Privacy policy

1. Introduction and Contact

This Privacy Policy describes how hesteran.shop handles personal information in connection with https://hesteran.shop, purchases, customer communications, and related store services. It is intended for customers and website users, including people in the United Kingdom. Personal information means information relating to an identified or identifiable individual.

For questions about this policy or to exercise a privacy right, email info@hesteran.shop. In this policy, “we”, “us”, and “our” refer to the retailer trading through hesteran.shop. We determine the purposes and means of the store's customer-information processing where we act as controller. Service providers may act as processors or independent controllers depending on the service and applicable arrangements.

The information practices described here depend on how you interact with the store and which services you choose to use. A description of a possible optional function does not mean that function is enabled on every visit. This policy does not turn website use into consent for optional cookies or marketing.

2. Information You Give Us

When you place an order, contact support, or use an available account function, you may give us your name, email address, billing address, delivery address, telephone number where requested, and account information. We also receive details of the goods purchased, selected variants, amounts paid, and relevant order history.

Customer-service communications may include messages, return reasons, delivery questions, and photographs or other evidence you choose to provide about an order. We use this information to understand and resolve your enquiry. Please avoid sending health information, identity documents, or other sensitive information unless specifically requested for a necessary and lawful purpose.

If you subscribe to marketing or submit a review through an available feature, we receive the information you supply and records of the relevant choice. Public reviews may display the name or other attribution disclosed by that feature. Please consider what personal information you include in content intended for public display.

3. Information Generated During Website Use

Depending on the technology in operation and your choices, website interactions may generate information such as IP address, browser type, device characteristics, language, referring page, timestamps, pages viewed, and error or security logs. Cookies and similar technologies can support shopping carts, checkout, preferences, or optional analytics and advertising functions.

Essential technical information helps make the store available, maintain security, and process transactions. Optional tracking must operate in accordance with applicable consent requirements and the choices made through the relevant controls. Refusing optional tracking should not require you to give up access to essential purchasing functions.

We may retain records of consent choices so that we can respect them and demonstrate compliance. A browser setting that deletes cookies may remove a stored choice, in which case the website may ask you to choose again.

4. Information from Service Providers

Shopify supports our ecommerce platform and may provide order records, checkout information, platform logs, and relevant customer-management functionality. Payment providers send us transaction status, payment references, limited payment information, and fraud-related signals needed to manage a purchase.

Delivery providers may supply tracking events, delivery status, address issues, and information needed to investigate a missing parcel. Where permitted, service providers may also provide security or abuse-prevention information relevant to protecting our customers and store.

We do not ask customers to email full card details or payment passwords. Full payment credentials are handled through the payment service used at checkout. The information available to us may include the payment type, partial account identifiers, and confirmation of payment or refund.

5. Why We Process Information and Our Legal Bases

We process order, contact, delivery, and transaction information where necessary to enter into or perform a purchase contract, including taking steps you request before a contract. This covers processing orders, receiving payments, arranging delivery, handling appropriate returns, and communicating about your purchase.

We process some information to comply with legal obligations, such as accounting, taxation, consumer-law requirements, and responding to valid legal demands. The relevant obligation determines the information and retention required.

We may rely on legitimate interests for necessary and proportionate purposes such as securing the website, detecting fraud, preventing misuse, maintaining appropriate business records, handling complaints, and establishing or defending legal claims. We consider the impact on individuals and apply safeguards. You can ask us for more information about a relevant legitimate-interest assessment.

Where consent is required, including for applicable optional cookies or particular marketing activities, we rely on your consent. You can withdraw consent at any time, without affecting the lawfulness of processing that occurred before withdrawal.

We do not treat every purpose as covered by every legal basis. The appropriate basis depends on the specific processing. If information is needed for a contract or legal requirement, we will explain the consequences of not supplying it when relevant.

6. Marketing Communications

If marketing communications are offered, we send them only where permitted by applicable law. This may be based on an opt-in or, where all legal conditions are met, the limited existing-customer exception for our own similar products or services. Any such exception requires an appropriate opportunity to opt out when details are collected and in subsequent messages.

You may unsubscribe through the link in a marketing email or contact info@hesteran.shop. Opting out of marketing does not stop essential order confirmations, delivery notices, refund updates, or necessary service communications.

We may keep a minimal suppression record to ensure that an opt-out is honoured. Deleting every trace of the email address could otherwise cause an opted-out person to be added again accidentally. We use the suppression record for that protective purpose rather than to continue sending promotions.

7. Cookies, Analytics, and Advertising Choices

Cookies and similar technologies can enable the cart, checkout, security checks, and user-requested functions. Technologies strictly necessary to provide a service you request may be used without optional-cookie consent where the law permits.

Where optional analytics or advertising technologies are enabled and consent is legally required, they must remain inactive until you make an appropriate choice. The relevant consent interface should let you accept, reject, or manage optional categories and change your decision later. We do not infer optional-cookie consent from continued browsing or acceptance of these terms.

If optional advertising services are used, data may include online identifiers and interactions needed to measure or personalise advertising. The applicable controls and disclosures should identify the active services. This policy does not assert that a particular advertising platform or pixel is installed.

Browser tools can block or delete cookies, although doing so may affect some requested store features. A separate third-party website may offer additional privacy or advertising controls; its settings apply according to that provider's own service.

8. Who Receives Information

We share information with service providers to the extent needed for the relevant purpose. Categories may include Shopify and associated ecommerce services, payment processors, delivery and logistics providers, technical hosting and security services, and customer-support tools actually used for an enquiry.

Where optional marketing or analytics services are enabled, the relevant provider may receive information according to the lawful configuration and your consent choices. We do not imply that every category listed here is active in the store.

Professional advisers, accountants, insurers, regulators, courts, or other authorities may receive necessary information for advice, legal obligations, dispute handling, or lawful investigations. We assess requests and disclose information only on an appropriate basis.

If a business transaction such as a sale or restructuring involves customer records, disclosure must have a lawful basis, be appropriately safeguarded, and respect applicable information duties. Personal information is not made unrestricted merely because a business changes ownership.

9. Shopify and Independently Provided Services

Shopify operates the platform supporting our store. Depending on the function, Shopify may process information on our behalf or for its own purposes described in its privacy notices. You can read Shopify's privacy information at https://www.shopify.com/legal/privacy.

If you choose a service such as Shop, Shop Pay, or another independently provided payment or account feature where offered, that provider may process information under its own terms and privacy policy. The availability of a payment option is shown at checkout; this policy does not guarantee that every Shopify-related feature is available.

Our responsibilities for store data remain distinct from a provider's own responsibilities. You may contact us about our use of information, and the relevant provider about processing for which it independently determines the purposes and means.

10. International Transfers

Ecommerce providers can operate internationally, and information may be processed outside the United Kingdom. Where a restricted international transfer is involved, we use or require an appropriate transfer mechanism and safeguards under applicable data-protection law.

These may include a UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another legally permitted mechanism. Where required, transfer-risk assessments and additional safeguards support the arrangement.

The appropriate mechanism depends on the destination and provider. A provider's global operations do not mean that every transfer is automatically lawful. Email info@hesteran.shop to ask about the relevant safeguards or how to obtain information about them, subject to lawful confidentiality protections.

11. How Long We Keep Information

We keep personal information only for as long as needed for its purpose, taking account of legal requirements and legitimate needs. Order and financial records may need to be retained for accounting, taxation, refund administration, and legal claims after a purchase is completed.

Support records are retained according to the nature of the enquiry, the need to resolve related issues, and applicable limitation periods. Security logs are retained for the period reasonably needed to investigate incidents and protect the service. Optional marketing records are assessed by reference to your preferences and whether the relationship remains relevant.

There is no single retention period that fits every record. We consider the data category, sensitivity, purpose, legal obligation, and whether anonymisation or deletion is possible. Backup copies may remain until the relevant backup cycle expires, with access restricted and data not restored for unrelated use.

You can ask us about the retention period or criteria applying to your information. A deletion request may require us to remove some information while keeping limited records that the law requires or permits us to retain.

12. Security

We use reasonable organisational and technical measures appropriate to the information and risks involved. These can include access restrictions, secure service configurations, and controls designed to reduce unauthorised access, loss, or misuse. Payment services supply their own security measures for the payment functions they operate.

No transmission or storage system can be described as entirely risk-free. If a personal-data breach occurs, we will assess it and make the notifications required by applicable law, including informing affected individuals where required.

Please protect any account credentials, avoid sending payment passwords by email, and contact us if a message claiming to come from the store appears suspicious. We will not ask you to disclose a full card number or an account password to resolve an ordinary support request.

13. Your UK Data-Protection Rights

Subject to applicable conditions, you may request access to your personal information and a copy; correction of inaccurate information; erasure; restriction of processing; and portability of qualifying information processed by automated means on consent or contract grounds.

You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing at any time, including related profiling, and we will stop the relevant marketing processing.

You may withdraw consent where processing relies on it. You also have rights concerning solely automated decisions with legal or similarly significant effects where applicable. We do not state that ordinary risk signals or recommendation features necessarily constitute such a decision. If an order appears to have been affected by an automated fraud assessment, contact us so that we can explain our role and the review available under applicable law.

Rights are not absolute in every situation. If we cannot fulfil a request in full, we will explain the relevant reason and your options. We will not refuse a request merely because responding would be inconvenient.

14. Making a Request and Complaining

Send your request to info@hesteran.shop and describe what you are requesting. We may seek information reasonably necessary to verify identity, protect another person's information, or clarify the request. We will not collect excessive identity information for this purpose.

We normally respond within one month, subject to lawful timing rules and extensions. If a permitted extension is necessary because of complexity or the number of requests, we will explain it within the initial response period. Requests are normally free, except where the law permits a reasonable charge or refusal for a manifestly unfounded or excessive request.

You may complain to the UK Information Commissioner's Office through https://ico.org.uk/make-a-complaint/. We welcome an opportunity to address your concerns, but you do not have to contact us first before exercising a right to complain to a regulator.

15. Children, Third-Party Links, and Changes

Our store is intended for general retail use by people able to enter into a purchase contract, or acting with appropriate adult involvement. We do not knowingly seek to collect children's information for independent marketing. If you believe a child has supplied information in circumstances requiring attention, contact us.

Links to third-party websites take you to services with their own practices. Review their notices before supplying information. Linking does not make their privacy policy part of ours.

We may update this policy to reflect actual changes in practices or law. The effective date identifies the current version. Material changes will be communicated where required, and a policy update does not itself create a new consent for previously unapproved optional processing.