GDPR Privacy Policy
Last updated: November 10, 2026
1. Introduction and Scope
This GDPR Privacy Policy explains how Duo Case Co collects, uses, shares, and protects personal data of individuals located in the European Economic Area (EEA) and the United Kingdom when they visit duocaseco.com, make a purchase, or otherwise communicate with us (together, the “Services”). It applies in addition to our general Privacy Policy. If the two conflict regarding the personal data of EEA or UK residents, this GDPR Privacy Policy applies.
Our online store is hosted on Shopify.
2. Who Is Responsible for Your Data
The data controller responsible for your personal data is:
Caubade Limited, trading as Duo Case Co
Country of registration: Hong Kong SAR
Customer service address: 1229 St Thomas St, New Orleans, LA 70130, United States
Email: contact@duocaseco.com
Phone: +1 504-422-5104
Our service providers (such as Shopify, payment processors, and shipping partners) act as data processors on our behalf, or as independent controllers where they determine how your data is used for their own purposes.
3. Personal Data We Collect
- Contact details: name, billing and shipping address, phone number, and email address.
- Payment and transaction information: payment method details (processed securely by our payment providers; we do not store full card numbers), order amounts, and transaction confirmations.
- Account information: login details and preferences, if you create an account.
- Order information: products you view, add to cart, purchase, return, or cancel.
- Customer support information: the content of messages you send us.
- Device information: device type, browser, IP address, and other online identifiers.
- Usage information: how and when you interact with the Services, including through cookies and similar technologies.
4. Where We Get Your Data
- Directly from you, when you place an order, create an account, subscribe, or contact us.
- Automatically, through cookies and similar technologies when you use the Services.
- From our service providers, such as payment processors and shipping carriers.
- From advertising and analytics partners, where you have consented.
5. How We Use Your Data and Our Lawful Bases
| Purpose | Lawful basis (GDPR Art. 6) |
|---|---|
| Processing and delivering your order, handling payments, returns, and refunds | Performance of a contract |
| Responding to your questions and providing customer support | Performance of a contract; legitimate interests |
| Preventing fraud and keeping the Services secure | Legitimate interests; legal obligation |
| Keeping tax, accounting, and order records | Legal obligation |
| Analytics to understand and improve the Services | Consent (via our cookie banner) |
| Marketing emails and SMS | Consent |
| Personalised advertising and remarketing | Consent (via our cookie banner) |
Where we rely on consent, you can withdraw it at any time without affecting processing carried out before withdrawal.
6. Who We Share Your Data With
- Shopify, which hosts our store and processes data to provide its services. See Shopify’s Privacy Policy.
- Payment processors, including Shopify Payments and the payment providers shown at checkout.
- Fulfillment centers and shipping carriers, so your order can be delivered.
- Advertising and analytics partners, including Google (Google Analytics and Google Ads), Meta (Facebook and Instagram), Pinterest, and TikTok, where you have consented.
- Email and SMS service providers, if you subscribe to our marketing messages.
- Authorities and professional advisers, where required by law or to protect our legal rights.
- A buyer or successor, in connection with a merger, acquisition, or sale of assets.
We do not sell your personal data.
7. International Data Transfers
We are based outside the EEA and UK, and our service providers may process data in other countries, including Canada, the United States, and Hong Kong. Where personal data is transferred outside the EEA or UK to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum.
8. How Long We Keep Your Data
| Data | Retention period |
|---|---|
| Order, payment, and invoice records | 7 years from the end of the financial year of the order, to meet tax and accounting obligations |
| Customer support messages | Up to 3 years after the last contact |
| Account information | Until you delete your account or ask us to delete it |
| Marketing email and SMS lists | Until you unsubscribe or withdraw consent |
| Cookies | As set out in the cookie tables in our Privacy Policy (from 1 minute to 2 years for most cookies) |
When data is no longer needed, we delete or anonymise it.
9. Cookies and Consent
When you first visit our Site from the EEA or UK, our cookie banner asks for your consent before any non-essential cookies (analytics and advertising) are set. Strictly necessary cookies, which are needed for the store and checkout to work, do not require consent. You can change your choices at any time using the cookie settings on our Site or your browser settings. A full list of cookies is available in our Privacy Policy.
10. Your Rights
Under the GDPR and UK GDPR, you have the right to:
- Access your personal data and receive a copy of it.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete your data, unless we must keep it by law.
- Restriction: ask us to limit how we use your data.
- Portability: receive data you provided to us in a structured, machine-readable format, or have it sent to another company.
- Object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent at any time, where processing is based on consent.
- Not be subject to decisions based solely on automated processing that have legal or similarly significant effects. We do not make such decisions.
11. How to Exercise Your Rights
To exercise any of these rights, email us at contact@duocaseco.com with the subject line “GDPR Request”. We may ask you to verify your identity before responding. You may also authorise someone to make a request on your behalf, with proof of that authorisation.
We will respond within one month of receiving your request. If your request is complex or we receive many requests, we may extend this by up to two further months, and we will tell you if we do. Exercising your rights is free of charge, and we will not treat you differently for doing so.
12. Children
Our Services are not intended for children under 16, and we do not knowingly collect their personal data. If you are a parent or guardian and believe your child has provided us with personal data, please contact us and we will delete it.
13. Security
We use appropriate technical and organisational measures to protect your personal data, including encrypted (HTTPS) connections and secure payment processing through PCI-compliant providers. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to any security incident.
14. Complaints
If you have a concern about how we handle your personal data, please contact us first and we will do our best to resolve it. You also have the right to lodge a complaint with the data protection authority in the EEA country where you live or work, or where an alleged infringement took place. In the UK, this is the Information Commissioner’s Office (ico.org.uk). A list of EEA authorities is available from the European Data Protection Board.
15. Changes to This Policy
We may update this policy from time to time. Changes will be posted on this page with a revised “Last updated” date, and where required by law we will notify you.
16. Contact Us
Duo Case Co (Caubade Limited)
Email: contact@duocaseco.com
Phone: +1 504-422-5104
Address: 1229 St Thomas St, New Orleans, LA 70130, United States