Privacy Policy & Advertising Tracking Notice

Effective Date & Document History

This Privacy Policy and Tracking Disclosure takes effect on October 27, 2026. It supersedes all prior public statements regarding privacy, visitor tracking, and inventory reservation processing across ceanshop.click.

Data Controller & Operating Business

The data controller responsible for the processing of personal data gathered through ceanshop.click is:

Ceanshop
1201 Northwest Irving Street, Portland, Oregon 97209, Portland, Oregon, United States
Telephone: +1 (340) 885-9800
Electronic Mail: office@ceanshop.click

Cean Shop operates as an inquiry-only physical goods catalog and brick-and-mortar showroom in Portland, Oregon. We do not operate an automated ecommerce cart, do not collect payment card information, and do not execute remote card-not-present retail sales online.

Categories of Information Collected

We collect information strictly necessary to handle customer inquiries, reserve shelf inventory for physical pickup, operate live floor support chat, and assess advertising campaign performance:

• Hold & Inquiry Data: Customer full name, optional telephone number, optional electronic mail address, street address or neighborhood (for regional delivery assessments), inquiry classification, item SKU specifications, and custom packing notes submitted via gici911.php.
• Technical & Telemetry Data: Internet Protocol (IP) address, browser user-agent header, screen resolution, referring Uniform Resource Locator (URL), timestamp when the form opened, and timestamp when submission occurred.
• Live Support Chat Records: Message transcript and a locally stored random session token managed by boceaf0.php to maintain dialogue persistence during your visit.
• Advertising Click Identifiers: Uniform Resource Identifier parameters appended to inbound advertising links, specifically Google Click Identifier (gclid), Microsoft Click Identifier (msclkid), and Meta Click Identifier (fbclid).
• Consent Registry Choice: The binary consent preference stored under the local browser key site_consent_v2.

Purposes of Personal Data Processing

We process personal information exclusively for specific, explicit, and legitimate commercial objectives:

• Executing 48-hour physical item holds at our 1201 Northwest Irving Street counter.
• Communicating floor stock counts, timber dimensions, and load ratings to inquiring customers.
• Evaluating road mileage and freight logistics for heavy industrial shelving or bulk glass orders within the Oregon region.
• Maintaining store security, preventing automated bot abuse, and mitigating fraudulent spam via honeypot filtering fields.
• Measuring the effectiveness and conversion attribution of paid advertising campaigns on commercial search and social networks.

Legal Bases for Processing

Under applicable statutory frameworks, including European General Data Protection Regulation (GDPR) Article 6 and relevant United States state laws, our processing activities rest on the following legal bases:

• Consent (Article 6(1)(a)): Freely given, specific, informed, and unambiguous consent provided via our consent banner for non-essential advertising measurement cookies, and via form checkboxes for inquiry follow-up communications.
• Pre-Contractual Measures (Article 6(1)(b)): Processing necessary to take steps at your request prior to entering into a retail sale, including reserving physical inventory and preparing delivery estimates.
• Legitimate Interests (Article 6(1)(f)): Operating an error-free web server, safeguarding network infrastructure against denial-of-service intrusions, and maintaining proof of business correspondence.

Advertising Platforms & Campaign Attribution

This website is an active destination for paid commercial advertising. We currently operate campaigns and receive inbound referral traffic from google ads, microsoft advertising, and Meta Ads.

When a visitor arrives at our catalog through a paid commercial campaign, the referral URL carries specific tracking parameters generated by the corresponding platform:

• gclid: Attached to inbound landing URLs by Google Ads to correlate ad impressions with on-site inquiry actions.
• msclkid: Attached to inbound landing URLs by Microsoft Advertising for search attribution across the Bing network.
• fbclid: Attached to inbound landing URLs by Meta Ads when marketing campaigns are active across Meta platforms.

We declare that no advertising platform has reviewed, endorsed, or verified our physical showroom or catalogue operations. All product representations, inventory prices ($2–$616 USD), and physical availability claims are exclusively our own.

Google Consent Mode v2 Implementation

To respect user autonomy and satisfy international data privacy standards, ceanshop.click deploys consent mode v2. Prior to any interaction with our cookie banner, the following four telemetry and advertising signals are initialized strictly to denied:

• ad_storage: Held denied until storage is explicitly granted by the visitor;
• ad_user_data: Held denied until storage is explicitly granted by the visitor;
• ad_personalization: Held denied until storage is explicitly granted by the visitor;
• analytics_storage: Held denied until storage is explicitly granted by the visitor.

If a visitor clicks “Decline All” or refuses tracking, all four signals remain denied, no advertising tags write persistent tracking cookies, and any cached storage identifiers are immediately purged. If the visitor subsequently revokes consent via the footer cookie control, the parameters are instantly set back to denied.

Data Processors & Third-Party Service Providers

We disclose personal data only to contracted processors bound by strict confidentiality and security commitments:

• Google LLC / Google Ireland Ltd: Provides advertising measurement infrastructure and Google Ads conversion reporting.
• Microsoft Ireland Operations Ltd: Provides Microsoft Advertising conversion attribution services. The collection and processing of data by Microsoft is governed by their independent privacy commitments, accessible at privacy.microsoft.com.
• Meta Platforms Ireland Ltd / Meta Platforms, Inc.: Provides audience attribution and pixel measurement where campaigns are deployed.
• Infrastructure Hosting Provider: Dedicated cloud server host providing physical server space, MariaDB database persistence, and HTTPS SSL certificates for ceanshop.click.
• Electronic Mail Transport Provider: SMTP relay provider delivering submission notifications from our website form directly to our staff inbox at office@ceanshop.click.

International & Cross-Border Data Transfers

Ceanshop operates primary server infrastructure located in the United States. If you access our catalog from the European Economic Area, the United Kingdom, or other jurisdictions outside the United States, your personal data will be transferred and stored within the United States.

For transfers of European personal data, we rely on the European Commission’s Standard Contractual Clauses (SCCs), adequacy decisions, or certification under the EU-U.S. Data Privacy Framework to ensure equivalent protection standards.

Data Retention Schedules

We never store personal information indefinitely. Data categories are retained according to the following real, binding calendar periods:

• Hold Inquiries & Customer Correspondence: Retained for exactly 36 months to resolve historical warranty inquiries, order history questions, and tax audit records.
• Live Support Chat Transcripts: Retained in server storage for exactly 6 months, after which session records are permanently deleted.
• Web Server Access & Security Logs: Retained for 90 days for network threat analysis and forensic inspection, then cycled out.
• Consent Preference Records: Kept in client browser storage for 12 months before requiring re-affirmation.
• Data Subject Access Requests (DSAR): Logged and answered within a statutory limit of 14 days from initial receipt.

Technical, Administrative & Physical Security

Cean Shop applies multilayered defensive controls to protect customer records against loss, unauthorized access, alteration, or disclosure:

• Mandatory TLS 1.3 / HTTPS encryption across all web endpoints, securing form inputs in transit.
• Input parameter sanitization and strict SQL parameter binding across gici911.php and boceaf0.php.
• Hidden honeypot fields and CSRF session timestamps to reject malicious automated bot traffic.
• Strict physical key-card access to our Irving Street administrative terminal and local inventory archives.

Rights of European Data Subjects Under GDPR

For visitors accessing our services from the European Union, the United Kingdom, or Switzerland, the gdpr confers comprehensive personal data rights:

• Right of Access (Article 15): You may obtain confirmation as to whether your personal data is processed, along with a copy of that data.
• Right to Rectification (Article 16): You may request immediate correction of inaccurate or incomplete contact records.
• Right to Erasure (Article 17): You may request the deletion of your personal records (“right to be forgotten”), subject to statutory tax hold obligations.
• Right to Restriction (Article 18): You may restrict the processing of your data while a contestation or dispute is evaluated.
• Right to Data Portability (Article 20): You may receive your personal data in a structured, commonly used, and machine-readable JSON format.
• Right to Object (Article 21): You may object at any time to processing based on legitimate interests or direct marketing.
• Right to Withdraw Consent (Article 7(3)): You may revoke consent at any time without affecting the lawfulness of processing conducted prior to revocation.

United States State Privacy Rights & CCPA Notice

Under state comprehensive privacy laws, including the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act (collectively, ccpa), along with the Oregon Consumer Privacy Act (OCPA) and Colorado Privacy Act (CPA), residents enjoy distinct privacy rights:

• Right to Know & Access: The right to request the specific pieces and categories of personal information we have collected over the preceding 12 months.
• Right to Delete: The right to request deletion of personal information collected directly from you.
• Right to Correct: The right to correct inaccurate personal data maintained on our records.
• Right to Opt-Out of Sale or Sharing: We do not sell your personal data for monetary consideration. However, the transmission of advertising identifiers (such as gclid, msclkid, fbclid) to advertising partners may constitute “sharing” or “targeted advertising” under statutory definitions. You may opt out at any time by declining tracking in our banner or transmitting an opt-out signal.
• Non-Discrimination: We will never deny goods, alter pricing, or degrade service quality because you exercised statutory privacy rights.

Global Privacy Control (GPC) Compliance

Ceanshop fully recognizes and honors the global privacy control (GPC) signal. When our web server detects the Sec-GPC: 1 HTTP request header emitted by compliant web browsers, our site automatically interprets this signal as an immediate and valid opt-out request for advertising tracking and personal data sharing. No additional form submission or user interaction is required.

Protection of Children’s Privacy

Our website, domestic goods catalog, and commercial inventory are designed for adults. We do not knowingly solicit, collect, or maintain personal information from children under the age of 16. If we become aware that an inquiry form was submitted by a minor under 16 without parental authorization, we will purge that record within twenty-four hours of discovery.

Right to Lodge Regulatory Complaints

If you believe our processing of your personal information infringes statutory privacy standards, you have the right to lodge a formal complaint with a competent supervisory authority:

• In Oregon: The Financial Fraud and Consumer Protection Section of the Oregon Department of Justice, Attorney General of Oregon.
• In California: The California Privacy Protection Agency (CPPA) or Office of the California Attorney General.
• In the European Union: The national data protection authority of the EU Member State in which you reside or work.

How to Exercise Data Rights (DSAR Process)

To exercise your rights of access, correction, erasure, or opt-out, please submit a written Data Subject Access Request (DSAR) to our privacy officer.

Electronic Mail: office@ceanshop.click
Postal Dispatch: Data Protection Officer, Ceanshop, 1201 Northwest Irving Street, Portland, Oregon 97209, United States
Telephone Verification: +1 (340) 885-9800

Please include your full name, the contact phone or email used in your original inquiry, and the specific nature of your request. To protect customer confidentiality, we verify identity before executing records release. We will confirm receipt within two business days and fulfill your request within a maximum of 14 days without administrative charge.

Amendments & Policy Updates

We periodically review our data handling practices to reflect shop floor operations, technological enhancements, and regulatory updates. Any revisions to this policy will be published directly to this page with an updated Effective Date. We encourage visitors to review this page periodically.

Direct Privacy Inquiries & Human Contact

For direct communication with a human representative regarding this Privacy Notice or our floor data procedures, contact our administrative counter desk: