The short version
We collect what we need to sell you shoes and get them to your door: your name, contact details, address and order history. We never see your card number — Stripe handles payment. We do not sell your data to anyone. You can email privacy@schoolsteps.shop at any time to see, correct or delete what we hold.
1. Who is responsible for your data
The data controller is Kypos Ltd (registration number HE 488430), trading as SchoolSteps.
- Address: Voreiou Ipeirou 2, Oasis Park, Flat/Office Q2, 8035 Paphos, Cyprus
- Email: privacy@schoolsteps.shop
- Phone: +357 97 93 98 60
We are a small business and are not required to appoint a Data Protection Officer. Your message goes to the people who run the shop.
This policy follows the GDPR (Regulation (EU) 2016/679) and the Cyprus data protection law 125(I)/2018.
2. What we collect, why, and for how long
Each thing we do with your data needs a legal basis. Here is all of it, in one table.
| What we do | Data used | Legal basis | How long we keep it |
|---|---|---|---|
| Take and deliver your order | Name, email, phone, delivery address, order contents, shoe sizes | Performance of a contract | 6 years after the end of the tax year, for tax and accounting |
| Take payment | Amount, payment reference, card result (never the card number) | Performance of a contract | 6 years after the end of the tax year |
| Run your account | Email, password (encrypted), saved addresses, order history | Performance of a contract | Until you ask us to close your account. We action requests by hand, so allow a few working days. Order records are then kept for the tax period above |
| Answer your questions | Name, email, phone, what you told us | Performance of a contract, or our legitimate interest in helping you | 2 years from your last message |
| Handle returns and complaints | Order details, correspondence, photos you send | Legal obligation, and our legitimate interest in defending claims | 6 years, matching the guarantee and claim periods |
| Marketing emails | Name, email | Your consent | Until you unsubscribe. We then keep your email on a do-not-contact list |
| Analytics and marketing cookies | See our Cookie Policy | Your consent | See our Cookie Policy |
| Record your cookie choices | Choices made, time, browser, IP address | Legal obligation to prove consent | 2 years |
| Prevent fraud and keep the site secure | IP address, device and browser info, order patterns | Our legitimate interest in preventing fraud | 12 months |
| Waitlist signup | Your consent | Until we launch, or until you unsubscribe |
Where the basis is our legitimate interest, we have checked that our interest does not override your rights. Ask us at privacy@schoolsteps.shop and we will explain our reasoning.
You do not have to give us any of this. But we cannot deliver shoes without a name and an address, so if you leave those out we cannot accept your order.
Email from us comes in two kinds. Order emails — confirmations, delivery updates and return updates — are part of the order itself, so they are sent for as long as you have an order with us and cannot be switched off. Offers and news are separate and never automatic: they go out only if you ask for them, either by turning them on in your account settings or by ticking the box on our contact form or catalog signup. Every one of them has an unsubscribe link, and if you have an account you can also turn them off at any time in your settings.
3. About your children
We sell children's shoes to adults. We ask for a shoe size, and you may tell us a child's first name for a delivery label — that is all, and we do not build profiles of children or market to them.
Our shop is not aimed at children and accounts are for over-18s. Under the Cyprus law 125(I)/2018, a child in Cyprus can consent to online services from age 14; below that, a parent must consent. If you believe a child has given us data without your consent, email privacy@schoolsteps.shop and we will delete it.
4. Who else sees your data
We do not sell, rent or trade your personal data. We share it only with:
- Stripe — to take payment. Stripe receives your card details directly; we never see the full number.
- Google (Firebase) — hosting, login and our database.
- Google Ads — its tag loads with consent denied by default and may send limited cookieless signals; with your marketing consent, it measures ad visits, product-detail views and purchases. See our Cookie Policy for the data sent.
- Our courier — your name, address and phone number, so they can deliver.
- Our accountant, and the tax authorities — invoices and order records, as the law requires.
- Authorities or courts — if we are legally required to hand something over.
If our business is ever sold or merged, your data may transfer with it. You would be told first, and this policy would continue to apply until you were told otherwise.
5. Data sent outside Europe
Stripe and Google are US companies and some of your data is processed outside the European Economic Area. That transfer is covered by the European Commission's adequacy decision for the EU–US Data Privacy Framework, and by Standard Contractual Clauses approved by the Commission where the Framework does not apply.
You can ask us at privacy@schoolsteps.shop for a copy of the safeguards that apply.
6. How we protect your data
The site runs over HTTPS. Passwords are hashed, not stored. Access to customer data is limited to the people who need it, and card details never touch our servers.
No system is perfectly secure. If a breach ever puts your rights at risk, we will tell the Office of the Commissioner for Personal Data Protection within 72 hours and tell you without undue delay.
7. Your rights
Under the GDPR you can ask us to:
- Give you a copy of the data we hold about you
- Correct it if it is wrong or incomplete
- Delete it, where we do not have to keep it by law
- Restrict what we do with it while a dispute is sorted out
- Send it elsewhere, in a machine-readable format
- Stop processing based on legitimate interest — you can object at any time
- Withdraw consent at any time, for anything based on consent. This does not undo what we did before you withdrew it.
We do not make any decision about you by automated means alone, and we do not profile you.
Signed-in customers can download a machine-readable JSON copy of their account data and submit access, correction, restriction, objection, portability or erasure requests from account settings. You can also email privacy@schoolsteps.shop. We verify the requester before disclosing or deleting data. We reply within one month. If your request is complicated we may need up to two months more, and we will tell you within the first month if so. It is free, unless a request is clearly excessive or repetitive.
When you ask us to erase your account, we delete data that is no longer needed and anonymise transaction records that must be retained for accounting, warranty, fraud prevention or legal claims. We record completion without retaining your identity.
8. Complaining
If you are unhappy with how we handle your data, please tell us first at privacy@schoolsteps.shop. You also have the right to complain directly to the Office of the Commissioner for Personal Data Protection in Cyprus:
You do not have to come to us first. You can go straight to them.
9. Cookies
Cookies and similar technologies are covered separately on our Cookie Policy page, including how to change your choices.
10. Other websites
Our pages sometimes link elsewhere. Once you follow a link, this policy stops applying and the other site's does.
11. Changes to this policy
If we change this policy in a way that affects you, we will update the date at the top and, for anything significant, email registered customers. We will ask for your consent again where the law requires it — your continued use of the site is not treated as agreement to a material change.
12. Contact us
- Privacy questions: privacy@schoolsteps.shop
- Everything else: info@schoolsteps.shop
- Post: Kypos Ltd, Voreiou Ipeirou 2, Oasis Park, Flat/Office Q2, 8035 Paphos, Cyprus