Privacy Policy

This policy describes how ISRAA processes your personal data, in line with the General Data Protection Regulation (GDPR).

Who we are

The data controller is Daknache Limited, trading as ISRAA.
Email: support@byisraa.com
Address: Ammochostou 27, 4651 Limassol, Cyprus.

What data we collect

When you place an order, we collect your full name, email address, phone number, and shipping address. We never collect your card details directly — payment is processed by Stripe (see below). If you accept analytics cookies, we also collect anonymous traffic statistics via Google Analytics. If you subscribe to our newsletter, we collect the email address you provide and your explicit consent to receive marketing emails — no other information is required to subscribe.

Legal basis and purpose of processing

Performance of a contract (GDPR Art. 6(1)(b)) — your contact details and shipping address are necessary to process, deliver, and keep accounting records of your order. Without this data, we cannot fulfil your order.
Legitimate interest (GDPR Art. 6(1)(f)) — to prevent fraud and keep the site secure (e.g. rate-limiting admin login attempts).
Consent (GDPR Art. 6(1)(a)) — for analytics cookies, which only load once you accept the cookie banner, and for newsletter marketing emails, which are only sent if you submit your email address through our newsletter signup form (submitting the form is itself the consent — no separate checkbox is used). Newsletter consent is separate from and never affects your ability to place an order, and can be withdrawn at any time using the unsubscribe link in any marketing email we send.

Who we share data with

We only share data with the service providers necessary to run the shop: Stripe (payment processing), our delivery courier (not yet finalized), Resend (order confirmation emails and, if you opt in, newsletter emails), Cloudinary (product image storage), and our hosting provider (Railway). We do not sell your data to third parties.

International transfers

Some of our service providers (e.g. Google Analytics) may process data outside the EU/EEA. Where this happens, the transfer relies on appropriate safeguards, such as Standard Contractual Clauses (SCCs) or, where applicable, the EU-U.S. Data Privacy Framework.

How long we keep data

Order and payment records are kept for 6 years, as required by Cyprus tax law. Cart contents are stored only locally in your browser (IndexedDB) and are never sent to our server until you check out.

Your rights

Under the GDPR, you have the right to access, correct, erase, and restrict the processing of your data, the right to data portability, the right to object to processing, and the right to withdraw consent at any time. To exercise any of these rights, contact us at the address above.

Complaints

If you believe we've processed your data in breach of the GDPR, you have the right to lodge a complaint with Cyprus's supervisory authority: Office of the Commissioner for Personal Data Protection, P.O. Box 23378, 1682 Nicosia, Cyprus — www.dataprotection.gov.cy.

Changes to this policy

We may update this policy from time to time. The date of the last update is shown at the top of the page.