PRIVACY POLICY & DATA PROTECTION

Last updated: 15 September 2026

Ambassador Boutique respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, disclose and otherwise process personal data when you visit or use www.ambassadorboutique.com (the “Website”), create or use a customer account, browse or purchase products, contact us, submit a review, subscribe to our communications, interact with us through social media, or otherwise interact with Ambassador Boutique.

Ambassador Boutique is a Luxembourg-based online retail business offering selected products, accessories and other items for dogs and cats.

Our products may include, depending on the products available from time to time, accessories, lifestyle products, practical items, gifts and other products intended for pets and their owners.

We currently offer products for delivery within the European Union, the United Kingdom, Switzerland, Iceland and Norway, subject to the destinations made available through the Website.

This Privacy Policy is intended to comply with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), applicable Luxembourg data protection legislation and applicable rules concerning electronic communications, cookies and direct marketing.

This Privacy Policy should be read together with our Terms & Conditions, Cookie Policy, Shipping & Delivery Policy and Returns & Refund Policy, where applicable.

1. WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?

The controller responsible for the processing of your personal data is:

LEOPOLDS SARL-S
Ambassador Boutique
1A, Rue de Fort Wallis
L-2714 Luxembourg
Grand Duchy of Luxembourg

Email: contact@ambassadorboutique.com
Website: www.ambassadorboutique.com

In this Privacy Policy, “Ambassador Boutique”, “we”, “us” and “our” refer to LEOPOLDS SARL-S acting as the data controller.

If you have any questions concerning the processing of your personal data, you may contact us at:

contact@ambassadorboutique.com

At the date of this Privacy Policy, we have not identified a separate Data Protection Officer (“DPO”) in this document. If a DPO is appointed where required by applicable law, the relevant contact details will be made available.

2. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies to personal data processed in connection with:

• your visit to the Website;
• browsing and searching the Website;
• use of the online shop;
• creation and use of a customer account;
• purchases and orders;
• payment and delivery;
• returns, refunds and customer service;
• product reviews and other user-generated content;
• newsletter and marketing communications;
• product availability notifications, where offered;
• wish lists, favourites or similar functionality, where offered;
• cookies and similar technologies;
• Website analytics and advertising, where applicable;
• fraud prevention and Website security;
• communications with Ambassador Boutique; and
• the exercise of your rights under applicable data protection law.

Certain processing activities may be subject to additional or specific notices where required by law.

Where the Website contains links to third-party websites, platforms or services, those third parties may process personal data independently under their own privacy policies.

3. WHAT PERSONAL DATA DO WE PROCESS?

The categories of personal data we process depend on how you interact with us.

We do not seek to collect more personal data than is reasonably necessary for the relevant purpose.

3.1 Identification and contact information

This may include:

• first name;
• last name;
• email address;
• telephone or mobile number;
• billing address;
• delivery address;
• country of residence or delivery;
• customer number or account identifier; and
• other contact information you voluntarily provide.

3.2 Customer account information

If you create a customer account, we may process:

• name;
• email address;
• password or authentication information;
• saved addresses;
• account preferences;
• order history;
• returns and refund information;
• saved products or favourites, where this functionality is available;
• communication preferences;
• account activity; and
• other information associated with your account.

Your account allows you to manage relevant information, access order history and use other account functionality made available through the Website.

3.3 Order and purchase information

When you place an order, we may process:

• order number;
• order date and time;
• products purchased;
• quantities;
• product prices;
• discounts or promotions applied;
• billing information;
• delivery information;
• customer number;
• payment status;
• return and refund information;
• correspondence concerning the order; and
• information necessary to fulfil and administer the transaction.

3.4 Payment information

Depending on the payment method selected, we may process:

• payment method;
• transaction reference;
• payment status;
• billing information; and
• other information necessary to process or confirm the payment.

Payment card or other financial information may be processed directly by third-party payment service providers.

Where a third-party payment provider processes your payment, we generally do not need to receive or retain your complete payment card details.

Payment providers may act either as independent controllers or as processors, depending on their role and the relevant service.

3.5 Delivery and logistics information

To deliver your order, we may process:

• recipient name;
• delivery address;
• email address;
• telephone number, where required or provided;
• order number;
• shipment information;
• tracking information; and
• information concerning delivery problems or failed delivery attempts.

Where necessary, we may provide relevant information to the courier, postal operator or logistics provider responsible for delivering your order.

Such information is limited to what is reasonably necessary for delivery and related services.

3.6 Technical and log information

When you access the Website, your browser or device may automatically transmit technical information to our servers.

Depending on the technical configuration of the Website, this may include:

• IP address;
• date and time of access;
• requested page or resource;
• browser type and version;
• operating system;
• device type;
• language and regional settings;
• referring URL;
• pages visited;
• technical identifiers;
• information concerning successful or unsuccessful requests;
• approximate location derived from the IP address; and
• other technical information necessary for Website operation and security.

This information may be recorded in server or security logs.

We use such information primarily to operate, maintain, secure and troubleshoot the Website and our IT infrastructure.

3.7 Customer service and correspondence

When you contact us, we may process:

• your name;
• email address;
• telephone number;
• order information;
• customer account information;
• the content of your communication;
• attachments you voluntarily provide;
• records of previous communications; and
• information necessary to resolve your request.

This may include enquiries concerning products, orders, delivery, returns, refunds, payments or complaints.

3.8 Reviews and user-generated content

Where the Website allows customers to submit product reviews, ratings, photographs, comments, testimonials or other content, we may process:

• name or display name;
• email address;
• review or rating;
• photograph or other content submitted;
• product reviewed;
• order information where necessary to verify a purchase; and
• correspondence concerning the review.

You may choose what information you include in a public review.

Please do not publish sensitive personal information or personal information concerning another individual in a public review.

Where applicable, you may request deletion or correction of your review by contacting us at:

contact@ambassadorboutique.com

3.9 Newsletter and marketing information

If you subscribe to our newsletter or marketing communications, we may process:

• email address;
• name, where provided;
• communication preferences;
• consent records;
• unsubscribe records;
• information about your interaction with marketing communications, where tracking has been lawfully enabled; and
• information concerning your preferences or interests where this processing is legally permitted.

3.10 Product preferences, favourites and wish lists

Where the Website offers functionality such as favourites, wish lists or saved products, we may process information about the products you choose to save.

This may include:

• customer or account identifier;
• saved products;
• product searches;
• favourite products;
• shopping-cart information; and
• relevant account activity.

This information may be used to provide the functionality you requested and improve your shopping experience.

Where legally permitted, product preferences may also be used to make product recommendations or personalise Website content.

3.11 Information relating to pets

Because Ambassador Boutique sells products for dogs and cats, you may voluntarily provide information about your pet when communicating with us, submitting a review, participating in promotional content or discussing a product.

Examples may include:

• pet name;
• species;
• breed;
• size;
• age;
• preferences; or
• photographs.

Information relating to an animal is not generally personal data in itself.

However, if information about a pet is connected to an identifiable individual, it may constitute personal data concerning that individual.

Where such information constitutes personal data, we process it in accordance with this Privacy Policy and applicable law.

We do not require you to provide pet information merely to browse or purchase products unless the information is specifically necessary for a particular service.

4. HOW DO WE COLLECT PERSONAL DATA?

We collect personal data through several channels.

4.1 Information provided directly by you

You may provide personal data when you:

• create an account;
• place an order;
• complete checkout;
• subscribe to marketing communications;
• contact customer service;
• request information;
• submit a review;
• submit photographs or other content;
• create a wish list or favourite products;
• request a product availability notification;
• participate in a promotion;
• communicate with us through social media; or
• otherwise voluntarily provide information.

4.2 Information collected automatically

Certain technical information is automatically collected when you use the Website.

This may occur through:

• server logs;
• cookies;
• pixels;
• tags;
• local storage;
• similar technologies; and
• security technologies.

Non-essential cookies and similar technologies are subject to the applicable consent requirements described in our Cookie Policy.

4.3 Information received from third parties

Where necessary and legally permitted, we may receive personal data from:

• payment providers;
• delivery and logistics providers;
• fraud prevention providers;
• IT and hosting providers;
• analytics providers;
• advertising providers;
• social media platforms;
• customer service providers;
• professional advisers;
• business partners; and
• other service providers supporting our business.

Where personal data is received from a third party, we process it in accordance with applicable law and, where required, provide the information required under GDPR Articles 13 or 14.

5. WHY DO WE PROCESS YOUR PERSONAL DATA?

We may process personal data for the following purposes.

5.1 Website operation

We process technical information to:

• operate the Website;
• display pages and products;
• maintain Website stability;
• maintain security;
• troubleshoot errors;
• prevent misuse;
• monitor technical performance; and
• improve the Website.

Legal basis: primarily our legitimate interests under Article 6(1)(f) GDPR, or performance of a contract where processing is necessary to provide a requested service.

5.2 Customer account

We process account information to:

• create your account;
• authenticate you;
• allow you to log in;
• maintain your account;
• store information you choose to save;
• provide access to order history;
• manage saved addresses and preferences; and
• provide account-related services.

Legal basis: performance of a contract under Article 6(1)(b) GDPR.

5.3 Order processing and delivery

We process order information to:

• receive and process your order;
• confirm your purchase;
• process payment;
• prepare products for dispatch;
• arrange delivery;
• communicate delivery information;
• provide tracking information;
• handle returns;
• process refunds;
• provide customer support; and
• comply with legal obligations relating to the transaction.

Legal basis: performance of a contract under Article 6(1)(b) GDPR and, where applicable, compliance with legal obligations under Article 6(1)(c).

5.4 Payment processing

We process relevant information to facilitate and verify payment for your purchases.

Depending on the payment method, relevant information may be transmitted to the selected payment service provider.

Legal basis: performance of a contract under Article 6(1)(b) GDPR and, where applicable, compliance with legal obligations.

5.5 Customer service

We process information to:

• answer enquiries;
• investigate complaints;
• provide support;
• resolve order issues;
• handle returns and refunds;
• communicate with you about your purchases; and
• maintain appropriate customer-service records.

Legal basis: performance of a contract, compliance with legal obligations and/or our legitimate interests, depending on the circumstances.

5.6 Fraud prevention and security

We may process information such as:

• name;
• email address;
• billing and delivery information;
• payment information;
• IP address;
• browser and device information;
• account information;
• order history; and
• transaction information

to detect and prevent:

• fraudulent orders;
• payment abuse;
• account misuse;
• identity misuse;
• suspicious transactions;
• automated attacks;
• spam;
• security incidents; and
• other unlawful or abusive activity.

We may use automated tools or risk indicators for security and fraud-prevention purposes where appropriate.

Where a decision is made solely through automated processing and has legal or similarly significant effects on you, we will comply with the specific requirements and safeguards of GDPR Article 22.

Legal basis: primarily our legitimate interests under Article 6(1)(f) GDPR and, where applicable, compliance with legal obligations under Article 6(1)(c).

5.7 Legal and regulatory compliance

We may process personal data to comply with applicable:

• tax requirements;
• accounting obligations;
• consumer protection laws;
• product safety obligations;
• legal reporting obligations;
• regulatory requirements;
• court orders;
• requests from competent authorities; and
• other legal obligations.

Legal basis: Article 6(1)(c) GDPR.

5.8 Legal claims and dispute management

We may process personal data where necessary to:

• establish legal claims;
• exercise legal rights;
• defend claims;
• resolve disputes;
• investigate complaints; or
• comply with judicial proceedings.

Legal basis: our legitimate interests and, where applicable, the establishment, exercise or defence of legal claims.

6. LOG FILES AND TECHNICAL SECURITY

For technical reasons, when you access the Website, certain access information may be recorded in server or security logs.

This may include:

• IP address;
• requested page;
• date and time;
• browser;
• operating system;
• referring URL;
• device information;
• amount of data transferred;
• status of the request; and
• other technical information necessary for security and operation.

We use this information to:

• maintain the technical operation of the Website;
• identify errors;
• detect attacks;
• prevent abuse;
• protect our systems; and
• investigate security incidents.

Log data is retained only for as long as reasonably necessary for the relevant technical, security or legal purpose.

Where possible and appropriate, technical information may be anonymised or deleted after the relevant retention period.

Legal basis: Article 6(1)(f) GDPR, based on our legitimate interests in maintaining a secure and reliable Website.

7. COOKIES AND SIMILAR TECHNOLOGIES

Ambassador Boutique uses cookies and similar technologies.

Cookies may be used for:

• essential Website functions;
• authentication;
• shopping-cart functionality;
• security;
• remembering preferences;
• analytics;
• Website performance;
• functionality and personalisation;
• advertising;
• marketing measurement; and
• other purposes described in our Cookie Policy.

The exact cookies and technologies used on the Website may change over time.

For this reason, the current list of cookies, providers, purposes and retention periods should be consulted in our Cookie Policy and cookie preference centre.

7.1 Necessary cookies

Certain cookies are strictly necessary for the Website or a service specifically requested by you.

Examples may include cookies used for:

• shopping cart functionality;
• checkout;
• customer authentication;
• security;
• session management; and
• remembering your cookie consent choice.

Under Luxembourg rules, strictly necessary cookies may generally be used without prior consent when they fall within the applicable legal exemption.

7.2 Analytics and performance cookies

We may use analytics or performance technologies to understand:

• how visitors use the Website;
• which pages are visited;
• how products are viewed;
• Website performance;
• technical problems; and
• general Website usage.

Where consent is required, analytics cookies will only be activated after obtaining your prior consent.

Under the Luxembourg CNPD’s current guidance, analytics cookies generally require consent unless a specific exception applies.

Legal basis where consent is required: Article 6(1)(a) GDPR.

7.3 Functional cookies

Functional cookies may allow the Website to remember preferences or provide additional functionality.

Where these cookies are not strictly necessary, they will be activated only in accordance with applicable consent requirements.

Legal basis where consent is required: Article 6(1)(a) GDPR.

7.4 Advertising and targeting technologies

Where used, advertising and targeting technologies may enable us or our advertising partners to:

• measure advertising campaigns;
• understand interactions with advertising;
• show relevant advertisements;
• create or use advertising audiences; or
• measure conversions.

Such technologies may involve cookies, advertising IDs, pixels or similar technologies.

Where consent is required, these technologies will not be activated before the necessary consent has been obtained.

Legal basis: Article 6(1)(a) GDPR where consent is required.

7.5 Social media plugins and embedded content

The Website may contain links, buttons, embedded content or other integrations relating to social media or third-party platforms.

Where a third-party integration requires access to your device information or uses non-essential cookies, the relevant technology will be subject to the applicable consent requirements.

Once you interact directly with a third-party platform, that platform may independently process your personal data under its own privacy policy.

We do not control the subsequent processing performed by such third parties.

7.6 Managing cookie consent

Where non-essential cookies are used, you can manage your preferences through the Website’s cookie consent mechanism.

You may:

• accept non-essential cookies;
• refuse them;
• choose individual categories;
• change your preferences; and
• withdraw consent.

Under Luxembourg CNPD guidance, consent for non-essential cookies must be given through a clear affirmative action and must be capable of being withdrawn as easily as it was given.

The CNPD currently recommends that cookie consent should generally be renewed no later than every 12 months, unless circumstances require an earlier renewal.

8. WEBSITE ANALYTICS

We may use analytics tools to understand and improve the performance and usability of the Website.

Depending on the tools actually implemented, analytics may involve information such as:

• pages visited;
• products viewed;
• navigation paths;
• session information;
• approximate geographical information;
• device and browser information;
• referring source;
• interactions with Website features; and
• conversion information.

Analytics technologies that require prior consent will only be used after the required consent has been obtained.

The specific analytics providers used by Ambassador Boutique may change over time. Current information should therefore be consulted in the Cookie Policy and cookie preference centre.

9. PERSONALISED CONTENT, RECOMMENDATIONS AND PROFILING

Where legally permitted, Ambassador Boutique may analyse information such as:

• products viewed;
• products searched for;
• products added to the shopping cart;
• products purchased;
• saved products or favourites;
• order history; and
• interactions with the Website

to improve the shopping experience and make relevant product recommendations.

Such processing may help us:

• improve product presentation;
• organise our product range;
• understand customer preferences;
• display products that may be relevant to you; and
• improve our communications.

Where such processing is based on our legitimate interests, you have the right to object in accordance with Article 21 GDPR.

Where profiling relies on consent, you may withdraw your consent at any time.

We do not intend to use profiling to make decisions producing legal or similarly significant effects on you.

10. CUSTOMER REVIEWS AND QUALITY FEEDBACK

Where Ambassador Boutique provides a product review or customer feedback functionality, you may voluntarily provide a rating, review, photograph or other feedback.

We may use this information to:

• display customer reviews;
• improve products and services;
• monitor customer satisfaction;
• improve customer experience; and
• maintain the quality of our online shop.

Where a review is published publicly, the name or display name associated with the review may also be displayed, depending on the functionality offered and your choices.

Where we use an external review provider, the provider may process relevant information on our behalf or as an independent controller, depending on the service.

We will not state that a particular review provider is used unless that provider is actually implemented on the Website.

11. NEWSLETTER AND EMAIL MARKETING

If you subscribe to our newsletter, we will use your email address to send you communications concerning Ambassador Boutique, including where relevant:

• new products;
• new arrivals;
• collections;
• promotions;
• special offers;
• pet-related content;
• seasonal campaigns; and
• other Ambassador Boutique communications.

Legal basis: Article 6(1)(a) GDPR where consent is required.

Where applicable Luxembourg law permits electronic marketing to existing customers concerning similar products following a purchase, we may rely on the applicable legal exception, provided all statutory conditions are satisfied and an easy opt-out is provided.

11.1 Marketing tracking

Where permitted and where you have provided the necessary consent, our marketing emails may use technologies such as tracking pixels or similar mechanisms to determine:

• whether an email was delivered;
• whether it was opened;
• whether links were clicked; and
• how recipients interact with the communication.

We may use this information to improve the relevance and performance of our communications.

Where such tracking requires consent, it will be used only on the applicable legal basis.

11.2 Unsubscribing from marketing emails

You may opt out of marketing communications at any time by:

• using the unsubscribe link contained in the relevant email;
• changing your communication preferences where account functionality permits; or
• contacting us at contact@ambassadorboutique.com.

If you unsubscribe from marketing communications, you may still receive transactional or service-related communications that are necessary to fulfil an order or administer your account.

12. PRODUCT AVAILABILITY NOTIFICATIONS

Where the Website offers a product availability notification, you may request to receive an email when a selected product becomes available again.

If you request such a notification, we may process:

• your email address;
• the product selected;
• the date of your request; and
• information necessary to administer the notification.

The information will be used for the specific availability notification unless you separately consent to marketing communications.

Where a product availability mailing list is no longer required, the relevant information may be deleted or anonymised.

Legal basis: consent under Article 6(1)(a) GDPR where the notification is requested by you.

13. WISH LISTS AND SAVED PRODUCTS

Where available, you may save products to a wish list or favourites list.

We may process:

• your customer or account identifier;
• the products saved;
• date/time information; and
• information necessary to provide the functionality.

The information is used to provide the requested functionality and is associated with your account where applicable.

Legal basis: performance of a contract under Article 6(1)(b) GDPR.

14. COMMERCIAL COMMUNICATIONS AND POSTAL MARKETING

Where permitted by applicable law, Ambassador Boutique may send postal marketing communications to customers or prospective customers where there is an appropriate legal basis.

If we use external service providers to print, prepare or distribute postal marketing, relevant personal data may be shared with those providers solely to the extent necessary for the service.

You may object to postal marketing at any time by contacting:

contact@ambassadorboutique.com

15. WHO DO WE SHARE PERSONAL DATA WITH?

We do not sell your personal data.

We do not disclose personal data to unauthorised third parties.

However, operating an online retail business requires us to work with certain service providers and other recipients.

Depending on the circumstances, personal data may be disclosed to the following categories.

15.1 Hosting and IT providers

We may use:

• hosting providers;
• cloud infrastructure providers;
• database providers;
• cybersecurity providers;
• technical support providers; and
• other IT service providers.

They may access personal data where necessary to provide their services.

Where they act as processors, appropriate data processing agreements are put in place as required by GDPR.

15.2 Payment service providers

Payment-related information may be transmitted to the payment provider selected by you.

The provider may process personal data either as an independent controller or processor depending on the service.

15.3 Delivery and logistics providers

We may provide delivery providers with:

• recipient name;
• delivery address;
• email address;
• telephone number, where necessary;
• order/shipment reference; and
• information necessary to deliver your order.

This information is provided only to the extent necessary for delivery and related services.

15.4 Customer service providers

Where external providers support our customer service operations, they may process relevant information under appropriate contractual arrangements.

15.5 Analytics and advertising providers

Where analytics or advertising technologies are used, relevant information may be shared with the applicable provider, subject to the applicable legal basis and consent requirements.

15.6 Professional advisers

We may disclose personal data to:

• lawyers;
• accountants;
• auditors;
• insurers;
• tax advisers; and
• other professional advisers

where reasonably necessary for the operation or protection of our business.

15.7 Authorities and courts

We may disclose personal data to courts, law enforcement agencies, regulators, customs authorities, tax authorities or other competent public bodies where:

• we are legally required to do so;
• the request is legally valid;
• necessary to establish, exercise or defend legal claims; or
• necessary to protect our rights or the rights of others.

We assess requests from authorities and courts before disclosing information and disclose only information that is legally required or otherwise permitted.

Legal bases: Article 6(1)(c) and/or Article 6(1)(f) GDPR, depending on the circumstances.

16. PROCESSING OF DATA WHEN YOU EXERCISE YOUR GDPR RIGHTS

If you contact us to exercise your data protection rights, we will process the information necessary to identify you, assess your request and provide a response.

Depending on the request, this may include:

• first and last name;
• email address;
• address;
• customer/account information;
• order information;
• the content of your request;
• information used to verify your identity; and
• correspondence concerning the request.

We may request reasonable additional information where necessary to verify your identity and protect personal data from unauthorised disclosure.

We will process information relating to your request separately where appropriate in order to document compliance with our legal obligations and the principle of accountability under GDPR.

Legal basis: Article 6(1)(c) GDPR where processing is necessary to comply with our legal obligations.

We will retain information concerning rights requests only for as long as reasonably necessary to document and defend our compliance with applicable legal obligations and limitation periods.

17. INTERNATIONAL DATA TRANSFERS

Ambassador Boutique is established in Luxembourg and operates within the European regulatory framework.

Some of our service providers may operate or process information from locations outside the European Economic Area (“EEA”).

Where personal data is transferred to a country outside the EEA, we will ensure that the transfer complies with Chapter V GDPR.

Depending on the circumstances, the transfer may be based on:

• a European Commission adequacy decision;
• Standard Contractual Clauses adopted by the European Commission;
• Binding Corporate Rules;
• another legally recognised transfer mechanism; or
• a specific derogation permitted under Article 49 GDPR where applicable.

The Luxembourg CNPD confirms that, where no adequacy decision applies, appropriate safeguards such as Standard Contractual Clauses may be used for international transfers.

Where required by GDPR, we will provide additional information concerning the relevant transfer and safeguards upon request.

18. WHERE IS YOUR DATA STORED?

Personal data may be stored on systems operated by Ambassador Boutique and by service providers acting on our behalf.

Depending on the services actually used, these systems may include:

• Website hosting infrastructure;
• e-commerce systems;
• cloud services;
• payment systems;
• customer service systems;
• email systems;
• security systems; and
• backup systems.

We will not state that a particular cloud provider, server location or technology is used unless it is actually part of our infrastructure.

Where service providers process personal data on our behalf, appropriate contractual and organisational safeguards will be implemented.

19. DATA RETENTION

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy or for as long as required or permitted by law.

Retention periods depend on factors including:

• the nature of the information;
• the purpose for which it was collected;
• whether you have an active customer account;
• whether you have an ongoing customer relationship;
• whether you have placed an order;
• tax and accounting requirements;
• consumer protection requirements;
• warranty and legal guarantee periods;
• limitation periods;
• fraud prevention requirements;
• legal disputes; and
• regulatory obligations.

Examples include:

Customer account data

Generally retained for as long as your account remains active, unless deletion is requested and no legal obligation requires continued retention.

Order and transaction data

May need to be retained for longer periods due to tax, accounting, consumer protection and legal obligations.

Marketing data

Generally retained until you withdraw consent, unsubscribe or otherwise object, unless another lawful basis permits continued processing.

Rights-request data

Retained for as long as necessary to document and demonstrate compliance with legal obligations and applicable limitation periods.

Technical and security logs

Generally retained for a limited period appropriate to the relevant security and operational purpose.

When information is no longer required, it will be deleted, securely destroyed or anonymised, unless continued retention is required by law.

20. DATA SECURITY

We implement appropriate technical and organisational measures designed to protect personal data against:

• unauthorised access;
• unauthorised disclosure;
• accidental loss;
• destruction;
• alteration;
• misuse; and
• other unlawful processing.

Measures may include:

• access controls;
• authentication;
• secure account management;
• encryption where appropriate;
• secure hosting;
• backups;
• system monitoring;
• security testing;
• restricted access;
• contractual controls with service providers; and
• incident response procedures.

No electronic transmission or storage system can be guaranteed to be completely secure.

21. PERSONAL DATA BREACHES

If we become aware of a personal data breach, we will assess the incident and take appropriate measures under applicable law.

Where required by GDPR, we will notify the competent supervisory authority within the applicable legal deadline.

Where a breach is likely to result in a high risk to the rights and freedoms of individuals, we will communicate the breach to affected individuals where required by law.

22. FRAUD, ABUSE AND SECURITY MONITORING

To protect Ambassador Boutique, our customers and our Website, we may monitor transactions and technical activity for indicators of:

• fraud;
• payment abuse;
• account takeover;
• identity misuse;
• automated attacks;
• unusual ordering patterns;
• abuse of promotions;
• malicious activity; and
• other unlawful or harmful behaviour.

Information used for this purpose may include:

• order information;
• payment information;
• billing and delivery information;
• IP address;
• device information;
• browser information;
• account information;
• transaction history; and
• technical security information.

Where automated tools are used, they are intended primarily to assist security and fraud prevention.

Where applicable law gives you rights concerning automated decision-making, we will comply with those requirements.

23. LEGAL REQUESTS FROM AUTHORITIES AND COURTS

Ambassador Boutique may receive requests from:

• courts;
• police;
• prosecutors;
• customs authorities;
• tax authorities;
• regulators;
• data protection authorities; and
• other competent public authorities.

We will assess such requests and disclose personal data only where there is an appropriate legal basis, such as:

• a legal obligation under Article 6(1)(c) GDPR;
• a valid judicial or administrative order;
• the establishment, exercise or defence of legal claims; or
• a legitimate interest under Article 6(1)(f) GDPR where legally permitted.

We will seek to limit any disclosure to the information reasonably necessary for the relevant purpose.

24. YOUR RIGHTS UNDER GDPR

Subject to the applicable conditions and limitations, you may have the following rights.

24.1 Right of access

You may request confirmation as to whether we process your personal data and request access to that data and relevant information concerning the processing.

24.2 Right to rectification

You may request correction of inaccurate or incomplete personal data.

24.3 Right to erasure

You may request deletion of your personal data in circumstances provided by GDPR.

This right is not absolute and does not apply where continued processing is required or permitted by law.

24.4 Right to restriction

You may request restriction of processing in certain circumstances.

24.5 Right to data portability

Where the applicable requirements are satisfied, you may request certain personal data in a structured, commonly used and machine-readable format or request transmission to another controller.

24.6 Right to object

You may object to processing based on Article 6(1)(e) or Article 6(1)(f) GDPR on grounds relating to your particular situation.

We will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

24.7 Right to object to direct marketing

You have an absolute right to object to processing of personal data for direct marketing purposes, including profiling related to direct marketing.

24.8 Right to withdraw consent

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

24.9 Rights concerning automated decision-making

Where applicable, you may have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.

25. HOW TO WITHDRAW CONSENT OR OBJECT TO PROCESSING

Depending on the type of processing, you can withdraw consent or object as follows.

Cookies

Use the Website’s cookie preference mechanism to change or withdraw consent.

Newsletter

Use the unsubscribe link included in our marketing emails or contact:

contact@ambassadorboutique.com

Product availability notifications

You may withdraw your request by contacting us at:

contact@ambassadorboutique.com

Other consent-based processing

Contact us at:

contact@ambassadorboutique.com

Objection to legitimate-interest processing

You may contact us at any time with an objection explaining the relevant processing, where appropriate.

Deletion or other GDPR rights

Contact:

contact@ambassadorboutique.com

We may need to verify your identity before completing the request.

26. HOW TO EXERCISE YOUR DATA SUBJECT RIGHTS

To exercise your rights, contact:

LEOPOLDS SARL-S / Ambassador Boutique
1A, Rue de Fort Wallis
L-2714 Luxembourg
Grand Duchy of Luxembourg

Email: contact@ambassadorboutique.com

Please describe the request clearly.

We will generally respond within one month of receiving a valid request.

Where permitted by GDPR, this period may be extended by up to a further two months where necessary because of the complexity or number of requests. If an extension is necessary, we will inform you within the initial one-month period.

The exercise of your rights is generally free of charge.

Where GDPR permits, we may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive.

27. RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with a competent data protection supervisory authority.

For Ambassador Boutique, the relevant Luxembourg supervisory authority is:

Commission nationale pour la protection des données (CNPD)
15, Boulevard du Jazz
L-4370 Belvaux
Luxembourg

You may also have the right to lodge a complaint with the supervisory authority in the country where you live, work or where you believe that an infringement occurred, where applicable.

You do not have to contact Ambassador Boutique before contacting a supervisory authority.

28. CHILDREN’S PRIVACY

The Website is intended for adults and general consumers and is not specifically directed at children.

We do not knowingly collect personal data from children where such collection is prohibited by applicable law.

If you believe that a child has provided personal data to us unlawfully, please contact:

contact@ambassadorboutique.com

29. THIRD-PARTY WEBSITES AND SERVICES

The Website may contain links to or integrations with third-party websites and services.

Examples may include:

• payment services;
• delivery tracking;
• social media platforms;
• external review platforms;
• embedded content;
• advertising platforms; and
• other third-party services.

When you leave our Website or interact directly with a third-party service, that third party may process your personal data under its own privacy policy.

Ambassador Boutique is not responsible for the independent processing practices of third parties that we do not control.

30. SOCIAL MEDIA

Ambassador Boutique may maintain profiles or accounts on social media platforms.

If you interact with us through social media, the relevant platform may independently process your personal data.

Depending on the circumstances, Ambassador Boutique and the platform may each act as separate controllers.

The applicable platform’s privacy policy governs its own processing activities.

31. BUSINESS TRANSFERS

If Ambassador Boutique or LEOPOLDS SARL-S becomes involved in:

• a merger;
• acquisition;
• restructuring;
• sale of assets;
• financing;
• insolvency proceeding; or
• similar corporate transaction,

personal data may be transferred as part of the transaction where legally permitted.

Any such transfer will remain subject to applicable data protection requirements.

32. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect:

• changes to the Website;
• changes to our products or services;
• changes to our processing activities;
• changes in technology;
• changes to service providers;
• changes in applicable law;
• regulatory guidance; or
• changes to our business.

When we make changes, we will update the “Last updated” date at the beginning of this Privacy Policy.

Where required by law, we will provide additional notice of material changes.

33. RELATIONSHIP WITH OTHER POLICIES

This Privacy Policy forms part of the legal information available on the Website and should be read together with:

• Terms & Conditions;
• Cookie Policy;
• Shipping & Delivery Policy;
• Returns & Refund Policy; and
• other notices provided at the point where personal data is collected.

Where a specific privacy notice applies to a particular processing activity, that notice may provide additional information.

34. CONTACT INFORMATION

For questions concerning privacy, personal data, consent, objections or the exercise of your GDPR rights:

LEOPOLDS SARL-S
Ambassador Boutique
1A, Rue de Fort Wallis
L-2714 Luxembourg
Grand Duchy of Luxembourg

Email: contact@ambassadorboutique.com

Website: www.ambassadorboutique.com

35. FINAL NOTICE

This Privacy Policy is intended to explain transparently how Ambassador Boutique processes personal data.

It does not limit any rights you have under mandatory applicable data protection or consumer legislation.

If any provision of this Privacy Policy conflicts with a mandatory provision of applicable law, the mandatory legal provision will prevail.

Last updated: 15 September 2026