A jewelry online store sends a marketing email to a customer who bought a ring two years ago. The customer complains to their national data protection authority. The store had no clear opt-in, no unsubscribe in the first email, and no record of where the email address came from. Fines in the EU run up to 4% of global turnover. GDPR for jewelry retailers is not a legal nicety — it is an operating system that has to be built into the store before the first EU order.

What customer data a jewelry store actually holds

Beyond the obvious (name, email, shipping address, phone), jewelry stores hold a profile of customer-specific data: ring size, necklace length, metal allergy notes, past purchases, gift messages, and sometimes engraving text. That is more personal than a generic e-commerce store, because the size and allergy notes are health-adjacent and the purchase history reveals relationship events (engagement, anniversaries). GDPR treats all of it as personal data, not as harmless order metadata. The official text is the GDPR Regulation (EU) 2016/679; the practical starting point is to map every field you collect and why.

The five controls that prevent most complaints

Lawful basis for marketing. Email marketing needs consent, not just "they bought from us." Past-purchase "soft opt-in" has narrow limits — safest to add a separate opt-in at checkout.
Cookie and tracking consent. Analytics and ad-tracking cookies must be off until the user consents. A banner that says "accept all" with no reject option is not compliant.
Right to access and delete. Customers can ask for everything you hold on them, and you must delete it on request within a month. This includes order history unless a legal tax retention period keeps it.
Data processor list. Your payment processor, shipping carrier, email platform and CRM are all processors. You need a data-processing agreement (DPA) with each.
Breach notification. If customer data is exposed, you must notify the authority within 72 hours. Have the contact and process written down.

For the product-side compliance that sits alongside this, see REACH nickel limits and HS codes and tariffs; GDPR is the customer-data side of the same EU market.

The jewelry-specific gaps

Three gaps recur. First, gift messages and engraving text are personal data about a third party (the recipient) you never collected directly — you need a line in the order form explaining what you do with that text. Second, ring-size and allergy notes stored in customer profiles are sensitive-flavoured data; keep them optional, not required. Third, reviews and UGC that show a customer's name alongside an engagement ring reveal personal events; give customers a way to post anonymously. On the disclosure side, product listings must still follow FTC 16 CFR Part 23 for US customers — GDPR does not replace truthful labelling.

What to actually do this quarter

Four concrete steps. Audit the checkout fields: drop anything you do not need. Add a clean consent checkbox for marketing, separate from terms of service. Sign DPAs with your email platform, payment processor and shipping carrier. Write a one-page customer-data policy and link it in the footer. None of this requires a lawyer on day one — most e-commerce platforms ship GDPR-ready cookie banners and consent flows. Build the customer data fields into your SKU and order structure per the catalog SKU guide, and align return and sizing data collection with the page changes in reducing e-commerce returns.

What a customer-data request looks like

A customer emails asking to delete their account and everything you have on them. Your process should be: confirm identity by replying to the email on file, pull their order history, remove marketing tags and profile notes (ring size, allergy), and keep the invoice for the tax retention period. Reply within a month with what you deleted and what you must retain by law. Most small stores never get a request, but having the one-page SOP means you answer correctly when the first one lands.

FAQ

Do we need GDPR if we sell outside the EU?

If you ship to or market to EU customers, yes. EU data protection authorities enforce against non-EU stores that sell into the EU.

Is a cookie banner enough?

No. It is the visible part. You also need consent for marketing, access/delete rights, DPAs with processors, and a breach process.

How long must we keep order records?

Tax and accounting retention rules (usually 6–10 years) override the right to delete for the invoice itself. Customer profile notes and marketing data can and should be deleted on request.

Do we need a Data Protection Officer?

Only if your core activity is large-scale systematic monitoring or sensitive data processing. Most small jewelry stores do not; document your process instead.

HOLYCOME supplies wholesale lines with product data, stone and metal disclosure wording, and packaging components that support your EU-compliant listings. Ask for the compliance spec sheet and product data export for your catalog.