This Privacy Policy describes how Rawrawk ("we", "us", or "our") collects, uses, and discloses your personal data when you visit rawrawk.com (the "Site"), send us an enquiry, subscribe to our newsletter, or otherwise communicate with us.
This Site does not have user accounts, and no payment is taken through it. We do not ask you to register, and we never collect card details or bank credentials on this website. When you pay an invoice by card after we quote you, that payment is processed by a regulated payment provider; card numbers and security codes go to that provider, not to Rawrawk.
Data Controller
Rawrawk Unipessoal Lda, Vila Nova de Paiva, Portugal (NIF PT 518613593) is the controller of your personal data. You can reach us at hello@rawrawk.com. Full company details are on our Imprint page.
Changes to this Privacy Policy
We may periodically update this policy to reflect changes to our practices, or for operational, legal, or regulatory reasons. Updates will be posted on this page with an updated "Last updated" date.
What We Collect, Why, and On What Legal Basis
Enquiry form
When you send an enquiry we collect your name, email address, shipping country, the product you are interested in, and anything you write in the message field. We use this to reply to you, prepare a quote, and, if you go ahead, fulfil your order. Legal basis: performance of a contract or steps taken at your request prior to entering into one (Art. 6(1)(b) GDPR), and our legitimate interest in responding to enquiries (Art. 6(1)(f)).
Newsletter
If you subscribe we collect your email address and use it to send occasional updates about new builds, restocks, and workshop news. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time by emailing hello@rawrawk.com, and we will remove you promptly. Withdrawing consent does not affect processing carried out before you withdrew it.
Orders and correspondence
If you place an order we additionally process your billing and delivery address and the details needed to raise an invoice and arrange carriage. Legal basis: performance of a contract (Art. 6(1)(b)) and compliance with our legal obligations, including tax and accounting law (Art. 6(1)(c)).
If you settle the invoice by card, our payment provider processes your payment data (including card details) to take the payment and confirm it to us. We receive confirmation that you paid, the amount, and reference information needed for accounting — not your full card number or security code. Legal basis for that processing: performance of a contract (Art. 6(1)(b)). The provider acts as an independent controller or processor under its own privacy notice for the card data it collects.
Analytics
If — and only if — you accept analytics cookies, we use Google Analytics 4 to understand how visitors use the Site (pages viewed, approximate location derived from a truncated IP address, device and browser type). IP anonymisation is enabled. Legal basis: your consent (Art. 6(1)(a) GDPR and the ePrivacy rules on storing information on your device). If you decline, no analytics cookies are set and no analytics data is sent.
Server logs and security
Our hosting provider automatically records standard technical information such as IP address, timestamp, and requested URL, in order to deliver the site and protect it from abuse. Legal basis: our legitimate interest in operating and securing the Site (Art. 6(1)(f)).
Fonts and other static assets
The typefaces used on the Site (Space Grotesk, Hanken Grotesk, and our brand face Chaney) are hosted on our own server. We do not load fonts from Google Fonts or any other third-party font CDN. Visiting the Site therefore does not send your IP address to Google (or similar) solely for the purpose of delivering fonts. Font files are static assets served by our host, like images and stylesheets.
Cookies
We use two categories of cookies and similar technologies:
- Strictly necessary — a single small record of your cookie choice, so we do not ask you again on every page. This is set regardless of your choice because the Site cannot remember your preference otherwise. No consent is required for it.
- Analytics (optional) — Google Analytics 4 cookies, set only after you click "Accept". These typically expire within 24 months.
You can change or withdraw your choice at any time using the "Cookie settings" link in the footer of any page, or by clearing cookies in your browser. We do not use advertising, retargeting, or profiling cookies, and we do not sell personal data.
Who We Share Data With
We share personal data only with processors and partners who need it to provide our service:
- Our website hosting and form-handling provider, which receives enquiry and newsletter submissions on our behalf
- Google, as the provider of Google Analytics 4, where you have consented
- Shipping and logistics carriers, to deliver your order
- Our accountants and banking providers, to raise and reconcile invoices
- Our regulated payment provider, when you choose to pay an invoice by card — it processes the payment and confirms settlement to us (see “Orders and correspondence” above)
- Public authorities, where we are legally required to disclose
We do not share your data with marketing partners or data brokers, and we do not sell it.
International Transfers
Some of our providers process data outside the European Economic Area, including in the United States. Where that happens, transfers are made under appropriate safeguards — typically the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. You may request a copy of the relevant safeguards by contacting us.
How Long We Keep It
- Enquiries that do not lead to an order: up to 24 months, then deleted.
- Order and invoice records: retained for as long as Portuguese tax and accounting law requires (currently 10 years).
- Newsletter subscriptions: until you unsubscribe, plus a minimal record of the unsubscribe request.
- Analytics data: retained by Google for a maximum of 14 months.
Security
The Site is served over HTTPS and we apply reasonable technical and organisational measures to protect personal data. No system is perfect, however, and we cannot guarantee the security of information transmitted over the internet.
Your Rights Under the GDPR
If you are in the European Economic Area or the United Kingdom, you have the right to:
- Access the personal data we hold about you
- Have inaccurate data rectified
- Have your data erased ("right to be forgotten")
- Restrict how we process your data
- Receive your data in a portable format
- Object to processing based on our legitimate interests
- Withdraw consent at any time, where processing is based on consent
To exercise any of these, email hello@rawrawk.com. We respond within one month. You also have the right to lodge a complaint with a supervisory authority — in Portugal this is the Comissão Nacional de Proteção de Dados (CNPD), and elsewhere the authority in your country of residence.
Children's Data
We do not knowingly collect personal data from children under the age of 16. If you believe we have inadvertently collected information about a child, please contact us to request removal.
Contact Information
For questions regarding this Privacy Policy or our privacy practices, please contact us at hello@rawrawk.com.