Effective Date: April 30, 2026 
Last Updated: May 24, 2026

At CYO, your story matters—and so does your privacy. This Privacy Policy explains how CYO collects, uses, and protects personal data when you visit our website https://store.cyodesign.com or use our services.

By using our website, you agree to the practices described herein. If you do not agree, please refrain from using our website. We may update this Privacy Policy occasionally—all changes will be published on this page. Your continued use constitutes agreement to the most current version.

Please also refer to our Terms & Conditions for details on website usage, disclaimers, and legal restrictions.

What we collect

We only collect data that is truly necessary to provide you with a smooth and personalized experience—and we treat it with transparency, discretion, and respect.

This includes:

• Identification data: Name, email address, phone number, shipping and billing address, account ID, IP address

• Transaction data: Orders, payment and shipping information, purchase history, account data

• Profile & Preference data: Age, gender, design preferences, and purchase history—to personalize your CYO experience

• Usage & Device data: Device type, browser behavior, session duration, pages visited, interactions

• Communication data: Support inquiries, messages, product reviews, or survey responses

All data is processed in accordance with applicable data protection laws, used only for legitimate purposes, and protected with industry-standard security measures.

How we use your data

We use your data to improve your experience and ensure the security and functionality of the website—including for:

• Processing and fulfilling orders

• Account management

• Customer support

• Personalizing your design experience

• Shipping updates, order confirmations, and product information

• Promotions & exclusive offers (if activated by you)

• Fraud prevention and security

• Analytics & performance optimization

• Improving our services

• Legal obligations and compliance

We do not sell, trade, or rent your data. Disclosure occurs exclusively to trusted service partners (e.g., for payment, shipping, analytics) who are contractually obliged to use your data only for defined purposes.

For users in the EEA, we process personal data in accordance with GDPR based on contract fulfillment, legal obligation, legitimate interest, or your consent.

Cookies & Tracking

Our website uses cookies and similar technologies to enhance your experience:

• Strictly necessary cookies: essential for login, checkout, and basic functions

• Functional cookies: store preferences and improve usability

• Analytics cookies: help us understand user behavior and optimize the website

• Marketing cookies: enable personalized advertising and content

You can control cookies through your browser settings. Please note: Strictly necessary cookies cannot be disabled, as they are required for the website's basic functionality.

Account & Communication

If you create an account or sign up for our communications, your data will be securely stored and used exclusively for internal purposes.

For newsletter sign-ups, your IP address and the time of registration may be stored to document your consent.

You can unsubscribe from marketing emails at any time via the unsubscribe link in the email or directly through us.

Storage & Protection of Your Data

The protection of your data is our top priority. We rely on:

• SSL encryption for sensitive data

• Secure servers with firewalls and access restrictions

• Access exclusively for authorized personnel

Despite all measures, no digital transmission can be guaranteed 100% secure. In the event of a data incident, we act in accordance with legal requirements and inform you if necessary.

Sharing of Data

We only share data with selected third-party providers that enable our services—for example:

• Payment service providers

• Shipping & fulfillment partners

• Hosting & cloud providers

• Analytics & marketing tools

• Customer support services

All partners are contractually obliged to treat your data confidentially. Data is also disclosed only if legally required or within the scope of corporate processes (e.g., merger or acquisition).

Your Rights

California (CCPA)

You have the right to information about stored data, to deletion of your data, and to object to the sale of data. Regarding the latter: We do not sell data.

European Union (GDPR)

You have the right to information, rectification, erasure, restriction of processing, data portability, withdrawal of your consent, and the right to lodge a complaint with a data protection authority.

Data Protection for Minors

Our website is aimed at users aged 16 and over. We do not knowingly collect data from individuals under 16. Should this inadvertently occur, such data will be deleted immediately.

Third-Party Providers & Integrations

We use external services such as payment providers, e-commerce systems, and analytics tools. Our website may also contain links to external sites or social media profiles. These operate independently of us—please check their own privacy policies.

Changes to this Privacy Policy

We may update this Privacy Policy at any time. Significant changes will be published on this page and, if necessary, communicated additionally. We recommend that you review this page regularly.

Contact

For questions or to exercise your rights, you can reach us here:

E-mail: help@cyodesign.com

Address: Raj Hupp GmbH & Co. KG, Hammerbrookstraße 7, 20097 Hamburg, Germany

At CYO, personalization is built on trust. We protect your data with the same care, discretion, and intention with which we create every single piece.