Privacy Policy

1. Who we are

Younivo LLC (United States) operates the PULLSHKA brand and pullshka.com, and — together with STE PULLSHKA SARL (Agadir, Morocco) — is the data controller for the personal data collected on this site. Contact: contact@pullshka.com.

2. Applicable law

We process personal data in accordance with Moroccan Law 09-08 on the protection of individuals with regard to the processing of personal data, under the oversight of the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel). For EU-based customers, we additionally apply the relevant protections of the EU General Data Protection Regulation (GDPR).

3. What data we collect

• Identity & contact: name, email, phone, billing and shipping addresses.
• Order data: products purchased, order history, payment confirmations (we never store full card numbers — see §5).
• Account data: login credentials (passwords are stored hashed), preferences, wishlist.
• Technical: IP address, browser type, device information, timestamps.
• Usage: pages viewed, items added to cart, search queries, on-site behaviour.
• Communications: messages you send us via the contact form, Instagram DM, WhatsApp or email.

4. Why we process it (legal basis)

• Contract performance: to take, fulfil and deliver your order, and to provide customer support.
• Legal obligation: to comply with invoicing, tax, accounting and fraud-prevention rules.
• Legitimate interest: to secure the site, prevent abuse, and improve our products and service.
• Consent: for marketing emails, optional analytics cookies, and any non-essential profiling. You can withdraw consent at any time.

5. Sharing with third parties

We share personal data only with trusted service providers strictly required to run our business, and only to the extent necessary:

• Payment processing: Stripe Payments Europe Ltd. — handles card payments. Pullshka never sees or stores your full card number.
• Shipping: Ameex Express — receives the shipping address and order details required for delivery.
• Email delivery: our transactional email provider (order confirmations, shipping updates).
• Hosting: our cloud hosting provider for site infrastructure.
• Customer-service tools: Meta Platforms Inc. (Instagram and WhatsApp Business) when you contact us through those channels.
• Analytics: aggregated and anonymised usage statistics from optional analytics cookies.

We never sell your data. Disclosure to public authorities only takes place when legally required.

6. International transfers

Some of the providers above (Stripe, Meta) process data outside Morocco. When that happens we rely on contractual safeguards and the recognised adequacy frameworks of the destination country to ensure your data continues to be protected at a level equivalent to Moroccan and EU law.

7. Retention

We keep order and invoicing data for the period required by Moroccan tax law (10 years). Marketing-consent records are kept while consent is active and for three years after withdrawal. Account data is kept while your account is open and for two years of inactivity before deletion.

8. Your rights

Under Moroccan Law 09-08 (and GDPR where applicable) you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data ("right to be forgotten").
• Restrict or object to processing.
• Request a portable copy of your data.
• Withdraw consent for marketing or analytics at any time.
• Lodge a complaint with the CNDP (www.cndp.ma) if you believe your rights have been infringed.

To exercise these rights, email contact@pullshka.com with proof of identity. We respond within 30 days.

9. Cookies

We use essential cookies required for the site to work (cart, login session, language). With your consent we also use analytics cookies to understand how the site is used so we can improve it. You can accept or decline analytics via the consent banner shown on first visit, and change your choice at any time through your browser settings.

10. Security

We use HTTPS encryption site-wide, hashed passwords, and restricted access to personal data inside our team. Payments are tokenised by Stripe so card details never reach our servers.

11. Children

Our site is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

12. Changes

We may update this policy from time to time. The revision date at the top of the page reflects the most recent change. Material changes will be flagged on the site before they take effect.

13. Contact

Data-protection enquiries: contact@pullshka.com. General questions: contact form.