Privacy Policy

This Privacy Policy applies to WunderJewelry (referred to throughout as "WunderJewelry", "we", "us", or "our"), a business operating from Cyprus and serving customers internationally.

We are the "data controller" for the personal data we collect about you under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Cyprus Data Protection Law of 2018 (Law 125(I)/2018) — meaning we decide what data is collected and how it is used.

You can reach us at:

We collect personal data in the following ways:

When you contact us or request a quote

We collect: your name, email address, optional phone number, any reference images, sketches or descriptions you provide, details about the piece you'd like (specifications, materials, sizing, budget), and the content of your message.

When you place an order

We collect: your billing name and address, shipping name and address, email address, phone number, and order details. Payment card data is handled directly by our payment processor (Stripe / WooPayments) — we do not store full payment card numbers on our systems. We retain a record of payment confirmation, the amount, and the transaction reference.

Automatically when you visit our website

We collect, via cookies and similar technologies: your IP address, browser type and version, operating system, device information, pages visited, time spent, links clicked, referring website, and approximate location derived from your IP. See our Cookie Policy for the full breakdown.

If you subscribe to our communications

We collect: your email address and communication preferences.

Under the GDPR, every use of personal data needs a "legal basis". We rely on the following:

Performance of a contract (GDPR Article 6(1)(b))

Processing your orders, manufacturing your piece, accepting payment, arranging shipping, and handling the QC approval process — all are necessary to perform our service for you.

Compliance with legal obligations (GDPR Article 6(1)(c))

Keeping financial records for tax and accounting purposes (typically at least 6 years under Cyprus tax and companies law), and responding to lawful requests from authorities.

Legitimate interests (GDPR Article 6(1)(f))

Responding to your inquiries and quote requests, improving our service through anonymized analytics, securing our website against fraud and abuse, and communicating with you about your order or quote. In each case, we have balanced our interest against your right to privacy.

Consent (GDPR Article 6(1)(a))

Sending marketing emails (only with your active opt-in), setting non-essential cookies such as analytics and marketing pixels (only after you have consented through our cookie banner), and any other processing where consent is the legally required basis. You can withdraw consent at any time.

We share personal data only as necessary to deliver our service to you, and only with parties subject to appropriate data protection obligations.

Payment processing

Stripe (operating through WooPayments), our payment processor, handles card and bank payments securely. Stripe is itself responsible for its processing of your payment data under its own privacy terms.

Shipping and logistics

FedEx and DHL, our international shipping partners. We share the recipient's name, address, phone number, and a customs description of the contents.

Manufacturing partner

Our master goldsmith atelier in China, which manufactures every WunderJewelry piece. We share the technical specifications and design details of your piece. We do not share your personal contact information with the atelier — customer identity stays on our side; manufacturing references the piece, not the person.

Service providers running the website

Our web hosting provider, our email infrastructure provider (for transactional and marketing emails), Google Analytics 4 (Google LLC, processing in the United States under the EU–U.S. Data Privacy Framework), and Meta and TikTok (marketing pixels — only loaded if you have consented to marketing cookies).

Legal and compliance

Authorities, courts, or regulators where required by law (e.g., tax filings, lawful information requests), and our professional advisors (accountants, lawyers) under confidentiality obligations.

We do not:

• Sell your personal data to third parties.
• Share your data for advertising purposes unrelated to our own marketing.
• Allow our service providers to use your data for their own independent purposes.

WunderJewelry operates internationally, and some processing of your data takes place outside the European Economic Area ("EEA"). Specifically:

China (manufacturing)

Our manufacturing partner is located in China. For this transfer, personal data is minimized to what is required for the production and shipping of the product. For these limited transfers, we rely on the European Commission's Standard Contractual Clauses ("SCCs") as the legal basis under Chapter V of the GDPR.

United States (analytics, marketing pixels)

Google, Meta, and TikTok process certain data in the United States. Google participates in the EU–U.S. Data Privacy Framework, providing an approved legal basis for the transfer. Meta and TikTok rely on their respective transfer mechanisms (typically SCCs or equivalent safeguards).

You can request copies of the relevant Standard Contractual Clauses or other safeguards by emailing privacy@wunderjewelry.com.

We retain personal data only as long as necessary for the purposes described in this policy.

Order records

At least 6 years from completion of the order, as required by Cyprus tax and accounting law (including the Companies Law Cap. 113 and the VAT Law of 2000).

Quote requests that did not result in an order

24 months from the date of the request.

General contact form submissions

24 months from the date of the message.

Marketing communications

Until you unsubscribe or withdraw consent. After unsubscribing, your email is added to our suppression list so we do not accidentally email you again, but is not used for further active processing.

Website analytics

Aggregated, pseudonymous form for up to 26 months in Google Analytics, then deleted automatically.

Customer service correspondence

24 months, unless tied to an active order.

When retention periods expire, data is deleted or anonymized so it can no longer identify you.

Under the GDPR and Cyprus data protection law, you have the following rights:

Right of access (Article 15)

You can request a copy of the personal data we hold about you and information about how we use it.

Right to rectification (Article 16)

You can request correction of inaccurate or incomplete data.

Right to erasure (Article 17)

You can request deletion of your personal data, subject to certain legal limitations (we may need to retain order records for tax compliance, for example).

Right to restrict processing (Article 18)

In certain circumstances, you can request that we limit how we use your data.

Right to data portability (Article 20)

You can request that we send your personal data to you (or to another service) in a structured, machine-readable format.

Right to object (Article 21)

You can object to processing based on legitimate interests or for direct marketing. For marketing, we will stop on request. For other processing, we will stop unless we have compelling legitimate grounds.

Right not to be subject to automated decision-making (Article 22)

We do not make decisions about you based solely on automated processing.

Right to withdraw consent

Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

Right to lodge a complaint

You can complain to the Office of the Commissioner for Personal Data Protection in Cyprus (see Section 12), or to the supervisory authority in your country of residence.

How to exercise your rights

Email privacy@wunderjewelry.com. We respond within one month, as required by GDPR. We may ask you to verify your identity before processing certain requests, to protect against unauthorized access to your data. There is no fee in most cases — exceptions are limited to manifestly unfounded or excessive requests, as defined by GDPR.

Our website uses cookies and similar tracking technologies. These are small data files stored on your device when you visit a website.

Categories of cookies we use

• Strictly necessary cookies (no consent required): basic website function, session management, cart contents, security.
• Functional cookies: remembering your preferences such as language or currency.
• Analytics cookies (consent required): Google Analytics 4, to understand how visitors use the website.
• Marketing cookies (consent required): Meta Pixel, TikTok Pixel, used to measure ad performance and show relevant ads on those platforms.

Managing your cookie preferences

When you first visit the website, you are asked to consent to non-essential cookies through our cookie banner. You can change your preferences at any time through the cookie settings link in our footer, or by clearing cookies in your browser.

For a full list of the specific cookies set, including their names, purposes, and durations, see our Cookie Policy.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

These include: serving the entire website over HTTPS using TLS encryption; handling payment information directly through our payment processor (Stripe / WooPayments) rather than storing raw payment data on our own systems; restricting access to personal data within our team on a need-to-know basis; hosting our website on infrastructure with industry-standard security protections; and regularly reviewing our security practices.

No method of transmission over the internet or method of electronic storage is perfectly secure. While we use commercially reasonable means to protect your personal data, we cannot guarantee absolute security.

If we become aware of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, in accordance with GDPR Article 34.

Our website and services are intended for adults. We do not knowingly collect personal data from individuals under the age of 16. If you believe we have inadvertently collected data from a minor, please contact us at privacy@wunderjewelry.com and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, services, technology, legal requirements, or other factors. The "Last Updated" date at the top of this policy indicates when the most recent revision was made.

For material changes that affect how we use your personal data, we will update the date and — where appropriate — notify you directly (for example, by email if you have an active order or have subscribed to our communications).

We encourage you to review this policy periodically. Your continued use of our website and services after a change indicates your acceptance of the updated terms, to the extent permitted by law.

For any privacy-related question, concern, or request, contact us at:

We aim to respond to all privacy inquiries within seven business days. For formal GDPR rights requests, the legal response window is one month.

If you are dissatisfied with our response, or if you believe we are not complying with data protection law, you have the right to lodge a complaint with the data protection authority:

You may also lodge a complaint with the data protection authority in your own country of residence.