Legal

Privacy policy.

CYRUS B.V. is the data controller for personal data collected through cyrusdrinks.com. We process personal data in line with the EU General Data Protection Regulation (Regulation (EU) 2016/679), the UK GDPR, and the Dutch implementing law (UAVG).

The short version: we collect what we need to ship you a bottle, deliver an order confirmation, and (if you let us) understand which parts of the site are working. We do not sell your data to anyone. Ever.

What we collect, and why

Order data: Name, billing and shipping address, email, phone, order contents. Lawful basis: contract performance (Article 6(1)(b) GDPR). Retained for seven years to satisfy Dutch tax law (Article 52 of the Algemene wet inzake rijksbelastingen).
Account data: Email, hashed password, name, saved addresses, order history, optional B2B and Club membership flags. Lawful basis: contract performance. Retained for as long as the account is active, plus a 30-day grace period after closure.
Payment data: Card number, expiry, and security code are handled by Stripe and Mollie under PCI-DSS Level 1. We receive a token referencing the payment, never the card itself. Lawful basis: contract performance.
Age verification: A cookie recording that you have confirmed you are 18+ when entering the site. Cookie name: cyrus_age_gate. Retained for 30 days. Lawful basis: legal obligation under the Alcoholwet (Article 6(1)(c) GDPR).
Analytics (opt-in): If you accept analytics cookies, OpenPanel collects de-identified page-view and interaction data. We never combine this with your order or account record. Lawful basis: consent (Article 6(1)(a) GDPR). You can withdraw consent any time by clearing the cyrus_consent cookie or via your browser's site settings.
Email log: Order-related emails (confirmation, despatch, returns) are sent via Cloudflare Email Service and retained in the email log for 12 months for debugging delivery issues. Marketing emails are only sent if you separately opt in.

Who we share data with

We share personal data only with processors who help us fulfil your order:

Shopify Payments (powered by Stripe, Dublin, Ireland) — payments
PostNL N.V. (the Hague, the Netherlands) — Dutch shipping
DHL Express Nederland B.V. (Utrecht, the Netherlands) — international shipping
DPD UK Limited (Smethwick, UK) — UK shipping
Cloudflare Email Service (Cloudflare, Inc., San Francisco, CA, USA) — transactional email
Cloudflare, Inc. (San Francisco, CA, USA) — DNS and CDN

Transfers to processors outside the EU/UK rely on EU Commission Standard Contractual Clauses (2021/914), supplemented by Cloudflare's published data protection addenda. We do not transfer data to any sub-processor without imposing the same restrictions on them.

Your rights

Under the GDPR you have the right to:

Request a copy of the data we hold about you (Article 15)
Have inaccurate data corrected (Article 16)
Request deletion, subject to our legal obligations to retain transaction records for seven years (Article 17)
Restrict processing in certain cases (Article 18)
Receive your data in a portable format (Article 20)
Object to processing based on legitimate interests (Article 21)
Lodge a complaint with the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) or the UK Information Commissioner's Office (ico.org.uk)

To exercise any of these rights, email privacy@cyrusdrinks.com. We respond within 30 days (extendable by two months for complex requests, with prior notice).

Children's data

We do not knowingly collect data from anyone under 18. The site is age-gated, and any account suspected of belonging to a minor is closed and the data deleted (subject to the seven-year tax retention for any completed orders, which we keep in a restricted, read-only archive).

Security

The storefront is served over TLS 1.3 only. Passwords are hashed with Argon2id. Payment data never touches our servers. Backups are encrypted at rest in EU jurisdiction. The full security overview is available on request to the Data Protection Officer (DPO), dpo@cyrusdrinks.com.

Changes to this policy

Material changes are notified to account holders by email at least 30 days before taking effect. Non-material changes (typos, clarifications) are published here without individual notice. The current version supersedes all prior versions on the date indicated below.

Strictly-necessary cookies

Name	Purpose	Lifetime
cyrus_age_gate	Records that you confirmed you are 18+ to enter the site.	30 days
cyrus_cart	Links your browser session to a server-side cart.	Session + 30 days
cyrus_session	Authenticates you to the storefront after sign-in.	30 days
cyrus-locale	Remembers your language choice.	1 year
cyrus_theme	Remembers your brand-direction choice (active during the design selection period).	1 year

Consent cookie

Name	Purpose	Lifetime
cyrus_consent	Records whether you accepted or declined analytics cookies. Set by the consent banner.	180 days

Analytics (opt-in only)

Provider	Name	Purpose	Lifetime
OpenPanel	op_visitor	Pseudonymised visitor ID used to compute aggregated page-view metrics. No cross-site tracking; data stored in the EU.	6 months

Cookies we deliberately don't set

We don't set advertising or third-party tracking cookies. There is no Facebook Pixel, no Google Analytics, no Hotjar, no LinkedIn Insight Tag, no Pinterest Tag. If you see any in your browser's storage, that's from a different site sharing your tab — not from us.

The __Secure-cf-bm cookie set by Cloudflare is a bot-management cookie set by our CDN and is strictly necessary for the site to function. It contains no personal data and expires after 30 minutes.

How to refuse or clear cookies

Decline analytics from the consent banner at the bottom of the page on your first visit. To revisit that choice, clear the cyrus_consent cookie from your browser — the banner will re-appear on your next page view.

You can also block all cookies entirely in your browser settings. Strictly-necessary cookies are required for the cart, age gate, and sign-in to work, so blocking them will break some functionality.