Last updated: September 19, 2026
Data Controller
OSTARA GLOBAL LLC, operating under the Casalaïa brand, is the controller for the processing of personal data carried out in the context of the use of the casalaia.com website.
For any questions regarding your personal data or to exercise your rights, you can contact us:
Email: contact@casalaia.com
Customer service hours: Monday to Saturday, 9 a.m. to 6 p.m.
Postal address:
OSTARA GLOBAL LLC — Casalaïa
7345 W Sand Lake Rd, Ste 210, Office 5228
Orlando, FL 32819, USA
Personal data collected
We collect the information you provide to us when you place an order or contact our customer service: surname, first name, billing and delivery addresses, email address, phone number, and the content of your communications with us.
We also process information regarding your orders: items ordered, amount, payment status, delivery, tracking, returns, and refunds.
When you send us a complaint, we may receive documents or photographs that you choose to submit to explain your request.
When you browse our site, technical data may be processed, including your IP address, browser and device characteristics, as well as information about the pages viewed. Collection via cookies depends on their purpose and, where necessary, your consent.
Information marked as mandatory is necessary for the processing of your order or request. If you do not provide it, we may not be able to fulfill it.
Use of your data and legal bases
We use your data to register and fulfill your order, manage payment, organize delivery, provide tracking, and process return or refund requests. This processing is based on the performance of the contract or on steps taken at your request prior to a purchase.
We process the information necessary for billing, accounting, and compliance with legal warranties in order to satisfy our legal obligations.
We use certain data to secure the site, prevent fraud, and defend our rights in the event of a dispute. This processing is based on our legitimate interest in protecting our business and our customers, while respecting your rights and freedoms.
Information sent to our customer service is used to respond to your requests. Depending on their purpose, this processing is based on the performance of the contract, our legal obligations, or our legitimate interest in managing the customer relationship.
Processing intended to measure audience or display and measure advertisements, in particular with Google Analytics and Google Ads, is based on your consent when required.
Secure payment
Payments are processed by Stripe, a secure payment provider.
Casalaïa does not store your full credit card details. We receive the information necessary to confirm payment and manage the order or any potential refund.
Data recipients
Access to your data is limited to authorized personnel at Casalaïa and to service providers who need it to carry out their duties.
These recipients include Shopify, for hosting and store management; Stripe, for payment; carriers, for delivery and tracking; and support providers, for processing your requests.
Google may receive certain data in the context of the use of Google Analytics and Google Ads, depending on the features used and the applicable consent choices.
Data may also be communicated to our advisors or competent authorities when necessary to comply with a legal obligation or defend our rights.
International transfers
OSTARA GLOBAL LLC is established in the United States. Some of our service providers may also process data from the United States or other countries located outside the European Economic Area.
The transfers concerned must be regulated in accordance with applicable regulations. Depending on the recipient and the transfer, this framework may be based, for example, on an adequacy decision from the European Commission or on standard contractual clauses, accompanied, where necessary, by supplementary measures.
You may contact us at contact@casalaia.com to obtain information about the guarantees applicable to your data and how to obtain a copy.
Retention periods
Order data is kept for the time necessary to fulfill your purchase and manage the customer relationship. Some information may then be kept in restricted-access archives to comply with our legal obligations or manage a dispute, for the applicable periods.
Accounting documents and invoices are kept for the applicable legal period, generally ten years.
Requests addressed to customer service are kept for the duration of their processing, and then for a maximum of three years from the last contact, unless a legal obligation or dispute justifies longer retention.
Data used for prospecting purposes is kept for a maximum of three years from collection or from the last contact from the prospect, unless consent is withdrawn or an objection is applied before this deadline.
Specific retention periods for cookies and trackers are specified in our Cookie Policy and in the information associated with the consent management tool.
Cookies and privacy choices
Strictly necessary cookies enable the site, the shopping cart, and payment to function. They do not require your consent.
Analytics or advertising cookies subject to consent must only be set or read after your agreement. You can accept or refuse them and withdraw your consent at any time.
Refusing optional cookies does not prevent you from placing an order.
To learn about the cookies used, their purposes, their durations, and how to change your choices, consult our Cookie Policy.
Your rights
Under the conditions provided for by the General Data Protection Regulation, you may request access to, rectification, erasure, or restriction of the processing of your data.
You may also exercise your right to object and, where conditions are met, your right to data portability.
When processing is based on your consent, you may withdraw it at any time. This withdrawal does not affect the lawfulness of processing carried out prior to it.
You may object at any time to the use of your data for commercial prospecting purposes and define directives regarding the fate of your data after your death.
To exercise your rights, write to contact@casalaia.com specifying your request. Proof of identity is not systematically requested; additional information may be requested in case of reasonable doubt regarding your identity.
We generally respond within one month. This period may be extended by two additional months when the complexity or number of requests justifies it; we will inform you within the first month.
You may also lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL) at www.cnil.fr.
Security
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure.
Access to data is limited to individuals who need it to perform their functions.
Minors
Our site is not specifically intended for minors. If you believe that a minor has provided us with personal data without the necessary authorization, please contact us so that we can review the situation.
Changes to this policy
This policy may be updated to reflect changes in our services, our processing, or regulations.
The update date appears at the top of this page. When a change requires specific notification or new consent, we will take the corresponding steps.
