Skip to main content

Your privacy choices

Popeye’s Passion uses essential storage for the shop. With your consent, ObsidianCorps measures visits using Umami in Germany. Analytics uses no cookies. You can accept, refuse or choose below; refusal has no effect on shopping. Withdraw at any time using the footer controls.

Privacy and storage notice

Popeyes Passion Logo
Cart (0)

Your privacy matters

Last updated: 29 September 2026

This Privacy Policy explains what information we collect, how we use it, and your rights regarding your personal data.

We follow privacy-by-design principles and only collect the data necessary to provide our services.

This policy applies to our online store and related services (including our appointment booking experience) unless stated otherwise.

Data controller

The data controller for personal data processed through this website is Popeye's Passion. You can contact us at info@popeyespassion.com.

Information we collect

  • Account information (name, email, password)
  • Order details and transaction data (for example purchased items, delivery address, chosen shipping and payment method, payment status)
  • Technical data and access logs are processed to operate and secure the site. After activation and only with your consent, Umami processes broad public page categories, visit times, site language, browser/device type and approximate country, region and city. The server receives your IP address and user agent and derives pseudonymous session and visit identifiers; raw IP addresses are not stored in Umami analytics tables. We exclude product names, search terms, referrer URLs, query strings, fragments, customer identifiers, and account, cart, order and checkout pages. No session recording, heatmaps, advertising profiles or automated decisions are used.
  • Communications you send to support (for example contact form submissions or booking-related questions)
  • Marketing preferences (for example if you opt in to receive newsletters or product updates)

We do not intentionally collect special categories of personal data. Please avoid sharing sensitive information in free-text fields.

How we use your information

  • To provide and improve our services (including our online store and appointment booking)
  • To process orders and payments, including transmitting the necessary payment data to our payment provider Revolut to execute the transaction
  • To communicate updates, confirmations and support (for example order updates or answers to your requests)
  • To maintain security, prevent abuse, detect fraud and troubleshoot incidents (for example via server and access logs)
  • With consent, to measure visits to broad public page categories and improve the store. Analytics is optional and is separate from security logs.

Legal bases for processing (GDPR)

  • Performance of a contract (for example to process your order or provide customer support)
  • Legitimate interests (for example to secure and operate our website)
  • Consent under Article 6(1)(a) GDPR for optional Umami audience measurement and separately for optional marketing communications. A refusal does not affect shopping. Necessary storage is limited to the services you request; consent evidence is retained to meet our accountability obligations under Articles 5(2) and 7(1) GDPR.
  • Legal obligation (for example accounting and tax retention requirements)

Sharing and disclosure

We do not sell personal data. We use service providers for hosting, shipping, payments (including Revolut) and email. The optional Umami service at analytics.obsidiancorps.com is operated by ObsidianCorps on our behalf in Germany. This processing is covered by an agreement under Article 28 GDPR. Access is restricted to authorised personnel of Popeye’s Passion, ObsidianCorps and its contracted infrastructure providers. No advertising networks receive analytics data.

Cookies and similar technologies

We use cookies that are necessary for core site functionality (for example authentication and keeping your cart).

Authentication (_medusa_jwt) and cart (_medusa_cart_id): 7 days. Cache (_medusa_cache_id): 1 day. Language (NEXT_LOCALE) and age verification (AGE_VERIFIED): up to 1 year. The age_verified local preference remains until cleared. Your cookie_preferences choice is valid for 180 days and is renewed if the analytics policy changes. The essential consent_withdrawn cookie remembers a refusal for up to 180 days, including when localStorage cannot save it.

Optional Umami analytics contacts analytics.obsidiancorps.com only after you accept it. No analytics cookies or persistent visitor IDs are placed on your device. Accepting or refusing is remembered in localStorage (cookie_preferences) for 180 days, with the choice time, policy version and a random consent-receipt reference; a material policy change requires a new choice. Consent evidence (choice, notice version, language, receipt reference and server timestamp) is held separately for 400 days, without IP addresses, account IDs or user agents. It is never sent to Umami. You can change settings or withdraw consent with one click in the footer, including at checkout. Withdrawal stops future analytics without affecting earlier lawful processing. The essential consent_withdrawn cookie remembers a refusal for up to 180 days, including when localStorage cannot save it.

Your rights

  • Access, update, or delete your information
  • Request a copy (data portability)
  • Object to or restrict certain processing
  • Withdraw consent where applicable
  • Request correction of inaccurate or incomplete data
  • Request deletion of your data (where applicable)

Contact info@popeyespassion.com to exercise your rights. We may need to verify your identity. You may lodge a complaint with the Luxembourg CNPD (cnpd.public.lu) or another competent supervisory authority. Pseudonymous analytics may not be linkable to your identity; we do not collect additional identifying data solely to identify you in analytics.

Data retention

Security access logs, including IP addresses and requested URLs, are retained for 30 days with daily rotation and deletion. They are used to secure and troubleshoot the service, separately from optional audience measurement. Analytics records expire after 180 days and are deleted by a daily job. Consent receipts expire after 400 days and are deleted daily. The browser choice is valid for 180 days. Backups expire within a further 30 days; restored data is subject to the same deletion rules before returning to service. Other personal data is retained only as necessary for its stated purpose and applicable legal, accounting and tax obligations.

Security

We use appropriate technical and organizational measures to protect personal data. However, no method of transmission or storage is 100% secure.

International transfers

The Umami service and its backups are hosted in Germany. No transfer outside the EEA is intended for this analytics processing. Any change of hosting or subprocessor that introduces a third-country transfer requires prior assessment, appropriate GDPR Chapter V safeguards and an updated notice. Other service providers may require such safeguards as described in their applicable service arrangements.

Changes to this policy

We may update this Privacy Policy from time to time. The latest version will be posted on this page.

Contact

For privacy requests, contact: info@popeyespassion.com