Privacy policy

The Wee Coo operates this store and website, including all related information, content, features, tools, products and services, to provide you, the customer, with a personalised shopping experience (the "Services"). The Wee Coo is powered by Shopify, which allows us to provide the Services.

This Privacy Policy explains how we collect, use and share your personal data when you visit or use the Services, make a purchase or contact us.

If there is any conflict between our Terms of Service and this Privacy Policy, this Privacy Policy takes precedence regarding the processing of your personal data.

Data controller. The Wee Coo is the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Contact: [your full name or company name], [business address], [support email].

1. THE DATA WE COLLECT

"Personal data" means any information relating to an identified or identifiable individual. It does not include anonymised data that can no longer identify you.

Depending on how you use the Services, we may collect:

  • Contact details: name, postal address, billing address, delivery address, phone number and email address.
  • Payment details: transaction details, payment method and payment confirmation. We do not store or process your card numbers ourselves; these are collected directly by our payment providers, who handle them securely in line with the PCI-DSS standard.
  • Account details: username, password (encrypted), preferences and settings.
  • Order details: items viewed, added to your basket or wishlist, purchased, returned, exchanged or cancelled, and your order history.
  • Communications with us: the content of your messages when you contact customer service.
  • Technical data: information about your device, browser and network connection, IP address and unique identifiers.
  • Usage data: information about how you browse and interact with the Services.

We do not collect any special category data under Article 9 of the UK GDPR (such as racial or ethnic origin, political or religious beliefs, health, sexual orientation or biometric data).

2. WHERE WE GET YOUR DATA

We collect your personal data:

  • directly from you, when you create an account, place an order, contact us or use the Services;
  • automatically from your device as you browse, including through cookies and similar technologies;
  • from our service providers, when they collect or process data on our behalf;
  • from our partners, in line with applicable law.

3. HOW WE USE YOUR DATA AND OUR LAWFUL BASIS

We only process your data when we have a lawful basis to do so:

  • To process and deliver your orders, handle returns, refunds and exchanges, and manage your account: performance of a contract (Article 6(1)(b) UK GDPR).
  • To answer your questions and provide customer service: performance of a contract or legitimate interests.
  • To prevent and detect fraud and keep payments and the Services secure: legitimate interests (Article 6(1)(f)).
  • To improve the Services and analyse site traffic: legitimate interests, or consent where non-essential cookies are used.
  • To send you marketing by email or SMS: consent (Article 6(1)(a)), or, for similar products to ones you've already bought from us, the "soft opt-in" under the Privacy and Electronic Communications Regulations (PECR). You can opt out at any time.
  • To show you personalised advertising, including on other websites: consent.
  • To publish and moderate customer reviews: consent.
  • To meet our accounting, tax and legal obligations and respond to requests from authorities: legal obligation (Article 6(1)(c)).
  • To establish, exercise or defend legal claims: legitimate interests.

Where we rely on your consent, you can withdraw it at any time. This won't affect the lawfulness of any processing carried out before you withdrew it.

4. WHO WE SHARE YOUR DATA WITH

We do not sell your personal data.

We may share it with:

  • Shopify and our service providers, who act on our behalf and follow our instructions: hosting, payment processing, logistics and delivery, customer service, email services and analytics tools;
  • our advertising and marketing partners, only where you have given consent, for example to show you personalised ads. These partners process your data under their own privacy policies;
  • third parties at your request or with your permission, for example when you use a social media feature or sign in with a third-party account;
  • a buyer or successor in the event of a merger, sale or reorganisation of our business, provided your data remains protected to the same standard;
  • the relevant authorities, where required by law or to protect our rights.

Each service provider is bound by a contract that meets the requirements of Article 28 of the UK GDPR and may not use your data for any other purpose.

5. OUR RELATIONSHIP WITH SHOPIFY

The Services are hosted by Shopify, which collects and processes data about your use of the Services in order to provide them to us. Information you submit through the Services is shared with Shopify and may be processed in countries other than the one you live in.

We also use certain advanced Shopify features that rely on your interactions with our store, with other merchants and with Shopify. For these features, Shopify acts as a controller for its own purposes and handles any requests to exercise your rights relating to them directly. To find out more, please see Shopify's Consumer Privacy Policy.

6. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies to make the site work, remember what's in your basket, measure site traffic and, with your consent, personalise advertising.

Strictly necessary cookies do not require your consent. All other cookies are only set once you have agreed to them through the cookie banner shown on your first visit.

You can change your choices at any time through the cookie settings on our site, or set your browser to refuse cookies. Refusing non-essential cookies will not stop you from using the Services.

7. HOW LONG WE KEEP YOUR DATA

We only keep your data for as long as necessary for the purposes it was collected for:

  • Order and billing data: 6 years from the end of the financial year in which the transaction took place, to meet our legal accounting and tax obligations;
  • Customer accounts: for as long as your account is active, then 3 years from your last activity;
  • Marketing data: 3 years from your last contact with us, or until you withdraw your consent;
  • Customer service enquiries: for as long as needed to deal with your request, then in line with applicable limitation periods;
  • Cookies: for the periods set out in our cookie banner.

When these periods end, your data is deleted or irreversibly anonymised.

8. INTERNATIONAL TRANSFERS

Some of our service providers may process your data outside the United Kingdom.

Where this happens, we make sure the transfer is protected by a safeguard recognised under UK data protection law, such as UK adequacy regulations, the International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses. You can request a copy of these safeguards by contacting us.

9. SECURITY

We use appropriate technical and organisational measures to protect your data against loss, alteration or unauthorised access, including encrypted connections, secure hosting, access restrictions and authentication.

No system is completely secure, so we cannot guarantee absolute security. Please do not send us confidential information through unsecured channels, and never share your password with anyone.

If a data breach is likely to result in a high risk to your rights and freedoms, we will inform you as required by the UK GDPR.

10. YOUR RIGHTS

Under the UK GDPR, you have the right to:

  • Access: confirm whether we process your data and receive a copy of it.
  • Rectification: have inaccurate or incomplete data corrected.
  • Erasure: ask us to delete your data, subject to our legal obligations to keep certain records.
  • Restriction: ask us to limit how we use your data in certain situations.
  • Object: object to processing based on our legitimate interests, and to direct marketing at any time, without giving a reason.
  • Data portability: receive the data you have given us in a structured, machine-readable format and have it transferred to another organisation.
  • Withdraw consent: at any time, where processing is based on consent.

How to exercise your rights. Email our customer service at [support email]. We may need to verify your identity before responding. We will reply within one month; this may be extended by up to two further months for complex requests, in which case we'll let you know.

Exercising your rights is free of charge.

Marketing. You can unsubscribe at any time using the link in any of our emails. We will still send you messages about your orders and account, which are not promotional.

11. COMPLAINTS

If you believe we have not handled your data in line with the law, please contact us first so we can try to resolve your concerns.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection authority: ico.org.uk.

12. CHILDREN'S DATA

The Services are not intended for children. We do not knowingly collect personal data from anyone under 13 without the consent of a parent or guardian.

If you are a parent or guardian and believe a child has given us their data, please contact us and we will delete it as soon as possible.

13. THIRD-PARTY SITES AND LINKS

The Services may link to websites run by third parties. We do not control their content or privacy practices and are not responsible for them. Please read their privacy policies before sharing your data with them.

Information you post in public areas or on social media may be seen by other users, and we cannot control how it is shared.

14. CHANGES TO THIS POLICY

We may update this Privacy Policy to reflect changes to our practices or to the law. The updated version will be published on this page with a new "Last updated" date. If we make significant changes, we will let you know in an appropriate way.

15. CONTACT US

If you have any questions about this Privacy Policy or want to exercise your rights, please contact us at [support email].

The Wee Coo