Privacy policy

The database owner and data controller is BAIA Swimwear (Company no. coming soon), מושב גילת.

For any privacy question or request: baiaswimwear0@gmail.com or by phone at 054-4446739.

• Account (if you open one): name, email address and password (stored only as a secure hash). If you sign up with Google - the name, email and profile picture Google shares.
• Orders: recipient name, phone, delivery address or pickup point, items ordered, amounts, coupons and order history. Card details go directly to the payment provider and are never stored by us.
• Messages: what you write in the contact form - name, email, phone and order number (optional) and the message itself.
• Newsletter: your email address, language, sign-up source and consent date - as proof of the consent you gave.
• Technical data: IP address, browser and device type, and cookies - see section 8.

You are not legally required to give us any information, but without details such as your name, phone and address we cannot deliver your order.

• Processing your order, payment and delivery, and handling cancellations, returns and exchanges.
• Sending service messages: order confirmations, shipping updates, email verification and password resets.
• Answering your messages and providing customer service.
• Securing the website and preventing fraud and abuse.
• Meeting legal obligations such as tax and bookkeeping.
• Sending marketing emails - only if you explicitly agreed.

In line with section 30A of the Communications (Telecommunications and Broadcasting) Law, 5742-1982 (the "Spam Law"), we only send advertising if you ticked the consent box yourself - it is never pre-ticked. Every marketing email is marked "Advertisement" (פרסומת) and includes an unsubscribe link.

You can withdraw consent at any time: via the unsubscribe link in any marketing email, in your account settings, or by contacting us. Service messages about existing orders will still be sent.

We never sell or rent personal data. We share it only with parties needed to provide the service, and only as much as they need:

• The payment provider - to process payment and prevent fraud.
• Couriers and pickup points - name, phone and address for delivery.
• Our email service provider - to send service messages and newsletters.
• Hosting and cloud infrastructure providers - to host the website and data.
• Competent authorities - when required by law or court order.

Some providers may store data on servers outside Israel. When that happens we make sure the transfer complies with the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001, and that adequate protection applies.

• Orders and invoices - 7 years, as required by tax law.
• Your account - while it is active, or until you ask us to delete it.
• Customer service messages - up to 2 years after they are resolved.
• Newsletter list - until you unsubscribe. After that we keep only your email address and the consent and unsubscribe dates, to honour your request and prove compliance.

We apply security measures in line with the Protection of Privacy (Data Security) Regulations, 5777-2017: encrypted traffic (HTTPS), hashed passwords, restricted access and backups. No system is completely immune, but if a serious security incident occurs we will act according to our legal reporting duties.

We only use essential cookies that the website needs to work: keeping you signed in, your cart, your language and your cookie choice. There are currently no analytics or advertising cookies.

If we add such cookies in the future, they will only run if you chose "Accept all" in the cookie banner. You can delete cookies at any time in your browser settings, and the banner will show again.

• Access - receive the information we hold about you (section 13 of the Law).
• Correction - ask us to fix inaccurate, incomplete or outdated data (section 14 of the Law).
• Deletion - ask us to delete your account and any data we are not legally required to keep.
• Unsubscribe - at any time, free of charge (section 17F of the Law and section 30A of the Communications Law).

To exercise a right, email baiaswimwear0@gmail.com from the address registered with us. We may ask you to verify your identity before sharing data. We reply within 30 days. If you're unhappy with how we handled it, you can contact the Privacy Protection Authority.

Accounts are not intended for anyone under 18 without parental consent. If you learn that a minor gave us data without such consent, contact us and we will delete it.

We'll update this policy when the way we handle data changes. The date of the last update is shown at the top of the page, and material changes will also be announced prominently on the website.