This Privacy Policy applies to the footwear store operated by FEASTER VERNALCREST COMMERCE LLC . It explains what personal data we collect when you browse the store or place an order, why we process it, who receives it, how long we retain it, and how you can exercise your rights.
We are the controller of the personal data described here. Our business is based in Lexington, Kentucky, and we sell to customers in the United States and the European Union. Where we offer goods to customers in the EU or monitor their behaviour there, the GDPR applies alongside U.S. law. Where we process the personal data of Kentucky residents, the Kentucky Consumer Data Protection Act (KCDPA) applies, effective 1 January 2026. Where we process the personal data of California residents, the CCPA/CPRA applies.
This Policy is not organised around a generic template. It is organised around the three data flows that actually exist in a footwear store: the fit data you give us to get the right size, the wallet payment data that never reaches our servers, and the order record that we must keep after the sale. Each section maps a data category to its purpose and, where GDPR applies, its legal basis.
1. Fit Data: Size, Width, and What We Do Not Infer
Footwear is one of the few categories where the customer must supply body-related information before a transaction can be completed. This section explains how we treat it.
1.1 What we collect
When you use a size guide, a “find my size” tool, or a product page, you may give us:
- Your shoe size in one or more systems (US, EU, UK, or centimetres);
- Your foot width (narrow, standard, wide) where a product page asks for it;
- A heel-to-toe measurement, if you enter it;
- Your usual brand or last preference, if you provide it;
- For children’s footwear, the child’s age or size where you enter it to receive a recommendation.
You do not have to provide any of this information to browse the store. It is collected only when you choose to use a fit-related feature or enter it at checkout.
1.2 How we classify it, and what we do not do
Shoe size and width are used to recommend a product and to check whether a pair is likely to fit. We do not treat this information as health data, and we do not use it to infer a medical condition. This distinction matters under GDPR Article 9, under the CPRA’s definition of health information, and under the KCDPA’s definition of “physical or mental health diagnosis.” A shoe size alone is a commercial fit parameter, not a diagnosis. A width entered to select a wider last is a fit parameter, not a statement about a medical condition.
Where we would cross that line, we will ask you separately and specifically. If you voluntarily tell us in a customer-service message that you have a foot condition — for example, that you need extra depth because of a medical issue — that statement may constitute health data. We will use it only to answer your inquiry and will not store it as part of a fit profile or use it to infer characteristics about you. We do not operate a virtual try-on scanner, a foot-scanning device, or any tool that derives biometric identifiers from your feet. If we introduce such a tool, we will update this Policy and, where required, obtain explicit consent before processing.
Legal basis (GDPR): where you enter fit data to receive a size recommendation, we process it on the basis of your consent (Art. 6(1)(a)). Where the information is necessary to fulfil an order — for example, the size you selected for the pair you bought — the basis is performance of a contract (Art. 6(1)(b)). You can withdraw consent for fit recommendations at any time by clearing the relevant field or contacting us; withdrawal does not affect the lawfulness of processing before withdrawal.
KCDPA note: the KCDPA requires opt-in consent before processing sensitive data, and sensitive data includes a “physical or mental health diagnosis.” Fit data as described in this section is not a health diagnosis and is not processed as sensitive data. If you volunteer a health diagnosis in a message, we rely on your voluntary provision for the purpose of resolving that specific inquiry and do not retain it as a profile attribute.
1.3 What we do not do with fit data
We do not sell fit data. We do not share it with advertising platforms for their own use. We do not use it to build a cross-site profile of your body or health status. We do not combine it with browsing data to infer a medical condition.
2. Order and Account Data
2.1 What we collect
Full name, shipping address, billing address (where different), email address, telephone number, and account login credentials (stored hashed and encrypted). For orders, we also collect the product, size, colour, price, currency, and order reference.
2.2 Why, and on what basis
We use this data to process and deliver the order, manage returns and size exchanges, and provide order-related customer service. GDPR legal basis: performance of a contract (Art. 6(1)(b)); legal obligation for transaction and tax records (Art. 6(1)(c)). Consequence of not providing order data: we cannot process or deliver an order.
2.3 Children’s footwear
Where you order children’s footwear, you are providing the shipping and order data, and possibly the child’s size. You confirm that you are the parent or guardian or are otherwise authorised to provide that information. We do not knowingly collect personal data directly from a child under 13. The store is not directed to children, and account creation requires the user to confirm they are at least 18. Where we learn that we have collected personal data from a child under 13 without parental consent, we will delete it promptly. This threshold reflects the COPPA baseline of under 13, which applies to commercial websites directed to children or operators with actual knowledge of collecting from a child.
3. Wallet Payment Data and the Zero-Storage Boundary
3.1 What we collect
The wallet selected (iDEAL or BLIK), transaction ID and payment reference, authorisation status, amount, currency, timestamp, refund and chargeback status, and limited identifiers returned by the payment service provider.
3.2 How the payment flow works
Payment method selection occurs after you click “Place Order.” The system evaluates the shipping destination and order currency and displays the wallet method available for that combination. You are then directed to your banking environment or wallet interface to authorise the transaction. The result is returned to the store, and the order moves out of pending status only if authorisation succeeds.
3.3 What we do not retain
We do not receive or store your online banking password, wallet login credentials, full payment account number, CVV, or one-time authentication codes. iDEAL and BLIK authorisation takes place in the banking environment; the credential itself is not transmitted to or retained by us. If you receive a request for such credentials that appears to come from us, do not respond and contact us before taking any other step.
GDPR legal basis for wallet data: performance of a contract (Art. 6(1)(b)); legal obligation for transaction records (Art. 6(1)(c)).
4. Automatically Collected Technical Data and Cookies
4.1 Technical data
IP address, browser type and version, operating system, device type, referring and exit pages, pages viewed, and general geographic location derived from IP. Why: site security, fraud prevention, and aggregated analytics. GDPR legal basis: legitimate interests (Art. 6(1)(f)) in keeping the store secure and functional; consent where analytics or advertising cookies require it.
4.2 Cookies
Essential cookies (cart, checkout, session security) do not require consent. Analytics and advertising cookies are loaded only after you give clear, affirmative consent through the cookie banner. Pre-ticked boxes are not used, and “reject” is presented with the same prominence as “accept.” Silence, scrolling, or continued browsing does not constitute consent. We do not use cookie walls that condition access on accepting non-essential cookies.
GPC and opt-out signals. We treat a Global Privacy Control (GPC) signal as a valid request to opt out of sale or sharing for the browser or device on which it is sent. Honouring GPC is not optional for a business that shares personal information for advertising purposes; the CPPA’s 2026 enforcement priorities specifically target sites that display a cookie banner but fail to act on a GPC signal. We test our GPC handling periodically, because ad-tech and vendor changes can break it without any change to the policy text.
Consent records are retained for no longer than six months, after which we will ask you to reaffirm your preferences. Non-essential cookies expire within a defined period, typically no longer than 24 months.
5. How We Share Data
Payment service providers. The provider that enables iDEAL and BLIK receives the data necessary to authorise and settle the transaction. It acts under its own regulatory and security obligations.
Logistics and carriers (USPS, FedEx, DHL, and regional last-mile partners). They receive name, shipping address, and, where the carrier requires it for delivery, a phone number. They do not receive fit data, wallet data, or marketing preferences.
IT, hosting, and analytics providers. They process data on our instructions under data-processing agreements and are bound to use it only for the specified purposes.
Professional advisers and authorities. Where necessary to comply with law, enforce our terms, or protect rights and safety.
We do not sell personal information. We do not share fit data with advertising partners. Where advertising cookies are used, those tools receive cookie identifiers for measurement and remarketing on our behalf, not for their independent use.
International transfers. Our business is based in the United States, and our service providers may process data in the U.S. or other countries. Where GDPR applies and we transfer personal data from the EU/EEA to the U.S., we rely on Standard Contractual Clauses approved by the European Commission, supplemented by measures appropriate to the transfer. A copy can be requested using the contact details in Section 9.
6. Retention
| Data | Retention |
|---|---|
| Order and transaction records | 7 years from the end of the relevant tax year, or the period required by applicable tax and accounting law, whichever is longer. |
| Account information | Until you delete your account or request removal, plus a short period to complete deletion across systems and backups. |
| Fit data entered for a recommendation | Until the recommendation is generated and you complete or abandon the session; if saved to an account, until you remove it or delete the account. |
| Marketing preferences | Until you withdraw consent or opt out. |
| Server and analytics data | Identifiable form only as long as needed for security and analytics; aggregated or anonymised data may be retained for trend analysis. |
Where data is no longer needed, we delete or anonymise it.
7. Your Rights: Kentucky, California, and the EU/EEA
7.1 Kentucky residents — KCDPA
The KCDPA took effect on 1 January 2026. If you are a Kentucky resident, you have the right to:
- Confirm whether we are processing your personal data, and access it;
- Correct inaccuracies in your personal data;
- Delete personal data you provided to us, or that was obtained about you;
- Obtain a portable copy of personal data you provided, to the extent feasible;
- Opt out of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects;
- Protect your sensitive data from processing without your consent. Sensitive data under the KCDPA includes a “mental or physical health diagnosis,” precise geolocation, biometric data used for identification, and data collected from a known child under 13. As explained in Section 1.2, fit data is not processed as a health diagnosis, and we do not process sensitive data for any purpose beyond the specific inquiry for which you volunteered it, where applicable.
To exercise a KCDPA right, contact us using the details in Section 9. The Kentucky Attorney General has exclusive enforcement authority under the Act; there is no private right of action under the KCDPA.
7.2 California residents — CCPA/CPRA
If you are a California resident, you have the right to know what personal information is collected, used, and disclosed; to delete it, subject to legal retention; to correct inaccurate information; to opt out of sale or sharing (we do not sell; where advertising cookies constitute “sharing,” you can opt out via the “Your California Privacy Choices” link or a GPC signal); to limit the use and disclosure of sensitive personal information; and to non-discrimination for exercising a right.
Sensitive personal information. We do not use sensitive personal information beyond the purposes necessary to provide the goods or services reasonably expected by you. This Policy states that limitation as the basis for not presenting a separate “Limit the Use of My Sensitive Personal Information” link. If our use changes, we will provide the link and update this Policy. Under the CPRA, health information is sensitive only when it is collected and analysed; shoe size and width used to recommend a size are not collected and analysed for a health purpose.
You may use an authorised agent to submit a request where the law permits it.
7.3 EU/EEA and UK residents — GDPR / UK GDPR
You have the rights of access, rectification, erasure, restriction, data portability, objection (including to processing based on legitimate interests and to direct marketing), and withdrawal of consent at any time, without affecting the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with your supervisory authority.
8. Automated Tools and Children
Automated decision-making. We use automated tools for fraud screening and payment authorisation. These do not produce legal or similarly significant effects based solely on automated processing. If a payment is declined by the provider, you may contact us and we will review the order through a human process. We do not use automated processing to set individualised prices, and we do not use fit data to make automated decisions about credit or access to the store.
Children. The store is not directed to children under 13, and we do not knowingly collect their personal data. Account creation requires confirmation that the user is at least 18. Where we learn that we have collected personal data from a child under 13, we will delete it promptly. If you believe a minor has provided data, contact us.
9. Contact
Controller: FEASTER VERNALCREST COMMERCE LLC
Address: 3096 Wellington Way, Lexington, KY 40503, United States
Email: [email protected]
Phone: +1 8597971799
Part number: 1530213
For privacy requests, include “Privacy Request” in the subject line so the request is routed correctly. EU/EEA data subjects also have the right to contact their local supervisory authority.