Privacy Policy

1. Data Controller Information

For the purposes of the UK General Data Protection Regulation (UK GDPR), the data controller responsible for your personal information is MB-Paws.

If you have any questions regarding this Privacy Policy, your statutory data subject rights, or how your personal data is handled, please contact our Data Privacy Lead:

2. Personal Data We Collect

We only collect data strictly necessary to fulfill your orders, provide customer support, and operate a secure, functioning e-commerce platform:

• Identity & Contact Information: Full name, email address, telephone number, billing address, and UK delivery address.
• Order & Transaction Records: Details of products purchased, quantities, sizes, colour choices, discounts applied, order timestamps, and delivery notes.
• Communication Records: Records of customer care correspondence, inquiries submitted via our contact forms, and support emails.
• Technical & Usage Information: IP address, browser type, operating system, device identifiers, referral URLs, and pages accessed, collected via essential cookies and aggregated analytics.

3. Lawful Bases for Processing

Under UK GDPR Article 6, we process your personal information strictly in reliance upon the following legal bases:

4. Sharing of Data with Third Parties & Fulfilment Partners

We do not sell, rent, or lease your personal information under any circumstances. In order to operate our dropshipping and direct-fulfilment supply chain, your data is shared only with verified third-party service providers bound by strict contractual data processing agreements:

• Fulfilment & Manufacturing Hubs: Names, delivery addresses, telephone numbers, and order items are securely transmitted to verified manufacturing and dispatch hubs strictly to pack and label your package.
• Postal Carriers & Couriers: Delivery data is shared with postal and courier services (including Royal Mail, DPD, Evri, or tracked courier partners) solely to execute delivery to your door.
• Cloud Infrastructure & Database Hosting: Encrypted databases hosted securely on Supabase (AWS eu-west-2 London region) and Vercel hosting infrastructure.
• Transactional Email Service: Resend for automated transactional order confirmations, dispatch notices, and tracking links.
• Legal & Regulatory Authorities: We may disclose data where strictly compelled by UK court orders, law enforcement bodies, or legal processes to protect against fraud or defend our legal rights.

5. International Data Transfers

Because our supply chain utilizes direct manufacturing and global dispatch networks, certain order fulfillment data may be transferred to and processed by partners located outside the United Kingdom or European Economic Area (EEA).

In all such circumstances, we enforce legally binding safeguards recognised under UK law—including the UK International Data Transfer Agreement (IDTA) or European Commission Standard Contractual Clauses with the UK Addendum—ensuring your personal data receives a level of protection essentially equivalent to that guaranteed within the United Kingdom.

6. Data Retention Periods

We retain personal data strictly for as long as necessary to satisfy the specific purposes for which it was gathered:

• Order & Invoicing Records: Kept for 6 years following the end of the relevant financial year in compliance with UK tax law and statutory HMRC audit guidelines.
• Customer Support Inquiries: Retained for up to 2 years after resolution to handle any follow-up warranty claims or return queries.
• Marketing Consent Records: Retained until such time as you withdraw consent or request erasure.

Upon expiration of statutory retention windows, records are irreversibly anonymised or securely deleted.

7. Your Legal Rights Under UK GDPR

As a resident of the United Kingdom, you possess clear statutory rights under Chapter III of the UK GDPR:

• Right of Access (Subject Access Request): You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request the immediate correction of inaccurate or incomplete records.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your data where statutory retention obligations do not apply.
• Right to Restriction of Processing: You may request the suspension of data processing under certain contested circumstances.
• Right to Data Portability: You may receive your data in a structured, commonly used, machine-readable format.
• Right to Object: You may object at any time to processing based on legitimate interests or direct marketing.

To exercise any of these rights, contact us at support@mb-paws.co.uk. We respond to verified requests within one calendar month without fee, subject to statutory identity verification.

You also have the right to lodge a complaint with the UK data protection supervisory authority: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF (ico.org.uk).

8. Cookies & Tracking Technologies

Our website uses small text files called cookies to facilitate basic site navigation, remember your cart items across sessions, and collect anonymous aggregate traffic metrics. You may configure your browser to decline non-essential cookies at any time, though some interactive checkout capabilities may be affected.

9. Amendments to this Policy

We reserve the right to amend this Privacy Policy periodically to reflect changes in our operational procedures or UK statutory regulations. Any revisions will be published on this page with an updated effective date. Continued usage of our website following any modification indicates your acknowledgment of the updated terms.