We collect personal information to provide you with the best experience at Little Brodie Shop. "Personal Information" means any information that identifies you or can be linked to you. We do not collect information that is anonymous or de-identified. Depending on how you interact with our Services, we collect:

• Contact Details: Your name, billing and shipping addresses, phone number, and email address. We use this to fulfill your orders and communicate with you.
• Payment Information: When you make a purchase, your payment details are processed securely by Shopify Payments or our third-party payment providers. Little Brodie Shop does not store or have access to your full credit card numbers or security codes; we only receive the last 4 digits and payment confirmation to process your order.
• Account Details: If you create an account, we store your username, password, security questions, and shopping preferences.
• Transaction History: Details of the items you view, add to your wishlist, or purchase, including any returns or cancellations.
• Customer Communications: Any information you provide when contacting our support team (e.g., questions about our Marvel or Wicked collections).
• Technical & Usage Data: Automatically collected information about your device, IP address, browser type, and how you navigate our site. This helps us improve our store and prevent fraud.

We receive and collect your personal information through three primary channels:

• Directly from You: This is the information you provide when you interact with us—for example, when you create an account, purchase an Owala bottle, sign up for our newsletter for drop alerts, or email our support team.
• Automatically via Technology: When you visit our website, we (and our service providers) automatically collect certain technical data from your device using cookies, pixels, and similar tracking technologies. This includes your IP address and how you navigate our store. You can manage these preferences via our cookie banner.
• From Trusted Third Parties & Partners: We may receive information from service providers who help us run our store (like Shopify), payment processors who confirm your transaction, and shipping partners who provide tracking updates. We may also receive data from advertising partners (like Meta or Google) to help us measure the effectiveness of our marketing.

We use your personal information for specific, lawful purposes to run Little Brodie Shop and serve you. Our legal grounds for processing your data include:

• Fulfilling Our Contract with You: We use your contact and payment details to process your orders, arrange shipping from Denny, and manage returns or exchanges. We cannot provide the Services without this information.
• Our Legitimate Interests: We process your information to improve our store, prevent fraud, and secure your account. This includes analysing how you use our site to ensure our Owala drops run smoothly and to protect our business from malicious activity.
• Your Consent: Where you have given us clear permission (such as opting into our email list or accepting marketing cookies), we use your data to send you promotional communications and show you personalised ads. You can withdraw this consent at any time.
• Legal Obligations: We may process your data to comply with UK tax laws (e.g., keeping records for HMRC) or to respond to valid legal requests.

Specific Purposes Include:

• Order Fulfillment: Processing payments, shipping your items, and sending order updates.
• Customer Support: Responding to your inquiries and maintaining our relationship.
• Marketing & Advertising: Showing you products you might like based on your browsing history and sending marketing emails (if you’ve opted in).
• Security & Fraud Prevention: Verifying your identity and monitoring for suspicious transactions to keep your shopping experience safe.

We do not sell your personal information. To provide our Services and fulfill our legal obligations, we share your data with trusted third-party service providers who act as "Data Processors" on our behalf. These include:

• Shopify: Our primary platform provider, which processes your information to facilitate the operation of our store.
• Payment Processors: Such as Shopify Payments or PayPal, to securely process your transactions.
• Shipping & Fulfillment Partners: We share your name and address with carriers (e.g., Royal Mail, Evri, or DPD) to deliver your orders from Denny to your door.
• Marketing & Advertising Partners: We share limited data (like email or browsing activity) with platforms like Google and Meta to show you relevant advertisements, but only where you have provided explicit consent via our cookie banner.
• Professional Advisors: When necessary, we may share information with our auditors, lawyers, or tax advisors to comply with UK legal and financial reporting requirements (such as HMRC).
• Legal & Safety Requirements: We may disclose information if required by law, such as responding to a valid court order, or to protect the rights, property, and safety of Little Brodie Shop, our customers, or the public.

Our store is hosted on the Shopify platform. In this relationship:

• Little Brodie Shop acts as the Data Controller. We decide how your information is used to fulfill your orders and manage our relationship with you.
• Shopify acts as our Data Processor. They provide the infrastructure that allows us to process your payments, manage our inventory, and host our website securely.

Shopify collects and processes your personal information on our behalf to provide and improve the Services. Because Shopify is a global company, your data may be transmitted to and stored in countries outside of the United Kingdom, including the United States and Canada. To ensure your data remains protected, Shopify relies on recognized Standard Contractual Clauses (SCCs) and equivalent transfer mechanisms approved by the UK government.

To learn more about how Shopify handles your data, you can visit the Shopify Consumer Privacy Policy. If you wish to exercise your data rights specifically regarding information processed by Shopify, you can use the Shopify Privacy Portal.

Our Services may contain links to other websites, plug-ins, or online platforms (such as our social media pages on Instagram or Facebook) that are not operated or controlled by Little Brodie Shop.

• No Control Over Content: We provide these links for your convenience and information only. We do not endorse or assume responsibility for the content, privacy policies, or security practices of any third-party sites.
• Your Responsibility: Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We strongly recommend that you read the privacy policy of every website you visit after leaving ours.
• External Transactions: If you interact with a third-party site (for example, via a social media "Login" or an external review platform), your information is governed by their terms, not ours.

To improve your shopping experience and measure the success of our collections, we use the following digital tools. These tools are only activated if you provide explicit consent via our cookie banner:

• Google Analytics (GA4): We use this to understand how visitors navigate Little Brodie Shop (e.g., which pages are most popular). We have enabled "IP Anonymization" to ensure your full IP address is never stored.
• Meta (Facebook) Pixel: This helps us measure the effectiveness of our social media ads and show you relevant products based on your interests.
• Google Consent Mode v2: In compliance with Google’s latest requirements for UK merchants, our site sends "consent signals" to Google. If you decline cookies, these tools will operate in a restricted, non-identifying mode to respect your privacy while still allowing us to track basic site performance.

How to Control Your Data:

• Google’s Data Usage: Review Google’s Privacy & Terms.
• Meta’s Data Usage: Review the Meta Privacy Policy.
• Opt-Out of Analytics: You can use the Google Analytics Opt-Out Browser Add-on.
• Adjust Ad Preferences: Visit Facebook Ad Preferences or Google's My Ad Center.

Little Brodie Shop provides a curated shopping experience intended for use by adults. Our Services are not directed at children under the age of 13.

• Age of Consent: In accordance with the UK-GDPR and the ICO Children’s Code, we do not knowingly collect personal information from children under the age of 13. If you are under 13, please do not provide any personal information on this website or make any purchases.
• Parental Role: We encourage parents and guardians to monitor their children's internet usage. If you believe a child under 13 has provided us with personal data (for example, by signing up for our subscriber list without permission), please contact us at support@littlebrodie.com.
• Data Deletion: Upon notification, we will take immediate steps to delete such information from our servers our Shopify database.
• Scottish Law Context: We recognize the rights of young people in Scotland to exercise their data protection rights where they have the capacity to do so. We will assess any such requests on a case-by-case basis in line with the Data Protection Act 2018.

We take the security of your data seriously and implement appropriate technical and organizational measures to protect it.

• Data Security: Your personal information is stored securely via Shopify’s PCI-compliant infrastructure. While no method of transmission over the internet is 100% secure, we follow all industry-standard requirements to safeguard your data.
• Data Retention: We do not keep your personal information for longer than is necessary for the purposes for which it was collected.
  • Order Records: To comply with UK tax law (HMRC), we retain records of your purchases and financial transactions for 6 years from the end of the financial year they relate to.
  • Account Information: We retain your account data for as long as you maintain an active account with us. If you request account deletion, we will remove your personal data within 30 days, unless we are legally required to keep specific parts of it.
  • Marketing Data: If you sign up for subscriber list  we keep your email until you choose to "Unsubscribe."
• Secure Disposal: Once the retention period expires, your data is either permanently deleted from our systems or anonymised so that it can no longer be linked to you.

Under the UK General Data Protection Regulation (UK GDPR), you have specific rights regarding your personal information. As a customer of Little Brodie Shop, you can exercise the following:

• Right to be Informed: You have the right to be told exactly how we use your data (which is the purpose of this policy).
• Right of Access: You can request a copy of the personal data we hold about you (often called a "Subject Access Request").
• Right to Rectification: You can ask us to correct or update any inaccurate or incomplete information.
• Right to Erasure (The "Right to be Forgotten"): You can request that we delete your data, provided we don't have a legal or tax obligation (such as HMRC records) to keep it.
• Right to Restrict Processing: You can ask us to "pause" the use of your data (for example, if you are contesting its accuracy).
• Right to Data Portability: You can request that we provide your data in a structured, machine-readable format.
• Right to Object: You have an absolute right to object to your data being used for direct marketing. You can also object to processing based on our "legitimate interests."
• Rights Related to Automated Decision-Making: You have the right to ensure that significant decisions (like credit checks) are not made solely by automated systems without human review.

How to Exercise Your Rights

To make a request, please email us at support@littlebrodie.com. We will respond to all legitimate requests within one calendar month. We may need to verify your identity before processing your request to ensure your data remains secure.

If you have any concerns or complaints about how we handle your personal information, please contact us directly at support@littlebrodie.com. We aim to acknowledge all data-related complaints within 48 hours and provide a formal response within one month.

If you are not satisfied with our response, or if you believe we are processing your personal data in a way that does not comply with the law, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection regulator.

• ICO Website: https://www.ico.org.uk/make-a-complaint
• ICO Helpline: 0303 123 1113
  

For customers residing in the European Economic Area (EEA), you may also contact your local Data Protection Supervisory Authority.

Little Brodie Shop is based in the United Kingdom, but we use global service providers (like Shopify, Google, and Meta) to operate our store. This means your personal information may be transferred to, stored, and processed in countries outside of the UK, including the United States and Canada.

To ensure your data receives the same level of protection as it does in the UK, we rely on the following recognised legal safeguards:

• Adequacy Regulations: We transfer data to countries that the UK Government has officially deemed to have "adequate" data protection laws (such as Canada and the EEA).
• UK International Data Transfer Agreement (IDTA): For transfers to countries without an adequacy decision, we use the ICO-approved IDTA or the UK Addendum to the Standard Contractual Clauses.
• UK-US Data Bridge: When transferring data to certified organisations in the United States, we rely on the UK Extension to the Data Privacy Framework, which ensures US companies handle your data according to UK standards.
• Transfer Risk Assessments (TRAs): We regularly review our third-party partners to ensure they maintain high security standards, regardless of their location.

If you have any questions about our privacy practices, this Privacy Policy, or if you would like to exercise any of your data protection rights, please contact our Data Privacy Lead.

• Business Name: Little Brodie Shop
• Email: support@littlebrodie.com
• Telephone: 01324 357561
• Postal Address: 18 Toptowie Drive, Denny, FK6 5FB, United Kingdom.

For the purposes of the UK GDPR and the Data Protection Act 2018, Little Brodie Shop is the Data Controller of your personal information. We are committed to acknowledging all data-related inquiries within 72 hours and providing a full response within one calendar month.