Privacy policy

 

This Privacy Policy describes how whitefoxboutiqueb.shop handles personal information when you visit our storefront, place an order, communicate with us, or request support. In this policy, “we,” “us,” and “our” mean the business operating whitefoxboutiqueb.shop. Contact details for privacy questions and requests appear below.

1. Information We Collect

• Contact and delivery information: your name, email address, telephone number, billing address, and shipping address.
• Order information: products purchased, order identifiers, amounts paid, delivery status, and records of cancellations, returns, or refunds.
• Payment-related information: payment status, transaction references, and limited payment-method information made available by the payment provider. Payment credentials supplied at checkout are handled by the payment service involved in the transaction.
• Communications: messages, attachments, product-issue descriptions, and other information you choose to provide when contacting us.
• Technical and usage information: IP address, browser and device details, pages requested, timestamps, and identifiers needed to maintain a session, operate the cart, and protect checkout.

We obtain information directly from you, automatically through operation of the storefront, and from providers handling payments, hosting, fulfillment, delivery, and fraud prevention. Please provide only information relevant to your request and avoid sending passwords or complete payment-card details by email.

2. Purposes and Lawful Bases

We process personal data to administer orders, take payment, arrange delivery, handle returns and refunds, provide support, maintain security, prevent fraud, keep legally required records, and operate the storefront. The lawful basis is normally performance of a contract or steps requested before a contract, compliance with legal obligations, or legitimate interests that are not overridden by individual rights. Where processing requires consent—such as certain non-essential cookies, advertising technologies, or electronic marketing—we rely on consent and allow it to be withdrawn.

Legitimate interests may include securing the website, detecting abuse, maintaining transaction evidence, improving service reliability, and establishing or defending legal claims. We assess necessity and impact before relying on that basis. Transactional communications are not marketing. Marketing choices do not affect the ability to make an ordinary purchase.

3. Recipients of Information

We disclose relevant information to service providers that support the storefront and order process, including Shopify as our commerce platform, payment processors, delivery carriers, fulfillment providers, technical-support providers, and professional advisers. We limit disclosures to the functions involved and applicable legal requirements.

Information may also be disclosed when reasonably necessary to comply with a valid legal demand, protect legal rights, investigate fraud, or address security incidents. If the business is transferred or reorganized, relevant records may be transferred subject to appropriate protections and any required notice.

Shopify and payment providers may process certain information for their own legal, security, and service purposes. Their separate notices explain those activities. See Shopify's Privacy Policy and Shopify's privacy controls. Your purchase contract remains with our store.

4. Cookies, Storage Technologies, and Advertising

Strictly necessary cookies and similar technologies may be used to operate checkout, remember security settings, maintain a basket, prevent fraud, and provide functions requested by the user. Where the Privacy and Electronic Communications Regulations 2003 require consent, non-essential analytics, advertising, audience-matching, and similar technologies must remain disabled until valid consent is obtained.

Consent must be freely given, specific, informed, and shown by a clear positive action. Continuing to browse is not consent, and rejecting non-essential technologies should be as easy as accepting them. Users must be able to revisit their choices. The final storefront must identify the technologies actually deployed, their providers, purposes, and durations in an accessible cookie notice or settings tool.

Configuration not verified. This draft does not assert that analytics pixels, personalised advertising, Shopify enhanced services, or cross-site tracking are enabled or disabled. The live configuration must be audited before publication and the notice updated to match reality.

5. Retention and Security

We retain information for as long as reasonably needed for the purposes described above, including order support, accounting, tax requirements, fraud prevention, and the establishment or defense of legal claims. Retention depends on the information's nature, the transaction, applicable obligations, and any unresolved dispute. Information no longer required is deleted or de-identified where appropriate.

We use reasonable safeguards intended to protect personal information. No method of transmission or storage is completely secure. Please contact us if you believe an order or communication associated with our store has been compromised.

6. Privacy Requests and Complaint Procedure

Subject to legal conditions and exemptions, individuals may request access to their personal data, correction, erasure, restriction, portability, or objection to certain processing, and may withdraw consent at any time where consent is the basis. They may also ask for safeguards relating to qualifying solely automated decisions.

Email info@whitefoxboutiqueb.shop with the request. We may ask for proportionate information to confirm identity and locate records. Under the UK GDPR as amended by the Data (Use and Access) Act 2025, the response period generally begins when we have the information reasonably required to identify the requester and locate the requested information. We normally respond without undue delay and within one month, subject to a lawful extension for complexity or number of requests with timely notice.

Before lodging a regulatory complaint, individuals may raise a data-protection complaint with us so we can investigate. We will acknowledge it and respond without undue delay. This internal route does not remove the right to complain to the Information Commission or seek a judicial remedy.

7. Children and International Processing

The store is not directed to children and we do not knowingly seek personal data from a child who cannot lawfully provide the relevant data or consent. If we learn that such information was collected without an appropriate legal basis or required parental authorisation, we will take reasonable steps to delete or restrict it. The live storefront should be reviewed for products, content, profiling, or age-assurance features that could create additional children’s privacy duties.

Shopify and other providers may process information in the United Kingdom and other countries. Where personal data is transferred internationally, we use or rely on an applicable adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard, together with supplementary measures where required.

8. Order Records and the Role of Each Participant

Different participants in a transaction can hold different records. We use the customer and order information available to us to administer the purchase and provide support. A payment provider may separately maintain payment authentication and dispute records, while a carrier may hold routing, delivery, signature, and delivery-photograph information. Their handling of information may be governed by their own notices and legal duties.

A request sent to us covers information for which we are responsible and the assistance we are legally required to obtain from our providers. We will explain when a request concerns a separate provider's independently controlled records. Referring you to a provider does not release us from our own responsibilities for information disclosed through our store.

9. Information Supplied About Other People

You may supply another person's delivery details when arranging a gift or an authorized purchase. Provide only the information needed to complete that request and ensure you have an appropriate reason to provide it. We use a recipient's delivery information for the transaction and related support; receiving a gift does not by itself constitute agreement to receive marketing.

When a person asks about an order placed by someone else, we may need to confirm their authority before revealing information, changing an address, or discussing a payment. Verification should reflect the sensitivity of the action. A request for general product information ordinarily does not require identity verification.

10. Financial Information and Sensitive Details

Checkout may require payment details necessary for the method you select. Do not assume that a payment processor's collection of a card credential means our support team can see the complete credential. We use payment status and the limited transaction information made available to us for order administration, fraud checks, refunds, and dispute resolution.

We do not ask customers to send passwords, complete card numbers, health records, or government identifiers in ordinary support correspondence. If a specific legal or transaction requirement makes additional information necessary, we will explain the purpose and an appropriate method for providing it. Any legally defined sensitive information is handled subject to the limitations applicable to its actual use.

11. Operational Logs and Service Diagnostics

Technical information helps the storefront respond to page requests, maintain a shopping session, detect suspicious activity, and investigate failures. Relevant records may indicate that a checkout request encountered an error without containing the full contents of a payment credential. Access to diagnostic information should be tied to the operational task involved.

12. Preference Choices and Their Effects

Some privacy choices operate at browser level and others relate to an identifiable customer record. Deleting cookies or switching devices may remove locally stored preferences. If you use more than one browser, you may need to manage local cookie settings on each. A browser choice does not necessarily identify every transaction associated with your email address.

You may also contact us directly to explain a privacy concern. We will distinguish an opt-out request from a deletion request or a request to stop promotional email because those actions have different effects. Necessary records may remain after marketing stops, and deleting an order record does not automatically undo a completed financial transaction.

13. UK Transparency and Data-Use Disclosures

This notice is intended to provide the information required by the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025, and PECR for the processing it accurately describes. It identifies categories of data, purposes, lawful bases, recipients, retention approach, international transfers, rights, and contact routes. The operator must complete a data inventory and update this notice if actual practices differ.

Where personal data is obtained from another source, additional source information and timing rules may apply. Where an exemption or disproportionate-effort provision is relied upon, appropriate safeguards and publicly available information must be maintained as required by law. This draft does not claim an exemption.

14. UK Data-Protection Rights

Individuals may have rights to be informed, access personal data, correct inaccurate data, erase data in qualifying circumstances, restrict processing, receive portable data, object to direct marketing and certain other processing, and obtain safeguards regarding qualifying automated decisions. The Data (Use and Access) Act 2025 amends but does not replace the UK GDPR, Data Protection Act 2018, or PECR.

Direct-marketing objections are honoured. Consent can be withdrawn as easily as it was given. Rights are not absolute: legal recordkeeping, fraud prevention, freedom of expression, legal claims, and other exemptions may permit or require continued processing. We will explain any lawful limitation.

As of the date of this draft, supervisory functions are exercised by the Information Commission, which succeeded the office of the Information Commissioner on 30 September 2026. Individuals may complain to that regulator using the current contact route published on its official website. Regulator names and links should be rechecked immediately before publication.

15. Identity Verification and Representatives

We use proportionate verification and do not request more information than reasonably necessary. A representative may act where the law permits and authority can be demonstrated. We may communicate directly with the individual where needed to confirm authority or protect information.

A request is not rejected solely because it arrives by email or does not use a form. Where clarification is reasonably needed to identify the requested information, we will explain what is needed and why. Excessive or manifestly unfounded requests may be handled only as permitted by law.

16. Deletion Exceptions and Corrected Records

A deletion request does not always require erasing every record immediately. Relevant exceptions may permit retention to complete a requested transaction, comply with tax or other legal obligations, prevent fraud, address security incidents, or establish and defend legal claims. We will explain a material exception rather than use recordkeeping as a blanket reason to disregard the request.

A correction can update an inaccurate contact or order-support record while preserving the historical accuracy of an invoice or transaction log where required. We distinguish correcting a fact from altering a valid record of what occurred. If we disagree that information is inaccurate, we will explain the decision and any available review route.

17. Retention by Record Type

Transaction records are retained according to accounting, tax, payment-dispute, and contract requirements. Support records are assessed according to the unresolved issue and the need to demonstrate its resolution. Technical records are assessed according to security and troubleshooting needs. Marketing preferences may need to be retained in a limited suppression record so an unsubscribe request continues to be respected.

These criteria do not create an unlimited retention period. When the relevant need ends, information should be deleted or de-identified subject to lawful exceptions and practical backup handling. Where deletion from a backup is not immediate, the information should not be restored to ordinary use merely to avoid the effect of a valid request.

18. International Requests and Transfers

Personal data may be processed outside the United Kingdom by Shopify, payment providers, carriers, cloud providers, or support services. We must identify the actual destinations and transfer mechanisms used. Applicable safeguards can include UK adequacy regulations, the International Data Transfer Agreement, the UK Addendum, binding corporate rules, or a specific statutory derogation used only where appropriate.

Individuals may request information about relevant safeguards. A provider’s separate notice does not remove our duty to describe our own role accurately. Transfers do not reduce rights provided by applicable UK data-protection law.

19. Public Reviews and Voluntary Content

If a review or other public-submission feature is available and you choose to publish content, information you include may be visible to other visitors. Avoid posting order numbers, home addresses, phone numbers, payment information, or another person's private details. Private support correspondence is not treated as permission to publish it as a testimonial.

20. Security Concerns and Suspicious Messages

Contact us if you receive a message that appears to misuse our store identity or asks for unexpected sensitive information. Describe the message and provide only the details needed to assess it. Do not open a suspicious attachment or provide a password simply because a message mentions an order number.

Where a security incident affects personal information, we will assess the event and provide notices required by applicable law. This policy is not a guarantee that an incident can never occur. A report to customer service does not require a customer to perform a technical investigation or collect information from someone else's account.

21. Material Changes in Processing

Changes to collection purposes, recipient categories, or advertising practices can require more than editing a date. Before implementing a material new practice, we will provide the information and choices required by applicable law. Previously collected information will not automatically be repurposed merely because a revised policy is posted.

Questions about a policy change may be sent to info@whitefoxboutiqueb.shop with the relevant date or paragraph. We will explain the practice at issue and the available request route. If a concern remains unresolved, you may use any complaint or appeal channel available under applicable law without being penalized for doing so.

22. Changes, Controller Contact, and Regulator

We may update this policy to reflect changes in law, technology, providers, or practices. Material changes are posted with a revised date and, where required, brought to affected individuals’ attention before the new use begins. Consent is requested where a new purpose cannot lawfully rely on the existing basis.

Data controller/store: the business operating whitefoxboutiqueb.shop (legal name not yet verified)
Website: https://whitefoxboutiqueb.shop
Privacy email: info@whitefoxboutiqueb.shop
Business address: 14 BRAESIDE PARK, BALLOCH, INVERNESS, United Kingdom

You may complain to the UK Information Commission using the current details published by the regulator. Please verify the operator’s legal identity, ICO/Information Commission registration position, actual data map, cookie banner, processors, retention schedule, and international-transfer safeguards before publishing this draft.