Privacy Policy

Draft — needs lawyer review before publishing. Written to align with EU GDPR, UK GDPR, and (briefly) US/California privacy expectations, given the store targets the UK and US alongside the EU. NIF pending autónomo registration.

Last updated: [DATE]

1. Data controller

Owner: Khalid Eddib, trading as Pawsitive Calm
Address: Carrer de la Ferreria, 19, Sants-Montjuïc, 08014 Barcelona, Spain
Contact: legal@pawsitivecalm.com

2. What data we collect

When you browse, create an account, or place an order, we may collect: name, email address, shipping and billing address, phone number, order history, and payment confirmation (payment card details are processed directly by our payment provider — we do not store full card numbers). We also collect technical data automatically via cookies: IP address, browser type, pages visited, and device information.

3. Why we collect it (legal basis)

To process and fulfill your orders (contractual necessity)
To respond to customer service requests sent to support@pawsitivecalm.com
To send order confirmations and shipping updates
To send marketing communications, only if you opt in (consent, withdrawable anytime)
To comply with tax and accounting obligations (legal obligation)
To analyze site usage and improve the store, via cookies (consent, except strictly necessary cookies)

4. Who we share it with

Shopify — hosts the store and processes orders on our behalf as a data processor.
Payment processor — processes payments securely; we do not see or store full card details.
Suppliers/fulfillment partners — receive the shipping name and address needed to fulfill and deliver your order directly, including partners located outside the EU/UK (see Section 6).

We do not sell your personal data to third parties.

5. Cookies

This site uses cookies for essential site function, analytics, and (if enabled) advertising. You can manage cookie preferences via the consent banner shown on your first visit, or through your browser settings.

6. International data transfers

Some of our suppliers and fulfillment partners are located outside the European Economic Area and the UK (including China), as your order's shipping details are shared directly with the supplier fulfilling it. Where this occurs, we rely on appropriate safeguards permitted under GDPR/UK GDPR (such as standard contractual clauses), or the transfer is limited to what is strictly necessary to deliver your order.

7. How long we keep your data

We retain order and invoicing data for the period required by Spanish tax law (generally 5 years). Account and marketing data is retained until you request deletion or withdraw consent, whichever is sooner.

8. Your rights

EU/Spain: under GDPR, you have the right to access, rectify, erase, restrict, or object to the processing of your data, and the right to data portability. Contact legal@pawsitivecalm.com to exercise these rights, or lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

UK: you have equivalent rights under UK GDPR and the Data Protection Act 2018, and may complain to the UK Information Commissioner's Office (ICO, ico.org.uk).

US/California: California residents may have rights under the CCPA/CPRA, including the right to know what data is collected and to request deletion. We do not sell personal data. Contact legal@pawsitivecalm.com for any request.