR, normally within one month, subject to the extensions permitted by law.

We may update this policy to reflect legal changes and our practices. The last update date appears below. For material changes we will notify you by email or site notice.

This register must match the trackers actually used in production. No non-essential tracker may be activated before the required consent has been obtained.

• mbg.privacy.lang — localStorage — Privacy Policy language preference — retained until the preference is changed or the browser storage is cleared.
• mbg.legal.lang / mbg.lang — localStorage — language preferences for the legal pages and Terms — retained until the preference is changed or the browser storage is cleared.
• Clerk authentication/session trackers — strictly necessary for sign-in, session security and account access — duration according to the active Clerk session configuration.
• Non-essential trackers — no non-essential tracker is currently declared as active in production.

Users may review or change their choices concerning non-essential cookies at any time through the consent-management control available on the Website.

• Vercel Inc. — hosting, deployment and CDN.
• Clerk — authentication and session management.
• PayPal — online payment processing.
• MongoDB / MongoDB Atlas — application database hosting when used in production.
• Email provider — À COMPLÉTER / TO COMPLETE — mbg-admin.
• Shipping / logistics — À COMPLÉTER / TO COMPLETE — mbg-admin.

Update this list whenever a provider receiving personal data is added, replaced or removed.

• Sales, delivery, returns and customer support: performance of the contract.
• Invoices and accounting records: legal obligation.
• Account security and fraud prevention: legitimate interest and, where applicable, legal obligations.
• Marketing emails sent to prospects: consent.
• Marketing to existing customers for similar products: legitimate interest where permitted by law, with a simple and free right to object.
• Non-essential analytics, advertising and tracker-based personalization: consent.

For any question concerning personal data or to exercise your rights, contact contact@milos-bg.com. If you consider that your rights have not been respected after contacting Milos BG, you may lodge a complaint with the CNIL.