Privacy Policy

PRIVACY POLICY
Paws Pet Shop
www.pawspetshop.co.uk

Last updated: September 2026

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

This Privacy Policy explains how Paws Pet Shop ("we", "us", "our") collects,
uses, stores, and shares your personal data when you visit or make a purchase
from www.pawspetshop.co.uk ("the Website").

We are committed to protecting your privacy and handling your data in an open
and transparent manner. Please read this policy carefully. If you have any
questions, contact us at contact@pawspetshop.co.uk.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. WHO WE ARE — DATA CONTROLLER
──────────────────────────────────────────────────────────

1.1  The data controller for your personal data is:

       Mr Philippe Marion
       Website: www.pawspetshop.co.uk
       Email:   contact@pawspetshop.co.uk
       Address: Appletree Cottage, Keynor Lane, Sidlesham,
                Chichester, PO20 7NL, United Kingdom

1.2  As data controller, we determine why and how your personal data is
     processed. We are registered with the Information Commissioner's Office
     (ICO) under registration number ZC244498.

1.3  This Website is operated using the NivoCart e-commerce platform, which
     provides the technical infrastructure for customer accounts, order
     management, session handling, and cookie management described in this
     policy.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

2. THE DATA WE COLLECT AND WHY
──────────────────────────────────────────────────────────

We collect the following categories of personal data. For each, we identify
the lawful basis under the UK General Data Protection Regulation (UK GDPR)
and the Data Protection Act 2018 (DPA 2018).

─────────────────────────────────────────────

2.1  Account Registration Data

     When you create a customer account, we collect:

       - First name and last name
       - Email address
       - Telephone number
       - Company name, Company ID, and Tax ID (if registering as a business)
       - Delivery address (address line 1 and 2, city, postcode, country,
         and county/zone)
       - Newsletter subscription preference (yes/no)
       - Password (stored in hashed/encrypted form — never as plain text)

     Lawful basis: Performance of a contract (UK GDPR Article 6(1)(b)) —
     this data is necessary to create and manage your account and to process
     your orders.

─────────────────────────────────────────────

2.2  Order and Transaction Data

     When you place an order, we collect and retain:

       - Order details (products ordered, quantities, prices)
       - Billing and shipping address(es)
       - Order status and history
       - Applied discount codes, reward points, or vouchers
       - Any special delivery notes or comments you provide

     Lawful basis: Performance of a contract (UK GDPR Article 6(1)(b)) and
     Legal obligation (Article 6(1)(c)) — we are required to retain financial
     transaction records for a minimum of 6 years under UK tax law (HMRC
     requirements).

─────────────────────────────────────────────

2.3  Payment Data

     Paws Pet Shop does NOT collect, process, or store any credit or debit
     card details on our servers or within our platform.

     All payment transactions are handled exclusively by Stripe Payments UK
     Ltd, a certified PCI DSS Level 1 payment processor. When you enter your
     card details at checkout, that information is transmitted directly and
     securely to Stripe via encrypted (SSL/TLS) connection and is subject to
     Stripe's own Privacy Policy: https://stripe.com/gb/privacy

     We receive only a transaction confirmation and a non-sensitive payment
     reference from Stripe — never your full card number, CVV, or bank
     account details.

─────────────────────────────────────────────

2.4  Technical and Usage Data

     Our platform (NivoCart) automatically collects certain technical data
     when you visit the Website:

       - IP address (used for session security and fraud/spam prevention,
         and logged against your customer account when you are logged in)
       - Browser type and version (User-Agent string)
       - Device type
       - Pages visited, referring URL, and time on site
       - Session data (shopping cart contents, wishlist, login state)

     The "Who's Online" feature within NivoCart also logs your IP address,
     the URL you are visiting, and your HTTP referrer while you are browsing
     the site. This data is used for internal traffic analysis and site
     security only.

     Lawful basis: Legitimate interests (UK GDPR Article 6(1)(f)) — to keep
     the Website secure, detect fraud, block malicious traffic, and improve
     site performance. We have carried out a balancing test and are satisfied
     that our legitimate interests do not override your fundamental rights and
     freedoms in this context.

─────────────────────────────────────────────

2.5  Search Engine Webmaster Verification Data

     Our Website uses webmaster verification meta tags for the following
     search engine tools:

       - Google Search Console
       - Bing Webmaster Tools

     These meta tags do not collect personal data. They allow the respective
     search engines to verify ownership of our website and provide us with
     anonymised traffic and crawl reports through their respective dashboards.

─────────────────────────────────────────────

2.6  Newsletter and Marketing Emails

     If you subscribe to our newsletter — either during account registration
     or via the newsletter subscription option in your account settings —
     we will use your email address to send you promotional communications,
     offers, and updates about Paws Pet Shop.

     Lawful basis: Consent (UK GDPR Article 6(1)(a)) — you must actively
     opt in. We will not send marketing emails without your explicit
     agreement.

     You can withdraw your consent and unsubscribe at any time by:
       (a) Logging into your account and updating your newsletter preference
           under Account > Newsletter; or
       (b) Clicking the "Unsubscribe" link in any marketing email we send; or
       (c) Contacting us directly at contact@pawspetshop.co.uk.

     Unsubscribing will not affect order confirmation, dispatch, or other
     transactional emails necessary to fulfil your purchase.

─────────────────────────────────────────────

2.7  Contact Enquiries

     If you contact us by email or via any contact form on the Website, we
     will collect your name, email address, and the contents of your message.
     We use this data to respond to your enquiry.

     Lawful basis: Legitimate interests (UK GDPR Article 6(1)(f)).

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

3. COOKIES AND TRACKING TECHNOLOGIES
──────────────────────────────────────────────────────────

We use cookies and similar technologies on this Website in accordance with
the Privacy and Electronic Communications Regulations 2003 (PECR) and the
ICO's updated cookie guidance.

─────────────────────────────────────────────

3.1  What Are Cookies?

     Cookies are small text files placed on your device by your web browser
     when you visit a website. They allow the website to recognise your
     browser and remember certain information.

─────────────────────────────────────────────

3.2  Cookie Consent

     When you first visit the Website, you will see our cookie consent
     banner. We will not set any non-essential cookies (including analytics
     cookies) unless and until you give your consent via this banner.

     You can change your cookie preferences at any time by clicking
     the 'Cookie Settings' option toggle switch in your account.

─────────────────────────────────────────────

3.3  Types of Cookies We Use

     STRICTLY NECESSARY COOKIES (always active — no consent required)
     These cookies are essential for the Website to function and cannot be
     switched off. They do not store any personally identifiable information.

       Name / Type          Purpose
       ─────────────────    ─────────────────────────────────────────────────
       PHPSESSID            PHP session management — maintains your login
                            state, shopping cart, and checkout session.
                            Set by NivoCart's session library. Session
                            cookie (expires when browser closes). HttpOnly
                            and SameSite=Lax flags are applied for security.

       NivoCart session     Stores your cart contents, wishlist, and
       slot cookie          checkout progress securely on the server. Uses
                            a cryptographically-generated 64-character hex
                            ID. HttpOnly, SameSite=Lax, Secure (HTTPS only).

       Customer cookie      Set only when logged-in account security mode is
                            enabled — binds your login session to your
                            browser over HTTPS. HttpOnly, Secure.

       Cookie consent       Records your cookie consent preference so the
       preference           banner is not shown again. Expires after
                            365 days.


     ANALYTICS COOKIES (require your consent)
     These cookies are only set after you accept analytics cookies via our
     consent banner.

       Name / Type          Purpose
       ─────────────────    ─────────────────────────────────────────────────
       Google Analytics     We use Google Analytics (provided by Google
       (_ga, _gid, etc.)    Ireland Ltd / Google LLC) to collect anonymous
                            statistics about how visitors use the Website:
                            pages visited, session duration, traffic sources,
                            and geographic region. IP addresses sent to
                            Google are anonymised before storage. Google may
                            transfer data outside the UK/EEA; Google provides
                            appropriate safeguards via Standard Contractual
                            Clauses. See Google's privacy policy:
                            https://policies.google.com/privacy


     FUNCTIONAL COOKIES (require your consent)

       Name / Type          Purpose
       ─────────────────    ─────────────────────────────────────────────────
       RSS feed currency    Remembers your selected currency for RSS feed
                            display. Session-based.

       Multi-store          If multi-store sharing is enabled, a short-lived
       session sharing      token is used to maintain session continuity
                            across store URLs.

─────────────────────────────────────────────

3.4  Managing Cookies in Your Browser

     Most web browsers allow you to control cookies through their settings.
     You can block or delete cookies entirely, but doing so may prevent
     certain features of the Website from working correctly (for example,
     your shopping cart may not function if session cookies are blocked).

     For guidance on managing cookies, visit: https://www.aboutcookies.org/

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

4. SEARCH ENGINE ROBOTS AND CRAWLERS
──────────────────────────────────────────────────────────

4.1  Our Website includes a robots.txt file that directs all major search
     engine crawlers (including Googlebot, Bingbot, Yandex, and Baidu) not
     to index private areas of the site such as account pages, checkout,
     order history, admin, and system directories. This is a security and
     privacy measure that prevents personal account or transaction data from
     appearing in search engine results.

4.2  Our platform automatically detects and logs search engine robots and
     other automated crawlers visiting the site, recording their IP address
     and user-agent string for internal traffic analysis and security. This
     data is not personal data relating to individual users.

4.3  We publish a dynamic XML sitemap to assist search engines in indexing
     the product and content pages of our Website.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

5. HOW WE SHARE YOUR DATA — THIRD-PARTY DATA PROCESSORS
──────────────────────────────────────────────────────────

We do not sell, rent, or trade your personal data. We share your data only
with trusted third parties who process it on our behalf and under our
instruction (data processors), or who are independent data controllers as
described below.

─────────────────────────────────────────────

5.1  Fulfilment Suppliers (Dropshipping)

     We operate as a dropshipping retailer. When you place an order, we pass
     your name and delivery address to our authorised fulfilment suppliers
     so they can prepare and dispatch your goods directly to you:

       - Avasam Ltd
         Fulfilment platform and supplier network (UK-based)
         Privacy: https://www.avasam.com/privacy-policy/

       - CJDropshipping
         Fulfilment supplier (UK operations only)
         Privacy: [CJDropshipping privacy policy URL]

     These suppliers act as data processors under our instruction. They are
     contractually required to use your data solely for the purpose of
     fulfilling your order and to comply with all applicable data protection
     laws. They will not use your data for their own marketing purposes.

─────────────────────────────────────────────

5.2  Payment Processing — Stripe

     All card payment data is processed by Stripe Payments UK Ltd, an
     independent data controller regulated under the Financial Conduct
     Authority. We pass your order amount and billing name to Stripe for
     payment authorisation. Stripe's privacy policy applies to all payment
     data: https://stripe.com/gb/privacy

─────────────────────────────────────────────

5.3  Analytics Providers

     Where you have consented to analytics cookies:

       - Google Analytics: Google Ireland Ltd (data may be processed by
         Google LLC in the USA under Standard Contractual Clauses).

─────────────────────────────────────────────

5.4  Email / Transactional Mail Service

     We use Hostinger Web Mail to send order confirmation, dispatch notification,
     and newsletter emails. Your email address and name are passed to this
     provider for this purpose only.

─────────────────────────────────────────────

5.5  Search Engine Webmaster Tools

     We share our website domain with Google and Bing for the purposes of
     site verification and receiving anonymised traffic reports.
     These tools do not receive any personal data about individual visitors.

─────────────────────────────────────────────

5.6  Social Media Platforms

     Our Website displays links to our social media profiles on Facebook,
     Instagram, Pinterest, and X (formerly Twitter). These are standard
     hyperlinks only. Clicking them takes you to our profiles on those
     platforms, which are governed by their own privacy policies. We do not
     embed social media tracking pixels or share your data with these
     platforms through the Website itself unless you choose to interact with
     their buttons or widgets.

─────────────────────────────────────────────

5.7  Legal Disclosure

     We may disclose your personal data where required by law, by a court
     order, or by a regulatory authority (including HMRC, the ICO, or law
     enforcement), or where necessary to enforce our Terms and Conditions or
     to protect the rights, property, or safety of Paws Pet Shop, our
     customers, or others.

─────────────────────────────────────────────

5.8  International Transfers

     Some of our third-party service providers (in particular Google Analytics
     and possibly Matomo) may transfer or store your data outside the United
     Kingdom. Where this occurs, we ensure appropriate safeguards are in place
     in accordance with UK GDPR Chapter V, such as the ICO's International
     Data Transfer Agreement (IDTA) or UK-approved Standard Contractual
     Clauses.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

6. HOW LONG WE KEEP YOUR DATA
──────────────────────────────────────────────────────────

We retain personal data only for as long as necessary for the purposes for
which it was collected, or as required by law.

  Data Type                        Retention Period
  ──────────────────────────────   ──────────────────────────────────────────
  Customer account data            For the lifetime of your account, plus
                                   2 years after your last purchase or login,
                                   after which it is deleted or anonymised.

  Order and transaction records    6 years from the end of the tax year in
                                   which the transaction took place (HMRC
                                   legal requirement).

  IP address logs (Who's Online)   90 days from the date of recording.
  and customer IP table            

  Newsletter subscription list     Until you unsubscribe. After unsubscribing,
                                   your email is retained on a suppression
                                   list to prevent accidental re-subscription.

  Cookie consent records           1 year from the date consent was given.

  Contact form enquiries           2 years from the date
                                   of your last communication.

  Analytics data (Google/Matomo)   14 months, for Google Analytics.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

7. HOW WE PROTECT YOUR DATA
──────────────────────────────────────────────────────────

7.1  Encryption. The entire Website operates over HTTPS (SSL/TLS). All data
     transmitted between your browser and our server is encrypted in transit.

7.2  Password security. Customer passwords are never stored in plain text.
     They are stored using a salted SHA-1 hash algorithm within the NivoCart
     platform.

7.3  Session security. User sessions are managed using cryptographically
     secure, randomly generated session IDs (64-character hex strings). Session
     cookies carry the HttpOnly flag (preventing JavaScript access) and the
     SameSite=Lax flag (mitigating cross-site request forgery). Where HTTPS
     is enforced, the Secure flag is also applied.

7.4  IP blocking. Our platform includes IP address blocking functionality to
     prevent access from known malicious sources.

7.5  No card data on site. As stated in Section 2.3, we never handle, store,
     or transmit raw payment card data. All card processing is delegated to
     Stripe's PCI DSS Level 1 certified infrastructure.

7.6  Access controls. Administrative access to the Website backend is
     restricted and protected. Customer account areas are protected behind
     authenticated HTTPS sessions with automatic timeout.

7.7  No system files indexed. Our robots.txt and server configuration
     prevent search engines from indexing system directories, configuration
     files, and account/checkout pages.

7.8  Despite these measures, no data transmission over the internet or data
     storage system can be guaranteed as 100% secure. In the event of a
     personal data breach that is likely to result in a risk to your rights
     and freedoms, we will notify the ICO within 72 hours and will notify
     affected individuals without undue delay where required.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

8. YOUR RIGHTS UNDER UK GDPR
──────────────────────────────────────────────────────────

Under the UK GDPR and the Data Protection Act 2018, you have the following
rights regarding your personal data. We will respond to all valid requests
within one calendar month (and will let you know if we need up to a further
two months for complex requests).

  Right                    What it means
  ─────────────────────    ─────────────────────────────────────────────────
  Right of access          You can request a copy of all personal data we
                           hold about you (a "Subject Access Request").

  Right to rectification   You can ask us to correct inaccurate or
                           incomplete data. (You can also update most
                           details directly via your account settings.)

  Right to erasure         You can request that we delete your personal
  ("Right to be            data where there is no compelling reason for us
   Forgotten")             to keep it. Note: we may need to retain some
                           data for legal reasons (e.g. tax records).
                           NivoCart includes a built-in account deletion
                           feature accessible from your account settings.

  Right to restrict        You can ask us to restrict how we process your
  processing               data in certain circumstances (e.g. if you
                           contest its accuracy).

  Right to data            You can request a machine-readable copy of
  portability              personal data you have provided to us, where
                           processing is based on your consent or a
                           contract and is carried out by automated means.

  Right to object          You can object to processing based on legitimate
                           interests or for direct marketing purposes.
                           Where you object to direct marketing, we will
                           stop immediately.

  Rights related to        You have the right not to be subject to a
  automated decision-      decision made solely by automated processing
  making                   that has a significant legal or similarly
                           significant effect on you. We do not currently
                           carry out such processing.

  Right to withdraw        Where processing is based on consent, you can
  consent                  withdraw your consent at any time. Withdrawal
                           does not affect the lawfulness of processing
                           before the withdrawal.

To exercise any of these rights, please contact us at contact@pawspetshop.co.uk.
We may need to verify your identity before processing your request.

You will not normally be charged for exercising your rights, but we may
charge a reasonable fee if your request is manifestly unfounded or excessive.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

9. THIRD-PARTY WEBSITE LINKS
──────────────────────────────────────────────────────────

9.1  Our Website may contain links to third-party websites, including our
     social media profiles on Facebook, Instagram, Pinterest, and X. These
     websites are not operated by us, and once you click a link to leave our
     site, this Privacy Policy no longer applies.

9.2  We have no control over the content or privacy practices of external
     websites and are not responsible for them. We encourage you to read the
     privacy policy of any third-party website you visit.

9.3  Where third-party services (such as Google Analytics) operate
     on this Website, we have disclosed them in Section 5 above and their
     data processing is subject to their own privacy policies.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

10. CHILDREN'S PRIVACY
──────────────────────────────────────────────────────────

10.1 Our Website is not intended for children under the age of 13, and we
     do not knowingly collect personal data from children under 13. If you
     believe that a child under 13 has provided us with personal data, please
     contact us immediately and we will take steps to delete it.

10.2 If our Website collects date of birth information during registration,
     this is used only to verify that the user meets the minimum age
     requirement and is not used for any other profiling purpose.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

11. CHANGES TO THIS PRIVACY POLICY
──────────────────────────────────────────────────────────

11.1 We may update this Privacy Policy from time to time to reflect changes
     in the law, our business model, or the services we use. The current
     version will always be available on this page with the "Last updated"
     date at the top.

11.2 Where we make significant changes, we will notify you by email (if you
     have an account) and/or by a prominent notice on the Website before the
     changes take effect.

11.3 We encourage you to review this policy periodically.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

12. HOW TO CONTACT US AND THE ICO
──────────────────────────────────────────────────────────

12.1 If you have any questions, concerns, or complaints about how we handle
     your personal data, please contact us at:

       Email:   contact@pawspetshop.co.uk
       Address: Appletree Cottage, Keynor Lane, Sidlesham, Chichester, PO20 7NL, United Kingdom

12.2 We are committed to resolving any concerns promptly. If you are not
     satisfied with our response, or if you believe we are processing your
     data unlawfully, you have the right to lodge a complaint with the
     Information Commissioner's Office (ICO):

       Information Commissioner's Office
       Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
       Telephone: 0303 123 1113
       Website:   https://ico.org.uk/make-a-complaint/


━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
© 2026 Paws Pet Shop — www.pawspetshop.co.uk
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━