tomas

Privacy Policy

Rowan Leeds ("we", "us", "our") operates this shop and website, including all related information, content, features, tools, products, and services (the "Services"). This Privacy Policy describes how we collect, use, and share personal data when you visit, use, shop on, or otherwise communicate with us through our Services.

Please read this Privacy Policy carefully. Where there is a conflict between our Terms of Service and this Privacy Policy regarding the collection, processing, and sharing of personal data, this Privacy Policy applies.

1. Data Controller

The data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 is Rowan Leeds.

Email: rowan_leeds@zohomail.eu

2. Personal Data We Process

Personal data means any information that identifies you or could reasonably be linked to you. Depending on how you use our Services, we process the following categories:

Contact details: such as name, address, billing and shipping address, phone number, and email address.
Payment details: such as payment method, transaction details, and payment confirmations. Full card and bank details are processed exclusively by our payment providers, not by us.
Account details: such as username, password, settings, and preferences.
Order details: such as items viewed, basket contents, purchases made, returns, exchanges, and cancellations.
Communication data: such as the content of your messages to us, for example in support enquiries.
Device data: such as information about your device, browser, or network, your IP address, and other identifiers.
Usage data: such as information about how and when you use and navigate our Services.

3. Source of Data

We may collect personal data from the following sources:

Directly from you, such as when creating an account, using the Services, or contacting us.
Automatically through the Services, such as from your device and through cookies and similar technologies.
From our service providers, when they process data on our behalf.
From partners or other third parties.

4. Purposes and Legal Bases for Processing

Providing the Services. We process your data to fulfil orders, process payments, arrange delivery, handle returns and exchanges, and manage your account. Legal basis: Article 6(1)(b) UK GDPR (performance of a contract).
Marketing and advertising. We process your data to send you newsletters and promotional content and to show you adverts on our Services or other websites. Legal basis: Article 6(1)(a) UK GDPR (consent). We only send marketing emails and SMS with your prior consent.
Security and fraud prevention. We process your data to authenticate accounts, enable secure payments, and detect and prevent potentially fraudulent or unlawful activity. Legal basis: Article 6(1)(f) UK GDPR (legitimate interests).
Communicating with you. We process your data to handle support enquiries and maintain our business relationship with you. Legal basis: Article 6(1)(b) and 6(1)(f) UK GDPR.
Legal obligations. We process your data to comply with commercial, tax, and other legal requirements and to respond to requests from public authorities. Legal basis: Article 6(1)(c) UK GDPR.

5. Recipients and Data Processors

We may share personal data with third parties in certain circumstances:

With service providers who perform services on our behalf, such as shop hosting, IT operations, payment processing, data analytics, customer service, cloud storage, warehousing, and shipping.
With advertising and marketing partners, who process your data under their own privacy notices.
With third parties where you instruct or consent to it, such as when using social media widgets or login integrations.
With affiliated companies within our corporate group, where applicable.
In connection with corporate transactions, and to comply with legal obligations and enforce our rights.

6. Services We Use

Shopify

Our Services are hosted by Shopify. Shopify collects and processes personal data relating to your access to the Services in order to provide and improve them. Data you submit through the Services is transferred to Shopify and to third parties, which may be located outside the UK.

For more information, see Shopify's Consumer Privacy Policy: https://privacy.shopify.com/en

Shopify Payments

Where Shopify Payments is used, it processes payments made through our store. Full payment card details are handled by the relevant payment provider.

7. Cookies and Consent

We use cookies and similar technologies. Strictly necessary cookies are required for the shop to function and are set on the basis of our legitimate interest in operating the Site.

All other cookies, in particular those used for analytics and marketing, are only set with your consent where required by applicable data protection and privacy laws, including the Privacy and Electronic Communications Regulations (PECR) and Article 6(1)(a) UK GDPR, where applicable.

You can withdraw your consent at any time, with future effect, through the cookie settings on our website.

8. Newsletter

If you sign up for our newsletter, we use your email address to send you offers and news. Where a double opt-in process is used, you will receive an email asking you to confirm your subscription.

The legal basis for processing is your consent under Article 6(1)(a) UK GDPR, where applicable. You can unsubscribe at any time using the unsubscribe link in any marketing email.

9. Contacting Us

If you contact us through our contact form or by email, we process your details in order to handle your enquiry.

The legal basis is Article 6(1)(b) UK GDPR where your enquiry relates to entering into or performing a contract, and Article 6(1)(f) UK GDPR otherwise, where applicable.

10. Links to Third-Party Websites

Our Services may contain links to third-party websites or platforms. If you follow such links, please review their privacy notices and terms of use. We are not responsible for the privacy practices or security of these websites.

11. Children's Data

Our Services are not directed at children. We do not knowingly collect personal data from children under 16.

If you are a parent or guardian of a child who has provided us with personal data, please contact us using the details below to request its deletion, subject to any applicable legal obligations.

12. International Data Transfers

Personal data may be transferred, processed, and stored outside the United Kingdom or the country in which you reside.

Where required by applicable law, we ensure appropriate safeguards are in place for international transfers, such as an adequacy decision, the UK's International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or another legally recognised transfer mechanism.

13. Security and Retention Period

13.1 Security

No security measure is completely fail-safe. We recommend that you do not send us confidential or sensitive information over unsecured channels.

13.2 Data Retention

We retain your personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including meeting legal, accounting, and reporting requirements. Retention periods depend on the type of data and the applicable legal obligations.

Order and transaction data: retained for the period required by applicable accounting and tax laws.
Account data: retained for as long as your account is active and for a reasonable period afterwards, where necessary.
Newsletter and marketing data: retained until you unsubscribe or withdraw your consent, subject to any necessary records of your preferences.
Customer service data: retained for as long as necessary to handle enquiries, resolve disputes, and meet applicable legal obligations.

14. Your Rights

Depending on your location and the applicable data protection laws, you may have the following rights:

Right of access: You can request information about the personal data we process about you.
Right to rectification: You can request that we correct inaccurate or incomplete data.
Right to erasure: You can request the deletion of your data, provided no legal retention obligations or other lawful grounds prevent this.
Right to restriction of processing: You can request that we restrict the processing of your data in certain circumstances.
Right to data portability: Where applicable, you can request your data in a structured, commonly used, machine-readable format or request that it be transmitted to another controller.
Right to object: You can object to certain processing activities, including processing based on legitimate interests. You can object to direct marketing at any time.
Right to withdraw consent: Where processing is based on consent, you can withdraw your consent at any time. This does not affect the lawfulness of processing carried out before your withdrawal.

To exercise your rights, email us at rowan_leeds@zohomail.eu.

We will respond within the timeframes required by applicable law. We may need to verify your identity before processing your request. Exercising your rights will not result in unlawful discrimination or disadvantage.

15. Right to Complain to a Supervisory Authority

If you believe that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority.

If UK GDPR applies, you may contact the UK Information Commissioner's Office (ICO) at https://ico.org.uk.

If you are located in the European Economic Area, you may also contact your local data protection authority.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes to our operations, services, or legal requirements.

We will publish the current version on this website and update the date of the latest revision where appropriate.

17. Contact

If you have questions about this Privacy Policy or how we handle personal data, please contact Rowan Leeds at:

Email: rowan_leeds@zohomail.eu

Customer service hours and response times may vary. Please refer to the contact information provided on our website.