Privacy policy
Privacy Policy
Last updated: 31 May 2026
This Privacy Policy describes how the operator of the Style Maha brand ("we", "us", "Style Maha") collects, uses, and protects your personal data when you visit stylemaha.com (the "Site") or place an order. It complies with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and, for UK customers, the UK GDPR and Data Protection Act 2018.
1. Data Controller
⚠️ TO COMPLETE — operator action required. The real legal entity must be named here so customers can identify the data controller. Do not publish with the placeholder.
Data controller: [LEGAL ENTITY NAME] [LEGAL FORM] — registration number [REGISTRATION NUMBER] Registered office: [REGISTERED OFFICE ADDRESS] Trading name: Style Maha Operating address: 263 Castle Peak Road, Cheung Sha Wan, Kowloon, Hong Kong 999077 Contact: info@stylemaha.com
2. Personal Data We Collect
We collect the following categories of data:
2.1 Data you provide directly
- Identity and contact: title, first and last name, email address, phone number;
- Delivery and billing address: postal address, postal code, country;
- Order data: items purchased, amount, order history;
- Payment data: handled directly by our payment provider (Shopify Payments / Stripe) — we never store your full card number;
- Correspondence: messages exchanged with customer service.
2.2 Data collected automatically
- Browsing data: IP address, browser type and version, operating system, pages viewed, time of visit, referring source;
- Cookies and trackers: see our Cookie Policy for details.
3. Purposes and Legal Bases
| Purpose | Legal basis | Retention period |
|---|---|---|
| Processing your order (payment, delivery, after-sales) | Performance of the contract | 3 years after the end of the commercial relationship |
| Accounting and tax obligations (invoices) | Legal obligation | As required by applicable tax law |
| Managing your customer account | Performance of the contract | Until account deletion |
| Sending marketing emails (newsletter, offers) | Consent (opt-in) | Until consent is withdrawn |
| Anonymous audience measurement and statistics | Consent / legitimate interest | Maximum 13 months |
| Fraud prevention | Legitimate interest | As required |
| Responding to contact requests | Legitimate interest | 3 years from last contact |
4. Recipients of the Data
Your data is never sold. It may be shared with:
- our sub-processors strictly necessary to provide the service: Shopify Inc. (store hosting, under GDPR Standard Contractual Clauses), Stripe / Shopify Payments (payment processing), shipping carriers (delivery), email service providers;
- the competent administrative or judicial authorities where required by law.
5. International Data Transfers
Some of our sub-processors (in particular Shopify Inc.) may process your data outside the European Union, mainly in the United States or Canada. In addition, our order fulfilment operates from Hong Kong. Such transfers are governed by the European Commission's Standard Contractual Clauses and, where applicable, additional measures ensuring a level of protection essentially equivalent to that provided by the GDPR.
6. Security
We implement appropriate technical and organisational measures to protect your data against loss, unauthorised access, disclosure, or alteration: TLS/HTTPS encryption across the Site, secure hosting via Shopify, restricted access by authorised personnel, regular backups, and access logging.
7. Your Rights
In accordance with the GDPR (Articles 15 to 22) and the UK GDPR, you have the following rights at any time over your data:
- right of access to your data;
- right to rectification of inaccurate or incomplete data;
- right to erasure ("right to be forgotten"), under the conditions provided by law;
- right to restriction of processing;
- right to data portability in a structured, machine-readable format;
- right to object to processing based on legitimate interest or to prospecting;
- right to withdraw your consent at any time for processing that depends on it.
To exercise your rights, contact us at info@stylemaha.com, providing proof of identity if necessary. We will respond within the legal time frame (one month, extendable).
8. Right to Lodge a Complaint
If, after contacting us, you consider that your rights are not respected, you may lodge a complaint with the data protection authority of your country of residence. For example:
- France: CNIL — www.cnil.fr
- Ireland: Data Protection Commission — www.dataprotection.ie
- United Kingdom: Information Commissioner's Office (ICO) — www.ico.org.uk
- Customers in other EU countries may contact their respective national supervisory authority.
9. Cookies
The use of cookies and trackers is detailed in our Cookie Policy. You can change your preferences at any time via the consent banner displayed on the Site.
10. Minors
The Site is not intended for minors under the age of 16. We do not knowingly collect personal data from minors. If you believe a minor has provided us with data, please contact us so we can delete it.
11. Changes to This Policy
We may update this policy to reflect legal, technical, or commercial changes. The date of the latest update appears at the top of this page. In the event of a significant change, we will inform you by email or by a notice visible on the Site.
12. Contact
Trading name: Style Maha Email: info@stylemaha.com Customer service hours: Monday to Friday, 9:00–17:00 (Central European Time, CET) Operating address: 263 Castle Peak Road, Cheung Sha Wan, Kowloon, Hong Kong 999077