Controller and representative details
The data controller responsible for this website is Eloa, operating the consumer brand
Skryxellrrwhron.ddd. The registered correspondence address is 170 Cashel Street,
Christchurch Central, Christchurch 8011, New Zealand. For all privacy correspondence use ask@skryxellrrwhron.world with
a clear subject line. If you reside in the European Economic Area and we appoint an EU
representative in writing, their contact details will be mirrored at the bottom of this page.
We respond to access and deletion requests without undue delay and within
statutory timeframes once identity is verified through proportionate checks.
Lawful bases at a glance
We rely on contract performance when fulfilling an order you place. Legitimate interests cover
fraud prevention, network security, product improvement analytics that do not require consent,
and internal reporting. Consent is collected before optional analytics or marketing cookies
fire. Legal obligation applies when tax or court orders require retention. Where more than one
basis could apply, we document the primary driver in our internal records.
Categories of personal data we process
Identity data includes your name, salutation if provided, and customer reference numbers. Contact
data covers email address, phone number when offered, and delivery addresses for physical goods.
Transactional data captures cart contents, payment status tokens (not full card numbers, which
our payment service provider tokenises), and shipment events. Technical data encompasses IP
address, browser user agent, approximate geolocation inferred at country or city level, device
category, operating system, and page journey timestamps. Preference data records newsletter
subscriptions and granular cookie consents with version identifiers.
Purposes tied to each activity
Customer care and fulfilment
We use your contact fields to acknowledge enquiries, send shipment tracking, and escalate
logistics exceptions. Warehouse partners receive the minimum address block needed to deliver
parcels.
Website reliability
Logs help engineers reproduce errors, tune caching, and block abusive traffic patterns without
profiling ordinary shoppers.
Product stewardship
Aggregated metrics about supplement interest categories inform inventory planning. Reports
exclude directly identifying fields unless you have opted into a named case study.
Regulatory evidence
Invoices and consent receipts may be archived to demonstrate compliance during audits from
food-safety or data-protection authorities.
Recipients and processor instructions
Cloud hosting vendors store encrypted backups in multiple regions. Email delivery partners
transmit transactional messages under submission-time controls. Payment processors retain card
artefacts according to PCI standards; we only see approval codes. Couriers receive labels with
contact phone numbers when you authorize text updates. None of these parties may sell your data
for their independent marketing.
Cross-border transfers
When data leaves New Zealand or the EEA, we implement safeguards such as Standard Contractual
Clauses, adequacy decisions, or binding corporate rules approved by regulators. You may request
a summary of the mechanisms applicable to your account by emailing us. Transfers to the United
States only proceed where recipients certify appropriate safeguards or derogations apply.
Retention timelines in plain language
- Marketing consents and email lists: until withdrawal plus thirty days for replication lag.
- Contractual purchase records: seven years where tax law mandates, otherwise three years
after the last delivery event.
- Server access logs: ninety rolling days unless frozen for incident review.
- Cookie consent proofs: twenty-four months from capture.
- Abuse investigations: up to eighteen months after closure if regulators require an audit
trail.
Security programme summary
Transport encryption enforces HTTPS with modern cipher suites. Administrative consoles require
multi-factor authentication and IP allow lists. Developers follow secure coding reviews prior to
deployment. Incident response playbooks define notification thresholds. While we invest in
defence in depth, no internet transmission is flawless; please use strong unique passwords on
your side and report suspicious account activity promptly.
Rights for individuals
You may request access, rectification, erasure, restriction, portability, or objection depending
on context. Automated decision-making is not used to deny purchases. Supervisory authorities in
the EU and the Office of the New Zealand Privacy Commissioner accept complaints if you believe
we mishandled a request. We do not charge a fee unless requests are manifestly excessive.
Profiling and automation boundaries
We do not score shoppers with purely automated decisions that produce legal or similarly
significant effects. Recommendation tiles, if introduced later, would rely on product affinity
rather than sensitive inferences.
Children and guardians
Our storefront targets adults who can lawfully buy dietary supplements. If we learn that
information was collected from a child under sixteen without guardian permission, we delete it
and throttle the account pending review.
How we announce changes
Material updates receive a refreshed publication stamp at the top of this document. Where consent
is the legal basis for optional processing, we surface a new collection dialogue before the
change takes effect. Continued use after minor clarifications constitutes acknowledgment.
Visible publication date follows your local clock when this file is opened:
Direct contact channel
Eloa, Skryxellrrwhron.world, 170 Cashel Street, Christchurch Central, Christchurch 8011, New
Zealand. Email ask@skryxellrrwhron.world.
Please include enough context for us to locate your request while minimising sensitive
attachments.