diff --git a/config/core.php b/config/core.php
index bd901cb..54eabde 100644
--- a/config/core.php
+++ b/config/core.php
@@ -35,11 +35,11 @@ return [
 
     'privacy' => [
         'providers' => [
-            \Modules\Core\Privacy\Providers\CustomerDataProvider::class,
-            \Modules\Core\Privacy\Providers\AddressDataProvider::class,
-            \Modules\Core\Privacy\Providers\OrderDataProvider::class,
-            \Modules\Core\Privacy\Providers\CartDataProvider::class,
-            \Modules\Core\Privacy\Providers\ReviewDataProvider::class,
+            \Modules\Core\Customer\Privacy\CustomerDataProvider::class,
+            \Modules\Core\Customer\Privacy\AddressDataProvider::class,
+            \Modules\Core\Order\Privacy\OrderDataProvider::class,
+            \Modules\Core\Cart\Privacy\CartDataProvider::class,
+            \Modules\Core\Review\Privacy\ReviewDataProvider::class,
         ],
 
         'grace_period_days' => 30,
diff --git a/docs/privacy.md b/docs/privacy.md
index c74db14..2359c44 100644
--- a/docs/privacy.md
+++ b/docs/privacy.md
@@ -61,6 +61,17 @@ implements that method as a no-op — `ErasureOutcome::Skipped` with a reason fo
 payload for export (e.g. `AddressDataProvider::eraseForUser()`, since addresses belong to a
 Customer, not an individual).
 
+A provider implementation lives inside the module that owns the data it erases/exports, under
+that module's own `Privacy/` subdirectory (e.g. `Modules\Core\Order\Privacy\OrderDataProvider`,
+`Modules\Core\Customer\Privacy\CustomerDataProvider`) — never inside `Modules\Core\Privacy`
+itself, which only owns the shared contract (`Contracts\PersonalDataProvider`), the request
+lifecycle (`Services\PrivacyManager`/`PrivacyService`), and the DTOs/enums every provider
+returns. This mirrors how this codebase already handles other cross-cutting-but-domain-specific
+code (e.g. a resource's own `Filament/Extensions/` subdirectory) — and matters concretely if a
+module is ever extracted into its own composer package (see `docs/modules.md`): the provider
+that knows how to erase that module's data must travel with it, not get stranded in `Privacy`
+depending on a package that no longer ships in this repo.
+
 A module registers by adding its provider class to `config('core.privacy.providers')` — the
 same shape as Lunar's own `config('lunar.search.indexers')` model→indexer map:
 
@@ -68,11 +79,11 @@ same shape as Lunar's own `config('lunar.search.indexers')` model→indexer map:
 // config/core.php
 'privacy' => [
     'providers' => [
-        \Modules\Core\Privacy\Providers\CustomerDataProvider::class,
-        \Modules\Core\Privacy\Providers\AddressDataProvider::class,
-        \Modules\Core\Privacy\Providers\OrderDataProvider::class,
-        \Modules\Core\Privacy\Providers\CartDataProvider::class,
-        \Modules\Core\Privacy\Providers\ReviewDataProvider::class,
+        \Modules\Core\Customer\Privacy\CustomerDataProvider::class,
+        \Modules\Core\Customer\Privacy\AddressDataProvider::class,
+        \Modules\Core\Order\Privacy\OrderDataProvider::class,
+        \Modules\Core\Cart\Privacy\CartDataProvider::class,
+        \Modules\Core\Review\Privacy\ReviewDataProvider::class,
         // A future module just adds its own provider here.
     ],
 ],
diff --git a/src/Privacy/Providers/CartDataProvider.php b/src/Cart/Privacy/CartDataProvider.php
similarity index 98%
rename from src/Privacy/Providers/CartDataProvider.php
rename to src/Cart/Privacy/CartDataProvider.php
index fd1043e..2ef7360 100644
--- a/src/Privacy/Providers/CartDataProvider.php
+++ b/src/Cart/Privacy/CartDataProvider.php
@@ -1,6 +1,6 @@
 <?php
 
-namespace Modules\Core\Privacy\Providers;
+namespace Modules\Core\Cart\Privacy;
 
 use Lunar\Models\Cart;
 use Lunar\Models\CartAddress;
diff --git a/src/Privacy/Providers/AddressDataProvider.php b/src/Customer/Privacy/AddressDataProvider.php
similarity index 95%
rename from src/Privacy/Providers/AddressDataProvider.php
rename to src/Customer/Privacy/AddressDataProvider.php
index 18e0184..c1730f3 100644
--- a/src/Privacy/Providers/AddressDataProvider.php
+++ b/src/Customer/Privacy/AddressDataProvider.php
@@ -1,6 +1,6 @@
 <?php
 
-namespace Modules\Core\Privacy\Providers;
+namespace Modules\Core\Customer\Privacy;
 
 use Lunar\Models\Address;
 use Modules\Core\Privacy\Contracts\PersonalDataProvider;
@@ -17,8 +17,7 @@ use Modules\Core\Privacy\DTOs\UserSubject;
  * OrderAddress, handled by OrderDataProvider), so they're freely deleted outright
  * rather than pseudonymized in place.
  */
-class 
-AddressDataProvider implements PersonalDataProvider
+class AddressDataProvider implements PersonalDataProvider
 {
     public function name(): string
     {
diff --git a/src/Privacy/Providers/CustomerDataProvider.php b/src/Customer/Privacy/CustomerDataProvider.php
similarity index 99%
rename from src/Privacy/Providers/CustomerDataProvider.php
rename to src/Customer/Privacy/CustomerDataProvider.php
index d2ad6e2..e883e60 100644
--- a/src/Privacy/Providers/CustomerDataProvider.php
+++ b/src/Customer/Privacy/CustomerDataProvider.php
@@ -1,6 +1,6 @@
 <?php
 
-namespace Modules\Core\Privacy\Providers;
+namespace Modules\Core\Customer\Privacy;
 
 use Lunar\Models\Customer;
 use Modules\Core\Privacy\Contracts\PersonalDataProvider;
diff --git a/src/Privacy/Providers/OrderDataProvider.php b/src/Order/Privacy/OrderDataProvider.php
similarity index 98%
rename from src/Privacy/Providers/OrderDataProvider.php
rename to src/Order/Privacy/OrderDataProvider.php
index c73fd1c..99c3e74 100644
--- a/src/Privacy/Providers/OrderDataProvider.php
+++ b/src/Order/Privacy/OrderDataProvider.php
@@ -1,6 +1,6 @@
 <?php
 
-namespace Modules\Core\Privacy\Providers;
+namespace Modules\Core\Order\Privacy;
 
 use Lunar\Models\Order;
 use Lunar\Models\OrderAddress;
diff --git a/src/Privacy/Listeners/WriteExportToCsvListener.php b/src/Privacy/Listeners/WriteExportToCsvListener.php
index 3c902ca..37c8d66 100644
--- a/src/Privacy/Listeners/WriteExportToCsvListener.php
+++ b/src/Privacy/Listeners/WriteExportToCsvListener.php
@@ -19,9 +19,11 @@ use ZipArchive;
  * listener) without touching how the data is gathered.
  *
  * Column schema: every provider's data is either a list of associative arrays
- * (rows directly) or a single associative array (one row) — see the providers in
- * Modules\Core\Privacy\Providers, all of which return exactly one of those two
- * shapes. Any nested array value within a row (e.g. an order's `addresses`) is
+ * (rows directly) or a single associative array (one row) — see the providers
+ * registered in config('core.privacy.providers'), each living in its own owning
+ * module's Privacy/ subdirectory (e.g. Modules\Core\Order\Privacy\
+ * OrderDataProvider), all of which return exactly one of those two shapes. Any
+ * nested array value within a row (e.g. an order's `addresses`) is
  * JSON-encoded into that one cell rather than exploded into further columns —
  * CsvWriter's generic stringify() behavior, not special-cased here.
  */
diff --git a/src/Privacy/Providers/ReviewDataProvider.php b/src/Review/Privacy/ReviewDataProvider.php
similarity index 98%
rename from src/Privacy/Providers/ReviewDataProvider.php
rename to src/Review/Privacy/ReviewDataProvider.php
index a9bcc59..d59e561 100644
--- a/src/Privacy/Providers/ReviewDataProvider.php
+++ b/src/Review/Privacy/ReviewDataProvider.php
@@ -1,6 +1,6 @@
 <?php
 
-namespace Modules\Core\Privacy\Providers;
+namespace Modules\Core\Review\Privacy;
 
 use Illuminate\Database\Eloquent\Builder;
 use Modules\Core\Privacy\Contracts\PersonalDataProvider;