Privacy Policy

MyPetiverse is a UK-based handmade pet gift box business. We are the data controller for the personal information you provide to us.

If you have any questions about this policy or how we handle your data, please contact us at [email protected].

We collect information you give us directly, including your name, email address, delivery address, and payment details when you place an order or create an account.

We also collect information about how you use our website, such as pages visited, time spent on site, and your IP address, through cookies and similar technologies.

If you contact us via our contact form or email, we retain the content of that communication and your contact details.

To process and fulfil your orders, including sending order confirmations and shipping updates.

To manage your account and provide customer support.

To send you marketing emails if you have opted in — you can unsubscribe at any time using the link in any email.

To improve our website and services through anonymised analytics.

To comply with our legal obligations, including fraud prevention and tax record-keeping.

Under UK GDPR Article 6, we only process your personal data where we have a lawful basis to do so. The bases we rely on are set out below.

Contract (Article 6(1)(b)): We process your name, email address, delivery address, and order details because it is necessary to perform the contract we have with you — namely, to process your order, arrange delivery, and manage your account.

Legitimate interests (Article 6(1)(f)): We process certain data to pursue our legitimate business interests, including improving our services, preventing fraud, and communicating with you about your orders. We have assessed that these interests are not overridden by your rights and freedoms.

Consent (Article 6(1)(a)): We rely on your consent to send marketing emails and to place non-essential analytics cookies on your device. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Legal obligation (Article 6(1)(c)): We retain financial and transaction records as required by HMRC under UK tax law, and we may disclose data where required by law or a court order.

We use essential cookies to keep your shopping cart working and to keep you logged in. We also use analytics cookies (with your consent) to understand how visitors use our site.

You can manage your cookie preferences at any time using the cookie settings banner on our site.

We do not sell your personal data. We share it only with trusted third parties who help us run our business, including our payment processor (Stripe), our shipping carriers, and our website platform (GoDaddy).

All third parties are required to handle your data securely and only for the purposes we specify.

Some of our third-party service providers are based outside the UK or European Economic Area (EEA). Where we transfer your personal data internationally, we ensure appropriate safeguards are in place in accordance with UK GDPR Chapter V.

Transfers to countries that benefit from a UK adequacy decision are permitted without additional safeguards. For transfers to other countries — for example, to Stripe's infrastructure in the United States — we rely on Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office, or equivalent transfer mechanisms.

You may request a copy of the relevant transfer safeguards by contacting us at [email protected].

We keep order and financial records for 7 years to comply with HMRC requirements. Account data is retained for as long as your account is active, and for up to 2 years after your last interaction with us.

Marketing consent records are retained for the duration of your subscription plus 1 year. Contact form enquiries are retained for up to 2 years. Analytics data is retained in anonymised form only.

You can request deletion of your account and personal data at any time by contacting us. Where we are required by law to retain certain records, we will inform you of the applicable retention period.

You have the following rights in relation to your personal data. To exercise any of them, please email [email protected]. We will respond within one calendar month as required by UK GDPR Article 12.

Right of access (Article 15): You have the right to request a copy of the personal data we hold about you and information about how we process it.

Right to rectification (Article 16): You have the right to ask us to correct any inaccurate or incomplete personal data we hold about you without undue delay.

Right to erasure (Article 17): You have the right to request that we delete your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent, or where we have no other lawful basis to retain it. This right is subject to certain legal exceptions.

Right to restriction of processing (Article 18): You have the right to ask us to restrict how we process your data in certain circumstances — for example, while we verify the accuracy of data you have contested.

Right to data portability (Article 20): Where we process your data on the basis of consent or contract, and by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit it to another controller.

Right to object (Article 21): You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will stop processing your data for that purpose immediately.

Rights related to automated decision-making (Article 22): We do not make solely automated decisions that produce legal or similarly significant effects about you.

There is no charge for exercising your rights. If your request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act, and we will explain why.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113 if you believe we have not handled your data correctly.

As a small business, MyPetiverse is not required to appoint a formal Data Protection Officer (DPO) under UK GDPR Article 37. However, all data protection queries and rights requests are handled directly by the business owner.

You can contact us about any data protection matter by email at [email protected]. We aim to acknowledge all requests within 72 hours and respond in full within one calendar month.

If you are not satisfied with our response, you have the right to escalate your complaint to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Website: ico.org.uk.

We may update this policy from time to time. When we do, we will update the date at the top of this page. We encourage you to review it periodically.