Privacy policy
This Privacy Policy explains how personal information may be collected, used, disclosed, retained and protected when customers visit or make purchases through comfrtax.shop.
For privacy enquiries or data-protection complaints, contact:
Email: info@comfrtax.shop
The UK GDPR requires organisations to provide information including their purposes for processing personal data, lawful bases, recipients, retention arrangements and applicable individual rights.
1. Scope
This Privacy Policy applies to personal information processed in connection with:
- Visiting comfrtax.shop;
- Creating or using customer functionality;
- Purchasing products;
- Contacting customer support;
- Making returns or refund requests;
- Receiving transactional communications;
- Participating in promotions where offered;
- Subscribing to marketing where applicable;
- Interacting with cookies and similar technologies; and
- Otherwise communicating with our store.
2. Personal Information We May Collect
Depending on how a customer interacts with the store, information may include:
Identity and Contact Information
This may include:
- Name;
- Email address;
- Telephone number;
- Billing address;
- Delivery address; and
- Other information voluntarily provided in communications.
Order and Transaction Information
This may include:
- Products purchased;
- Product variations;
- Order value;
- Order number;
- Payment status;
- Delivery information;
- Returns;
- Refunds;
- Customer-service correspondence; and
- Transaction history.
Payment Information
Payments may be processed by Shopify or other payment-service providers.
We may receive transaction-related information such as payment status, payment method type or limited payment identifiers.
Full card information may be collected and processed directly by the relevant payment provider rather than stored directly by us.
Device and Technical Information
Depending on website configuration, information may include:
- IP address;
- Browser type;
- Device type;
- Operating system;
- Referring page;
- Pages visited;
- Approximate location derived from technical information;
- Cookie identifiers; and
- Website-interaction data.
Communications
If a customer contacts us, we may process the contents of the communication together with information necessary to investigate and respond.
3. How We Collect Personal Information
We may collect information:
- Directly from customers;
- Through the Shopify ecommerce platform;
- Through cookies or similar technologies;
- Through payment processors;
- Through delivery and fulfilment providers;
- Through fraud-prevention providers;
- Through analytics services; and
- From other service providers involved in operating the store.
4. Purposes of Processing
Personal information may be processed for purposes including:
- Processing orders;
- Taking and administering payments;
- Delivering products;
- Providing order confirmations and updates;
- Processing cancellations;
- Handling returns and refunds;
- Providing customer support;
- Preventing fraud and misuse;
- Maintaining website security;
- Managing customer accounts;
- Maintaining transaction records;
- Complying with legal obligations;
- Establishing, exercising or defending legal claims;
- Improving store functionality;
- Analysing website performance;
- Managing cookies and consent;
- Sending marketing communications where legally permitted; and
- Protecting customers, our services and third parties.
5. Lawful Bases
Depending on the purpose and circumstances, processing may rely on one or more lawful bases recognised under applicable UK data-protection law.
These may include:
Contract
We may process personal information where necessary to enter into or perform a contract with the customer, including:
- Processing an order;
- Taking payment;
- Arranging delivery;
- Processing returns; and
- Providing order-related support.
Legal Obligation
We may process information where necessary to comply with legal obligations, including accounting, taxation, consumer-protection, regulatory or law-enforcement requirements.
Legitimate Interests
Where appropriate, we may process information for legitimate interests such as:
- Preventing fraud;
- Protecting website security;
- Improving services;
- Maintaining business records;
- Handling disputes; and
- Understanding the operation of our online store.
Where legitimate interests are relied upon, the relevant interests must be considered against the rights and interests of affected individuals. The ICO confirms that legitimate interests may be appropriate where use of personal information is reasonably expected and has a proportionate privacy impact.
Consent
Consent may be relied upon for certain activities where legally required, including some marketing and non-essential cookie activities.
Consent may be withdrawn at any time without affecting processing already lawfully conducted before withdrawal.
6. Shopify and Service Providers
Our store operates using Shopify ecommerce technology.
Personal information may therefore be processed through Shopify systems to provide ecommerce functionality.
We may also disclose necessary information to categories of service providers including:
- Payment processors;
- Shipping carriers;
- Fulfilment partners;
- Hosting and infrastructure providers;
- Fraud-prevention providers;
- Customer-service providers;
- Analytics providers;
- Marketing providers where lawfully used;
- Professional advisers; and
- IT and security providers.
We seek to disclose information only to the extent reasonably necessary for the relevant function.
7. Legal Disclosures
Information may be disclosed where reasonably necessary to:
- Comply with applicable law;
- Respond to a lawful court order;
- Respond to lawful regulatory requirements;
- Protect legal rights;
- Detect or prevent fraud;
- Enforce contractual rights; or
- Protect customers and others from unlawful activity.
8. Business Transactions
If all or part of the business operating comfrtax.shop is reorganised, acquired, transferred or sold, personal information may be disclosed to appropriate parties involved in the transaction where permitted by applicable law.
Any successor handling personal information will remain subject to applicable data-protection requirements.
9. International Transfers
Shopify and other service providers may operate internationally.
As a result, personal information may in some circumstances be processed outside the United Kingdom.
Where UK data-protection law requires safeguards for international transfers, appropriate lawful transfer mechanisms should be used.
These may include applicable adequacy regulations, recognised contractual safeguards or other legally permitted mechanisms.
10. Data Retention
Personal information will not intentionally be retained for longer than reasonably necessary for the relevant purposes.
Retention periods may depend on:
- The nature of the information;
- Whether an account remains active;
- The duration of the customer relationship;
- Accounting and tax obligations;
- Consumer-law requirements;
- Fraud-prevention needs;
- Applicable limitation periods;
- Dispute-resolution requirements; and
- Other legal obligations.
The ICO requires privacy information to explain either relevant retention periods or the criteria used to determine them.
11. Cookies and Similar Technologies
comfrtax.shop may use cookies and similar storage or access technologies.
These technologies may be used for:
- Essential website functionality;
- Maintaining shopping carts;
- Authentication;
- Security;
- Remembering preferences;
- Analytics;
- Performance measurement; and
- Advertising or marketing where enabled.
Where applicable law requires consent for non-essential cookies or similar technologies, such technologies should not be used until appropriate consent has been obtained.
The ICO states that valid cookie consent must be freely given, specific, informed and demonstrated through an unambiguous positive action; merely referring to cookies within a privacy policy is not sufficient consent.
Customers may also control certain cookies through their browser or available consent-management settings.
12. Marketing Communications
Where marketing emails or similar electronic communications are sent, we will seek to comply with applicable UK data-protection and electronic-marketing requirements.
The ICO states that unsolicited electronic marketing to individual subscribers normally requires consent unless the requirements of an applicable soft opt-in are satisfied.
Customers may unsubscribe using an available unsubscribe mechanism or by contacting:
Marketing opt-out requests will not prevent necessary transactional messages concerning existing orders, returns, security matters or customer-service enquiries.
13. Security
We use reasonable organisational and technical measures designed to reduce risks such as unauthorised access, loss, misuse, alteration or disclosure.
However, no online service or electronic storage system can guarantee absolute security.
Customers are responsible for taking reasonable steps to protect their own devices, passwords and account information.
14. Your UK Data-Protection Rights
Depending on the circumstances and applicable exemptions, individuals may have rights including:
- The right to be informed;
- The right of access;
- The right to rectification;
- The right to erasure;
- The right to restriction;
- The right to data portability;
- The right to object; and
- Rights relating to certain automated decision-making.
The exact rights available may depend on the lawful basis and circumstances of processing.
Right to Object
Where applicable, you may have the right to object to processing based on legitimate interests. You also have an absolute right to object to the use of your personal information for direct marketing.
Requests may be sent to:
We may request reasonable information to verify identity before responding to certain requests.
15. Data-Protection Complaints
Customers may submit a data-protection complaint directly to us at:
Current UK data-protection requirements require organisations to provide a clear method for submitting data-protection complaints and to acknowledge such complaints within 30 days, investigate appropriately, keep individuals appropriately informed and communicate the outcome without undue delay.
Individuals may also have the right to complain to the Information Commissioner's Office (ICO).
16. Children
comfrtax.shop is intended as a general online retail service and is not intentionally designed to collect unnecessary personal data from children.
If information concerning a child is identified as having been collected in circumstances where it should not be retained, appropriate steps may be taken to review or remove it.
17. Changes to This Privacy Policy
This Privacy Policy may be updated to reflect changes in our services, technology, operational practices or legal obligations.
The current version will be published on comfrtax.shop together with its updated date.
18. Contact
For privacy questions, rights requests or complaints:
Website: comfrtax.shop
Email: info@comfrtax.shop
- Choosing a selection results in a full page refresh.