Privacy
Policy

Last updated: August 26, 2026

This Privacy Policy explains how VALKYRIE MARKETING SRL, trading as Bonechoir, collects, uses, stores, shares, and protects personal information when you visit www.bonechoir.com, make a purchase, contact us, subscribe to our communications, or otherwise interact with Bonechoir.

We take the privacy of our customers and visitors seriously and process personal data in accordance with applicable privacy and data-protection laws, including, where applicable:

• Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR");
• Romanian Law no. 190/2018 implementing certain provisions of the GDPR;
• applicable Romanian electronic-communications and privacy legislation;
• applicable UK data-protection legislation; and
• other privacy laws applicable to customers in the jurisdictions where we operate.

1. WHO WE ARE

For the purposes of applicable data-protection law, the data controller responsible for the personal data described in this Privacy Policy is:

Throughout this Privacy Policy, "Bonechoir", "we", "us", and "our" refer to VALKYRIE MARKETING SRL.

If you have any questions concerning this Privacy Policy or wish to exercise your privacy rights, you may contact us at:

hello@bonechoir.com

2. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies to personal data we process in connection with:

• visits to www.bonechoir.com;
• purchases and orders;
• customer accounts;
• payments;
• shipping and fulfillment;
• returns, refunds, and exchanges;
• customer support;
• email or other marketing communications;
• product reviews;
• promotional campaigns;
• analytics;
• advertising;
• cookies and similar technologies;
• social-media interactions where information is provided to us; and
• other interactions with Bonechoir.

This Privacy Policy does not govern independent websites, platforms, or services operated by third parties that have their own privacy policies.

3. WHAT IS PERSONAL DATA?

"Personal data" means information relating to an identified or identifiable individual.

Depending on how you interact with Bonechoir, personal data may include information such as:

• your name;
• email address;
• shipping address;
• billing address;
• telephone number where provided;
• order history;
• account information;
• IP address;
• device information;
• browser information;
• online identifiers;
• cookie identifiers;
• advertising identifiers;
• website activity;
• customer-support correspondence; and
• information associated with payments or transactions.

Personal data does not generally include information that has been irreversibly anonymized so that it can no longer reasonably be linked to an identifiable person.

4. PERSONAL DATA WE COLLECT

We may collect the following categories of personal data.

4.1 Identification and contact information

This may include:

• first and last name;
• email address;
• billing address;
• shipping address;
• country;
• postal code;
• telephone number where provided; and
• account username or similar identifiers.

4.2 Order and transaction information

This may include:

• products ordered;
• size;
• color;
• quantity;
• order value;
• discounts used;
• order date;
• shipping method;
• order status;
• return or refund information;
• payment status; and
• transaction identifiers.

4.3 Payment information

Payments are generally processed by Shopify Payments or another third-party payment provider.

We do not ordinarily receive or store your complete payment-card number or security code.

We may receive limited payment-related information such as:

• payment method;
• card type;
• partial card details where provided by the payment processor;
• transaction status;
• billing information; and
• payment or transaction identifiers.

4.4 Technical and device information

When you visit the Website, information may be collected automatically, including:

• IP address;
• browser type;
• operating system;
• device type;
• language;
• approximate geographic location;
• referring URL;
• pages viewed;
• time spent on pages;
• interactions with Website features;
• session identifiers; and
• cookie or similar technology identifiers.

4.5 Customer-service information

If you contact us, we may process:

• your name;
• email address;
• order number;
• correspondence;
• photographs you provide;
• return or complaint information; and
• any other information you voluntarily provide to us.

4.6 Marketing information

Where applicable, we may process:

• email-subscription status;
• marketing preferences;
• consent records;
• campaign interactions;
• email opens or clicks where permitted;
• products or collections viewed;
• advertising interactions; and
• marketing attribution information.

4.7 Reviews and user-generated content

If you submit a review, photograph, testimonial, or other user-generated content, we may process:

• your display name;
• review content;
• rating;
• photographs or videos;
• product information; and
• related submission metadata.

5. HOW WE COLLECT PERSONAL DATA

We collect personal data from several sources.

Directly from you

For example, when you:

• place an order;
• create an account;
• subscribe to emails;
• contact customer service;
• request a return;
• submit a review;
• participate in a promotion; or
• otherwise provide information to us.

Automatically

Certain information is collected automatically when you use the Website through:

• cookies;
• pixels;
• tags;
• software development tools;
• server logs; and
• similar technologies.

From our service providers

We may receive personal data from providers involved in:

• payments;
• fraud prevention;
• fulfillment;
• shipping;
• ecommerce infrastructure;
• analytics;
• advertising; and
• customer communications.

From advertising and social-media platforms

Where permitted by law and depending on your settings and interactions, we may receive information from platforms such as:

• Meta;
• Google;
• Instagram;
• Facebook; and
• other advertising or social-media services we may use.

6. WHY WE PROCESS YOUR PERSONAL DATA

We process personal data only where we have an appropriate legal basis.

Depending on the circumstances, those legal bases may include:

Performance of a contract

We process personal data where necessary to fulfill or take steps connected with a contract with you.

This includes:

• processing your order;
• collecting payment;
• arranging production;
• arranging shipping;
• sending order confirmations;
• processing returns;
• providing refunds;
• responding to order-related requests; and
• providing customer service.

Compliance with legal obligations

We may process personal data where necessary to comply with legal obligations relating to matters such as:

• accounting;
• taxation;
• consumer protection;
• product safety;
• fraud prevention;
• regulatory reporting;
• legal claims; and
• lawful requests from public authorities.

Legitimate interests

Where permitted by applicable law, we may process personal data where necessary for our legitimate business interests, provided that those interests are not overridden by your fundamental rights and freedoms.

Our legitimate interests may include:

• operating and improving our Website;
• preventing fraud and abuse;
• securing our systems;
• understanding store performance;
• improving products and services;
• maintaining business records;
• managing customer relationships;
• defending legal claims;
• measuring non-intrusive business performance; and
• preventing misuse of our services.

Consent

Where required by law, we rely on your consent for activities such as:

• certain marketing communications;
• non-essential cookies;
• personalized advertising technologies;
• certain analytics technologies; and
• similar processing.

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

7. HOW WE USE PERSONAL DATA

We may use personal data for the following purposes.

Orders and fulfillment

To:

• process orders;
• manufacture products;
• fulfill purchases;
• deliver products;
• provide tracking;
• communicate about orders; and
• resolve delivery issues.

Payments

To:

• process payments;
• verify transactions;
• handle refunds;
• detect payment fraud; and
• maintain financial records.

Customer service

To:

• answer questions;
• resolve complaints;
• process returns;
• provide product support; and
• communicate about your account or order.

Website operation

To:

• operate the Website;
• maintain shopping-cart functionality;
• remember preferences;
• provide customer accounts;
• improve usability; and
• troubleshoot technical problems.

Security and fraud prevention

To:

• detect suspicious activity;
• prevent fraud;
• protect customer accounts;
• maintain system security; and
• enforce our Terms & Conditions.

Analytics

To:

• understand Website usage;
• measure performance;
• identify popular products;
• improve navigation;
• evaluate marketing;
• understand customer journeys; and
• improve the Bonechoir experience.

Where required by law, non-essential analytics technologies will only be activated after obtaining appropriate consent.

Marketing

Where permitted by applicable law, we may use your personal data to:

• send promotional emails;
• announce new Drops;
• announce product launches;
• provide offers;
• recommend products;
• measure marketing performance; and
• communicate relevant Bonechoir news.

Advertising

Subject to applicable consent requirements, we may use advertising technologies to:

• measure advertising performance;
• understand whether an advertisement led to a purchase;
• create advertising audiences;
• show advertisements to people likely to be interested in Bonechoir;
• limit repetitive advertising; and
• improve campaign effectiveness.

8. SHOPIFY

Our online store is hosted on Shopify.

Shopify provides the ecommerce infrastructure used to operate www.bonechoir.com, including functionality relating to:

• Website hosting;
• checkout;
• customer accounts;
• orders;
• payments;
• fraud detection;
• analytics;
• ecommerce functionality; and
• customer privacy tools.

For personal data processed by Shopify on our behalf in connection with our store, Bonechoir generally acts as the controller and Shopify acts as a processor or service provider.

Shopify may also act independently as a controller in relation to certain Shopify consumer services, such as Shop or Shop Pay, where those services are provided directly by Shopify to the customer.

Shopify maintains its own privacy policies describing how it processes personal data.

Because Shopify operates internationally, personal data may be processed in countries outside Romania and outside the European Economic Area in accordance with applicable data-protection safeguards.

9. PRINTFUL AND PRODUCT FULFILLMENT

Bonechoir may use Printful as a production and fulfillment provider.

When you place an order, we may provide Printful with personal data necessary to manufacture and deliver the order.

This may include:

• customer name;
• email address where necessary;
• telephone number where required for delivery;
• shipping address;
• product ordered;
• size;
• color;
• quantity; and
• order-related information.

Printful processes this information on our behalf for purposes including:

• production;
• order fulfillment;
• shipping;
• logistics;
• customer-order support; and
• related operational services.

Printful may use affiliated companies, production facilities, delivery providers, and service providers located in different countries.

Where Printful acts on our behalf in fulfilling customer orders, it acts as a data processor subject to applicable data-processing terms.

10. PAYMENT PROVIDERS

We use third-party payment providers to process purchases.

Depending on your location and selected payment method, these may include Shopify Payments and other payment services displayed at checkout.

Payment providers may process information such as:

• your name;
• billing address;
• card or payment details;
• transaction amount;
• device information;
• fraud-prevention information; and
• transaction identifiers.

Payment providers may act as independent controllers for some of their processing activities where required by financial, anti-fraud, banking, or regulatory obligations.

Their own privacy policies apply to processing performed independently by them.

11. SHIPPING AND DELIVERY PROVIDERS

We may share personal data with:

• courier companies;
• postal operators;
• logistics providers;
• customs intermediaries; and
• other delivery partners

where necessary to deliver your order.

The information shared may include:

• your name;
• shipping address;
• telephone number;
• email address;
• tracking information; and
• other information reasonably necessary for delivery.

12. ANALYTICS

We may use analytics services, including services provided by Google, to understand how visitors interact with our Website.

Depending on your location and consent choices, these technologies may collect information including:

• IP address;
• device information;
• browser information;
• pages visited;
• referral source;
• session data;
• purchase or conversion events; and
• interactions with Website content.

Where required by law, analytics technologies that are not strictly necessary will not be activated until you provide consent.

You may manage your preferences through the cookie-consent tools available on our Website.

13. META, FACEBOOK, AND INSTAGRAM ADVERTISING

We may use advertising services provided by Meta Platforms, including technologies associated with Facebook and Instagram.

Depending on the configuration of our store and your privacy choices, these may include technologies such as:

• Meta Pixel;
• server-side or Conversions API integrations;
• advertising measurement;
• campaign attribution;
• audience creation; and
• remarketing.

These technologies may process information such as:

• browser and device information;
• IP address;
• cookie identifiers;
• products viewed;
• products added to cart;
• checkout activity;
• purchase events;
• order value;
• advertising interactions; and
• pseudonymous identifiers.

Where required under applicable law, personalized advertising and non-essential advertising technologies will only operate after the appropriate consent has been obtained.

Meta processes certain information according to its own privacy policies and may act as an independent controller for some processing activities.

14. EMAIL MARKETING

If you subscribe to Bonechoir marketing communications, we may use your contact information to send:

• new Drop announcements;
• product launches;
• restock notices;
• promotional offers;
• editorial content;
• brand updates; and
• other Bonechoir marketing.

Where consent is required, we will send such communications only after receiving valid consent.

You may unsubscribe at any time by:

• using the unsubscribe link contained in a marketing email; or
• contacting us at hello@bonechoir.com.

Unsubscribing from marketing does not prevent us from sending necessary transactional communications about an existing order.

15. COOKIES AND SIMILAR TECHNOLOGIES

Our Website uses cookies and similar technologies.

These may include:

Strictly necessary technologies

Used for functions such as:

• shopping carts;
• checkout;
• security;
• login;
• fraud prevention; and
• Website functionality.

Preference technologies

Used to remember choices such as language, region, or other preferences.

Analytics technologies

Used to understand how visitors use the Website.

Advertising technologies

Used to measure advertisements, understand conversions, and where permitted provide more relevant advertising.

Where required by law, non-essential cookies and similar technologies will only be used after obtaining consent.

You can manage your preferences using the Website's cookie banner or Manage Cookies function.

For additional information, please review our Cookie Policy.

16. WHO WE SHARE PERSONAL DATA WITH

We may disclose personal data to service providers and other recipients where reasonably necessary to operate Bonechoir.

These may include:

• Shopify;
• Printful;
• payment providers;
• delivery companies;
• logistics providers;
• email service providers;
• analytics providers;
• advertising platforms;
• fraud-prevention providers;
• IT and hosting providers;
• professional advisers;
• accountants;
• legal advisers;
• regulators; and
• public authorities where legally required.

We require processors acting on our behalf to process personal data in accordance with applicable contractual and data-protection requirements.

We do not disclose personal data to third parties simply for unrelated purposes without an appropriate lawful basis.

17. SALE OR SHARING OF PERSONAL DATA

Bonechoir does not sell personal data for money.

Certain privacy laws may define terms such as "sale", "sharing", or "targeted advertising" more broadly than an exchange of personal data for money.

For example, the use of advertising technologies may, in some jurisdictions, constitute "sharing" or processing for targeted advertising even where no monetary payment is received in exchange for personal data.

Where applicable, we provide required consent, opt-out, or privacy-control mechanisms.

You may also manage relevant advertising and cookie choices through the privacy settings available on the Website.

18. INTERNATIONAL TRANSFERS

Some of our service providers operate internationally.

As a result, personal data may be transferred to or processed in countries outside Romania or outside the European Economic Area ("EEA").

These countries may have privacy laws that differ from those in your home country.

Where personal data subject to the GDPR is transferred outside the EEA, we seek to ensure that appropriate safeguards are used as required by applicable law.

These safeguards may include:

• European Commission adequacy decisions;
• Standard Contractual Clauses;
• approved Binding Corporate Rules;
• legally recognized transfer frameworks; or
• other lawful transfer mechanisms.

For example, Shopify uses mechanisms including Binding Corporate Rules and Standard Contractual Clauses for certain international transfers.

Printful also states that it uses appropriate safeguards, including Standard Contractual Clauses where applicable, for international transfers.

19. HOW LONG WE KEEP PERSONAL DATA

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and to meet applicable legal, regulatory, accounting, tax, security, and dispute-resolution requirements.

Retention periods depend on the type of information and why it is processed.

For example:

Order and transaction information

May be retained for the period necessary to comply with:

• Romanian accounting requirements;
• taxation requirements;
• consumer-protection obligations;
• contractual limitation periods; and
• legal or regulatory obligations.

Customer-service correspondence

May be retained for a reasonable period after a matter has been resolved in case the correspondence is required to address follow-up requests, complaints, or legal claims.

Marketing information

May generally be retained until:

• you unsubscribe;
• you withdraw consent where applicable;
• the information is no longer necessary; or
• we determine that continued retention is no longer appropriate.

We may retain limited suppression information after an unsubscribe to ensure that your marketing preference continues to be respected.

Analytics information

Retention depends on the settings and policies of the relevant analytics services.

Where information is no longer required, we may delete or anonymize it.

20. SECURITY

We take reasonable technical and organizational measures designed to protect personal data against:

• unauthorized access;
• loss;
• misuse;
• alteration;
• disclosure; and
• destruction.

Measures may include:

• access restrictions;
• password and account controls;
• secure ecommerce infrastructure;
• encrypted data transmission where appropriate;
• third-party security measures;
• monitoring;
• fraud-prevention tools; and
• administrative controls.

However, no online system can be guaranteed to be completely secure.

You are responsible for keeping any account credentials confidential and should notify us if you suspect unauthorized use of your account.

21. YOUR GDPR RIGHTS

If the GDPR applies to you, you may have the following rights, subject to the conditions and limitations provided by law.

Right of access

You may request confirmation of whether we process your personal data and request access to that data.

Right to rectification

You may ask us to correct inaccurate or incomplete personal data.

Right to erasure

You may ask us to delete your personal data in circumstances where the legal requirements for deletion are satisfied.

This right is not absolute. We may need to retain certain information where required by law or necessary for legitimate legal purposes.

Right to restriction

You may ask us to restrict certain processing of your personal data in circumstances provided by law.

Right to data portability

Where applicable, you may request certain personal data in a structured, commonly used, machine-readable format or ask us to transmit it to another controller where technically feasible.

Right to object

You may object to processing based on legitimate interests in circumstances provided by law.

Where personal data is processed for direct marketing, you may object to such processing at any time.

Right to withdraw consent

Where processing is based on consent, you may withdraw your consent at any time.

Rights concerning automated decision-making

Where applicable, you may have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

Bonechoir does not currently intend to make significant customer decisions solely through automated decision-making without appropriate safeguards.

22. HOW TO EXERCISE YOUR RIGHTS

To exercise your privacy rights, contact:

hello@bonechoir.com Please include enough information for us to understand and identify your request.

We may need to request reasonable information to verify your identity before responding.

Where the GDPR applies, we will normally respond within one month of receiving a valid request.

Where permitted by law, that period may be extended where a request is particularly complex or where numerous requests have been submitted.

We will inform you if such an extension is necessary.

Privacy requests are generally processed without charge.

However, applicable law may permit us to charge a reasonable fee or refuse a request where it is manifestly unfounded or excessive.

23. COMPLAINTS TO THE SUPERVISORY AUTHORITY

We encourage you to contact us first if you have a privacy concern so that we have an opportunity to resolve it.

You also have the right, where applicable, to lodge a complaint with a competent data-protection supervisory authority.

Our Romanian supervisory authority is:

You may also have the right to complain to a supervisory authority in the EU or EEA country where you live, work, or where an alleged infringement occurred.

24. UK PRIVACY RIGHTS

If you are located in the United Kingdom, you may have equivalent rights under applicable UK data-protection legislation.

These may include rights of:

• access;
• rectification;
• deletion;
• restriction;
• objection;
• portability; and
• withdrawal of consent.

You may also have the right to lodge a complaint with the UK's competent data-protection authority.

Nothing in this Privacy Policy limits mandatory rights available under UK law.

25. UNITED STATES PRIVACY RIGHTS

Residents of certain U.S. states may have additional privacy rights where the relevant state privacy law applies to Bonechoir.

Depending on the law and our activities, these rights may include:

• the right to know or access personal information;
• the right to correct inaccurate information;
• the right to request deletion;
• the right to obtain a copy of personal data;
• the right to opt out of certain sales or sharing;
• the right to opt out of targeted advertising;
• the right to limit certain uses of sensitive personal information; and
• the right not to receive unlawful discriminatory treatment for exercising privacy rights.

The availability of these rights depends on the applicable law and whether Bonechoir meets the relevant statutory thresholds.

Bonechoir does not sell personal data for monetary compensation.

Where applicable law treats certain advertising technologies as "sharing" or targeted advertising, eligible customers may use the available Website privacy or cookie controls to manage those activities.

You may also contact hello@bonechoir.com regarding a privacy request.

26. DO NOT TRACK AND GLOBAL PRIVACY CONTROLS

Some browsers or devices provide privacy signals such as "Do Not Track" or other preference signals.

The legal requirements surrounding these signals vary by jurisdiction.

Where applicable law requires us or our technology providers to recognize a valid browser-based privacy preference signal, we will seek to honor that signal as required.

Our Website may also provide cookie and privacy controls through Shopify's customer-privacy functionality.

27. CHILDREN'S PRIVACY

Bonechoir is not designed or directed primarily toward children under the age of 16.

We do not knowingly seek to collect personal data from children for marketing purposes.

If you believe that a child has provided personal data to us in circumstances where parental authorization is legally required, please contact:

hello@bonechoir.com

and we will review the matter and take appropriate action.

28. SPECIAL CATEGORIES OF PERSONAL DATA

Bonechoir does not intentionally request or require special-category personal data such as information concerning:

• health;
• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade-union membership;
• genetic or biometric data; or
• sexual orientation

for ordinary ecommerce transactions.

Please avoid sending such information to us unless it is genuinely necessary for a specific legally permissible purpose.

29. SOCIAL MEDIA

Bonechoir may operate pages or accounts on platforms such as:

• Instagram;
• Facebook;
• TikTok;
• Pinterest; and
• other social networks.

If you interact with Bonechoir through a social-media platform, both Bonechoir and the platform may receive information about that interaction.

The platform's own privacy policy applies to its independent processing of your personal information.

If you submit content directly to Bonechoir, our use of such content will also be subject to our Terms & Conditions and applicable law.

30. LINKS TO THIRD-PARTY WEBSITES

The Website may contain links to independent third-party websites.

We are not responsible for the privacy practices or content of websites that we do not control.

We encourage you to review the privacy policy of any third-party service before providing it with personal information.

31. LEGAL DISCLOSURES

We may disclose personal data where we reasonably believe disclosure is necessary to:

• comply with applicable law;
• comply with a court order;
• respond to a lawful government or regulatory request;
• protect our legal rights;
• investigate fraud;
• enforce our Terms & Conditions;
• protect customers or third parties; or
• establish, exercise, or defend legal claims.

We will only make such disclosures to the extent permitted or required by applicable law.

32. BUSINESS TRANSFERS

If VALKYRIE MARKETING SRL or Bonechoir undergoes a business transaction such as:

• merger;
• acquisition;
• restructuring;
• financing;
• asset sale; or
• transfer of the Bonechoir business,

personal data may be disclosed or transferred as part of that transaction where permitted by law.

Where required, affected individuals will be provided with appropriate notice.

33. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time.

Changes may be made to reflect:

• changes in applicable law;
• changes to our Website;
• changes to service providers;
• new marketing or analytics technologies;
• new products or services; or
• changes to our data-processing practices.

The most recent version will be published on www.bonechoir.com together with its "Last updated" date.

Where a change materially affects your rights or how we use your personal data, we will provide additional notice where required by law.

34. CONTACT US

If you have questions about this Privacy Policy, our privacy practices, or your personal data, or if you wish to exercise a privacy right, contact: