Last updated: August 22, 2026
1. What this covers
This policy explains what personal data we collect when you visit or buy from this store, why, and what rights you have. It applies to customers in the European Union and the United Kingdom, where we sell.
2. Data we collect
You give us: name, email, shipping and billing address, phone number, and payment details entered at checkout.
Collected automatically: device and browser type, IP address, pages viewed, referring site and cookie data, through Shopify's built-in analytics and any analytics or advertising tools we use.
We do not collect or store your full card number — that is handled directly by Shopify's PCI-compliant payment processor.
3. Why we use it, and our legal basis
- To fulfil your order — processing, shipping, customs clearance, returns. Legal basis: performance of a contract.
- To meet legal obligations — tax, accounting, customs declarations. Legal basis: legal obligation.
- To prevent fraud and improve our store — Legal basis: legitimate interests.
- To send marketing email — only if you opted in. Legal basis: consent, withdrawable at any time via the unsubscribe link.
4. Who we share it with
- Shopify — our e-commerce platform and payment processor
- Fulfilment and shipping partners, including facilities outside the EEA — to pick, pack, ship and clear customs on your order. This necessarily includes your name and delivery address.
- Analytics and advertising providers — to measure site usage and campaigns
- Authorities — where required by law
We do not sell your personal data.
5. International transfers
Because our fulfilment partners operate outside the European Economic Area, your name and delivery address are transferred outside the EEA in order to deliver your order. Where we do this we rely on the appropriate safeguards permitted under Chapter V of the GDPR, such as Standard Contractual Clauses, or on the derogation for transfers necessary to perform a contract with you. You can ask us for details of the safeguards that apply.
6. Cookies
We use cookies to keep your cart working, remember preferences and measure traffic. Where required, we ask for your consent before setting non-essential cookies. You can block or delete cookies in your browser, though parts of the site may stop working.
7. Retention
We keep order records for as long as needed to fulfil the purposes above and to meet tax and accounting obligations, typically several years. Marketing data is kept until you unsubscribe.
8. Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent at any time. You also have the right to lodge a complaint with your national supervisory authority.
To exercise any right, email us at the address below. We respond within 30 days.
9. Children
This store is not directed at children under 13 and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
10. Security
Traffic to this site is SSL encrypted and we take reasonable measures to protect your data, though no method of internet transmission is completely secure.
11. Changes and contact
We may update this policy; the version posted here is current. Data controller contact: totopetsshop@gmail.com.