Privacy & Cookie Policy

Last Updated: September 2026 · Data Controller: Stone Fintech LTD (Company No. 17152912)

Our Data Privacy Guarantee

At Stone Fintech LTD, we respect your privacy and are committed to protecting your personal data. This comprehensive Privacy Policy informs you about how we collect, process, protect, and retain your personal data when you visit our website (canillo.site) or purchase furniture and decor products from us, as well as informing you of your statutory privacy rights under the UK General Data Protection Regulation (UK GDPR / Data Protection Act 2018) and the European Union General Data Protection Regulation (EU GDPR).

Zero Raw Card Storage

Card credentials processed directly via PCI-DSS Level 1 tokenized iframes

No Selling of Data

We strictly never monetize, sell, or trade your personal information

Full Rights Control

Easy exercise of access, rectification, erasure, and portability rights

1. The Data Controller & Legal Identity

The entity responsible as the “Data Controller” for your personal information is:

Corporate Name: Stone Fintech LTD (trading as Stone Fintech LTD)

Business Registration Number: 17152912

Registered Address: OFFICE 1038 85 DUNSTALL HILL, WOLVERHAMPTON, UNITED KINGDOM WV6 0SR

Data Protection Officer (DPO) Email: support@canillo.site

Telephone Contact: +44 1902 518392

2. Categories of Personal Data We Collect

We may collect, use, store, and transfer different kinds of personal data about you, grouped into the following categories:

A. Identity & Contact Data

Includes your first name, last name, shipping address, billing address, email address, and phone number for delivery updates and customer service contact.

B. Financial & Payment Data (PCI-DSS Tokenized)

Includes payment transaction references, payment method type (e.g., Visa ending in 4242, PayPal transaction identifier), order timestamps, and invoice records. We explicitly do NOT capture, store, or have access to your full credit card PAN number, expiry date, or CVV/CVC security codes. All payment fields are rendered in encrypted iframes hosted directly by certified payment gateways (Airwallex, Stripe, PayPal).

C. Order & Transaction Data

Includes details of products ordered, dimensions/finishes chosen, total payment amounts, carrier tracking numbers, and correspondence relating to returns or warranties.

D. Technical & Device Usage Data

Includes Internet Protocol (IP) address, browser type and version, time zone setting, operating system, and anonymous page navigation paths recorded for security and site reliability.

3. Legal Bases for Processing Under GDPR

We process your personal data strictly in compliance with Article 6 of the GDPR under the following recognized legal bases:

Performance of a Contract (Art. 6(1)(b) GDPR): To process your order, manage billing, arrange doorstep delivery with couriers, and administer returns.
Compliance with Legal Obligations (Art. 6(1)(c) GDPR & PDPO): To maintain statutory tax, accounting, and anti-money laundering records as required by corporate law.
Legitimate Interests (Art. 6(1)(f) GDPR): To prevent fraud, safeguard website security, and maintain high standards of customer service.
Explicit Consent (Art. 6(1)(a) GDPR): Where you have opted in to receive promotional newsletters or optional marketing updates (which you can withdraw at any time).

4. Third-Party Data Processors & Service Partners

We never sell your data. We share necessary information only with trusted third-party service providers who are bound by stringent Data Processing Agreements (DPAs) and confidentiality obligations:

Processor Category	Partner Entities	Purpose & Data Shared
Payment Processors	Airwallex, Stripe, PayPal	PCI-DSS tokenized card processing, fraud prevention & chargeback handling
Logistics & Couriers	DHL Express, FedEx, DPD, UPS	Delivery address, recipient name, phone for SMS doorstep delivery alerts
Cloud Infrastructure	Cloudflare, AWS	Encrypted web hosting, edge CDN caching, DDoS defense, SSL termination

5. Cookie Policy & Tracking Technologies

Cookies are small alphanumeric files placed on your device to enhance site navigation, preserve shopping cart contents, and deliver a seamless shopping experience. We categorize our cookies as follows:

Strictly Necessary Cookies: Essential for core website functionality, session management, shopping cart persistence, and security verification. These cannot be switched off in our systems.
Functional Cookies: Remember your currency preference (€ EUR vs. $ USD) and language settings across visits.
Performance & Analytics Cookies: Aggregate, anonymized metrics that help us understand page load speeds and visitor flow without identifying individual users.

Managing Cookies: You can manage or disable cookies via your browser settings (Chrome, Safari, Firefox, Edge). Please note that disabling essential cookies may impact checkout functionality.

6. Data Retention Schedules

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

Order, Invoicing & Tax Data: Retained for 7 years in compliance with UK HMRC and European commercial accounting requirements.
Customer Support Records: Retained for 2 years following ticket closure to ensure continuity of warranty claims.
Marketing Opt-in Data: Retained until consent is withdrawn or after 24 months of total inactivity.

7. Your Statutory Privacy Rights (UK GDPR & EU GDPR)

Under applicable United Kingdom (UK GDPR) and European (EU GDPR) privacy laws, you possess the following actionable rights:

Right of Access (Art. 15 GDPR)

Obtain confirmation of whether we hold your personal data and request a copy free of charge.

Right to Rectification (Art. 16 GDPR)

Request correction of inaccurate or incomplete personal contact and address records.

Right to Erasure / Forgotten (Art. 17 GDPR)

Request deletion of personal data where there is no compelling legal reason for continued processing.

Right to Data Portability (Art. 20 GDPR)

Receive your personal order history in a structured, commonly used, machine-readable format.

To exercise any of these rights, email our Data Protection Officer at support@canillo.site. We respond to all verified statutory requests within 30 calendar days.

8. Contact Our Data Protection Officer

For any questions, concerns, or requests regarding this Privacy Policy or how your personal information is handled:

Stone Fintech LTD — Data Protection Office

Registration No.: 17152912

Office Address: OFFICE 1038 85 DUNSTALL HILL, WOLVERHAMPTON, UNITED KINGDOM WV6 0SR

Email: support@canillo.site

Telephone: +44 1902 518392