Privacy policy

This Privacy Policy explains how ashimaryhairx.shop collects, uses, stores, shares and otherwise processes personal information when you visit our website, communicate with us, create or use customer functionality, place an order or otherwise interact with our services.

For privacy enquiries, contact:

Email: info@ashimaryhairx.shop

UK data-protection transparency rules require organisations to explain matters including the purposes of processing, lawful bases, retention, data sharing and applicable individual rights.

1. Personal Information We May Collect

Depending on how you interact with ashimaryhairx.shop, we may collect information including:

Identity and Contact Information

This may include:

• Name;
• Email address;
• Telephone number;
• Billing address;
• Delivery address; and
• Other contact information supplied by you.

Order and Transaction Information

This may include:

• Products purchased;
• Order number;
• Order value;
• Order status;
• Delivery information;
• Returns;
• Refunds;
• Customer-service communications; and
• Transaction-related records.

Payment Information

Payments may be processed through Shopify and authorised third-party payment providers.

We may receive information relating to payment status and transaction identifiers.

Full payment-card information may be processed directly by authorised payment providers rather than being stored directly by us.

Device and Technical Information

When you use our website, certain information may be collected automatically, including:

• IP address;
• Browser type;
• Device information;
• Operating system;
• Pages visited;
• Referring website;
• Approximate location derived from technical information;
• Date and time of access;
• Cookie identifiers; and
• Website interaction data.

Customer Communications

If you contact us, we may process information contained in your correspondence, including enquiries, complaints, return requests, feedback and supporting documents or photographs.

2. How We Collect Personal Information

We may collect personal information:

• Directly from you;
• Through checkout;
• Through customer accounts or forms;
• When you contact customer support;
• Automatically through cookies and similar technologies;
• From Shopify and ecommerce service providers;
• From payment processors;
• From delivery and logistics providers; and
• From fraud-prevention, security or analytics providers where lawful.

3. Purposes for Which We Use Personal Information

We may use personal information to:

• Process and fulfil orders;
• Confirm transactions;
• Arrange shipping and delivery;
• Provide order tracking;
• Process cancellations, returns and refunds;
• Respond to customer enquiries;
• Provide customer service;
• Maintain customer accounts;
• Prevent fraudulent transactions;
• Protect our website and systems;
• Diagnose technical problems;
• Analyse website performance;
• Improve products and services;
• Comply with legal obligations;
• Maintain accounting and transaction records;
• Establish, exercise or defend legal claims; and
• Send marketing communications where lawfully permitted.

4. Lawful Bases for Processing

Where UK GDPR applies, we process personal information only when we have an appropriate lawful basis.

Depending on the activity, those bases may include:

Performance of a Contract

We may process information where necessary to take steps requested by you before entering into a contract or to perform our contract with you.

For example, this may include processing your name, address and order information to fulfil and deliver an order.

Legal Obligation

We may process information where necessary to comply with legal, regulatory, tax, accounting or consumer-protection obligations.

Legitimate Interests

We may process information where necessary for legitimate business interests, provided that those interests are not overridden by your rights and freedoms.

Legitimate interests may include:

• Protecting our systems;
• Preventing fraud;
• Improving our services;
• Understanding store performance;
• Handling legal claims; and
• Maintaining appropriate business records.

Consent

Where consent is legally required, we may process information based on your consent.

You may withdraw consent at any time, although withdrawal does not affect the lawfulness of processing that took place before withdrawal.

ICO guidance requires organisations relying on lawful bases to identify and communicate the relevant basis for processing.

5. Shopify and Service Providers

Our store uses Shopify ecommerce technology.

To operate ashimaryhairx.shop, personal information may be processed by service providers supporting functions such as:

• Ecommerce hosting;
• Checkout;
• Payment processing;
• Fraud prevention;
• Order management;
• Delivery;
• Analytics;
• Customer communication;
• Marketing;
• Website functionality;
• Information security; and
• Technical support.

We seek to use personal information only as reasonably necessary for the relevant service and subject to applicable data-protection requirements.

Shopify confirms that merchants may add privacy and other legal policies through Shopify's store-policy functionality.

6. Payment Processing

Payment information may be shared with authorised payment processors when necessary to process a transaction, verify payment, prevent fraud, handle disputes or issue refunds.

Payment providers may process information according to their own legal obligations and privacy practices.

7. Shipping and Logistics

We may provide necessary information to shipping, fulfilment and logistics providers so that they can:

• Prepare orders;
• Dispatch parcels;
• Deliver orders;
• Provide tracking;
• Resolve delivery problems; and
• Process qualifying returns.

The information disclosed may include name, delivery address, telephone number, email address and order information.

8. Fraud Prevention and Security

We may use personal information to detect, investigate and prevent suspected fraud, abuse, security incidents and unauthorised transactions.

This may include analysing technical, transaction and account information where necessary and lawful.

9. Cookies and Similar Technologies

ashimaryhairx.shop may use cookies and similar technologies to:

• Operate essential website functions;
• Remember preferences;
• Maintain shopping-cart functionality;
• Support secure checkout;
• Understand website usage;
• Measure performance; and
• Support analytics or marketing where permitted.

UK rules governing cookies include the Privacy and Electronic Communications Regulations as well as UK data-protection requirements where personal data is involved. ICO guidance confirms that PECR can apply to cookies even where cookie information is anonymous.

Where consent is legally required for non-essential cookies or similar technologies, such technologies should not be used until the required consent has been obtained.

10. Marketing Communications

Where legally permitted, we may send information about products, promotions or store updates.

Customers may unsubscribe from marketing communications using the unsubscribe functionality included in applicable communications or by contacting:

info@ashimaryhairx.shop

Where electronic marketing requires consent under PECR, consent will be treated in accordance with applicable UK GDPR requirements.

11. Sharing Personal Information

We may disclose personal information where reasonably necessary to:

• Shopify;
• Payment providers;
• Fulfilment providers;
• Delivery companies;
• IT and website providers;
• Fraud-prevention providers;
• Analytics providers;
• Professional advisers;
• Government or regulatory authorities where required by law;
• Courts or law-enforcement authorities where legally required; or
• Parties involved in a legitimate corporate transaction where permitted by law.

We do not disclose personal information arbitrarily.

UK GDPR requires an appropriate lawful basis for processing and sharing personal information.

12. International Data Transfers

Some providers used in operating an ecommerce business may process personal information in countries outside the United Kingdom.

Where UK data-protection law requires safeguards for an international transfer, appropriate transfer mechanisms and safeguards should be used.

13. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and for legitimate legal, accounting, tax, fraud-prevention, dispute-resolution and recordkeeping requirements.

Retention periods may vary depending on:

• The type of information;
• The nature of the transaction;
• Legal requirements;
• Contractual requirements;
• Potential disputes; and
• Security considerations.

When information is no longer reasonably required, we may delete, anonymise or securely dispose of it, subject to legal obligations.

14. Information Security

We use reasonable technical and organisational measures intended to protect personal information from:

• Unauthorised access;
• Unlawful disclosure;
• Accidental loss;
• Improper alteration;
• Misuse; and
• Destruction.

No internet-based system can be guaranteed to be completely secure, and customers should also take reasonable precautions to protect their account and device information.

The UK GDPR requires organisations to incorporate appropriate data-protection practices into the design and operation of their processing activities.

15. Your UK Data Protection Rights

Depending on the circumstances and applicable law, you may have rights including:

• The right to be informed;
• The right of access;
• The right to rectification;
• The right to erasure;
• The right to restrict processing;
• The right to data portability;
• The right to object to certain processing;
• Rights concerning certain automated decision-making; and
• The right to withdraw consent where processing is based on consent.

Not every right applies in every circumstance, and statutory exemptions may apply.

ICO guidance identifies access, rectification, erasure, restriction, objection and portability among the rights that privacy information may need to explain.

To submit a privacy request, contact:

info@ashimaryhairx.shop

We may reasonably request information necessary to verify identity before responding to a rights request.

16. Right to Object to Direct Marketing

You have the right to object to the processing of your personal information for direct-marketing purposes.

If you object to direct marketing, we will stop using your information for that purpose where required by law.

ICO guidance recognises the right to object to direct marketing as particularly strong.

17. Complaints

If you believe that your personal information has been handled improperly, please contact us first at:

info@ashimaryhairx.shop

You may also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's data-protection supervisory authority.

18. Children's Privacy

Our store is intended for general retail customers and is not designed for children to independently enter into purchases where they lack legal capacity to do so.

We do not knowingly seek to collect personal information from children in circumstances where doing so would be unlawful.

19. Third-Party Websites

Our website may contain links to third-party websites or services.

We are not responsible for the privacy practices of independent third parties. Customers should review the applicable third-party privacy information before supplying personal information directly to them.

20. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in:

• Our services;
• Ecommerce technology;
• Business operations;
• Legal obligations; or
• Data-protection practices.

The current version will be published on ashimaryhairx.shop with an updated revision date.

21. Contact

For privacy questions or requests:

ashimaryhairx.shop
Email: info@ashimaryhairx.shop