Curated Vintage Distressed & Washable Area Rugs — Complimentary Express Air Shipping to USA, UK & Europe
curated rugs
Return to Store
Data Protection & Regulatory Compliance

Privacy Policy

Last Updated: October 2026 • GDPR & CCPA Disclosures

1. Data Controller Identification

This privacy notice outlines how İhsan Rugs Atelier (“Data Controller”) collects, processes, and safeguards personal information when you visit or purchase from ihsanrugs.com.

For any questions regarding your personal information, you can contact our Data Protection Office directly at privacy@ihsanrugs.com.

2. Categories of Data Collected

We only collect data strictly necessary to fulfill e-commerce transactions and air courier delivery:

  • Order & Logistics Data: Full name, delivery street address, postal code, contact telephone number (mandatory for DHL Express / FedEx air waybills), and email address for shipment tracking.
  • Billing & Payment Verification: Billing address and payment method tokens provided via Shopify Payments. We never store credit card numbers or CVV codes.
  • Technical & Analytics Data: IP address, device type, browser specifications, and anonymous interaction metrics used to diagnose layout bugs and improve store speed.

3. Lawful Basis for Processing (GDPR Article 6)

We process personal data under the following legal frameworks:

  • Contractual Necessity: To manufacture, inspect, package, and deliver your rug and communicate order updates.
  • Legal Obligation: To maintain commercial accounting records, tax invoices, and international customs declarations.
  • Legitimate Interests: To detect and prevent fraudulent transactions, safeguard our digital storefront, and analyze site performance.

4. Third-Party Data Disclosures

We strictly do not monetize, rent, or sell your personal data to marketing brokers or unrelated third parties. Data is shared exclusively with critical fulfillment infrastructure:

  • Logistics Couriers: DHL Express, FedEx, and national postal authorities strictly for package transit and customs clearance.
  • Payment Gateways: Shopify Payments / Stripe for PCI-DSS Level 1 certified transaction settlement.

5. European (GDPR) & UK Resident Rights

Under the General Data Protection Regulation (Articles 15-22), individuals residing in the EU or UK possess the following statutory rights:

  • Right of Access: Request a complete transcript of the personal data held about you.
  • Right to Rectification: Request correction of inaccurate or incomplete shipping records.
  • Right to Erasure (“Right to be Forgotten”): Request permanent deletion of your customer records, subject to statutory tax retention rules.
  • Right to Restrict or Object: Restrict processing or object to automated telemetry.

To exercise these statutory rights, submit a written verification request to privacy@ihsanrugs.com. We fulfill verified requests within thirty (30) calendar days at zero fee.

6. California Consumer Privacy Act (CCPA)

California residents are entitled under California Civil Code Section 1798.100 to know what personal data is collected and have it deleted upon request. We confirm that ihsanrugs does not “sell” or “share” personal information for cross-context behavioral advertising as defined under the California Consumer Privacy Act.

7. Data Retention & Security Measures

Customer transaction data is retained only as long as necessary to comply with commercial tax audits and warranty obligations (typically 5 to 7 years). All server communications are encrypted using end-to-end TLS 1.3 encryption.