Privacy Policy

1. Who we are

This website is operated by Hansani Hidellaarachchi, a sole proprietor registered in the Netherlands. We publish and sell the literary memoir Dear Shah Rukh Khan.

Contact: hello@dearshahrukh.com

2. What data we collect

Order data

When you place an order we collect your name, email address, shipping address, and country. Payment is processed by Stripe — we never see or store your card details.

Anonymous visit statistics

We record which country and device type each page visit comes from, and which page was visited. This is done entirely server-side. We do not use cookies or tracking pixels for this purpose, and the data cannot be linked back to an individual person.

What we do not collect

We do not use advertising networks, social media trackers, or third-party analytics services.

3. Why we collect it (legal basis)

• Order data — necessary to perform the contract of sale (GDPR Art. 6(1)(b)).
• Anonymous visit statistics — legitimate interest in understanding our audience reach (GDPR Art. 6(1)(f)). Because no personal data is involved, this interest is not overridden by your rights.
• Financial records — legal obligation under Dutch bookkeeping law (GDPR Art. 6(1)(c)).

4. How long we keep your data

• Order records — 7 years from the order date, as required by Dutch tax law (Belastingdienst). After this period records are deleted.
• Anonymous visit statistics — 12 months on a rolling basis.

5. Who we share data with

• Stripe — processes your payment. See Stripe's Privacy Policy.
• Resend — sends transactional emails (order confirmation, shipping notification). Your email address is passed to Resend solely for delivery of these messages.
• We do not sell, rent, or otherwise share your data with any other party.

6. Cookies

This website uses only essential session cookies required for admin panel authentication. These cookies are not set for regular visitors browsing or purchasing on the site.

Our visit statistics are collected server-side without cookies. No consent is required.

7. Your rights

Under the GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Erasure — request that your personal data is deleted (see Section 8).
• Portability — receive your data in a machine-readable format.
• Rectification — ask us to correct inaccurate data.
• Object — object to processing based on legitimate interest. Note that financial records must be kept under Dutch law regardless of an objection.

To exercise any of these rights, email hello@dearshahrukh.com with the subject line “GDPR Request”.

You also have the right to lodge a complaint with the Dutch data protection authority: Autoriteit Persoonsgegevens.

8. How to request erasure

You may request that we erase your personal data at any time. To do so, email hello@dearshahrukh.com with the subject line “Erasure Request” and the email address used when placing your order.

We will process your request within 30 days.

Erasure means your name, email address, and shipping address are replaced with anonymised placeholders. Order amounts and dates are retained to satisfy our legal bookkeeping obligation.

9. Changes to this policy

We may update this policy when our practices change. The “Last updated” date at the top of this page will reflect any changes.