Policy

Privacy Policy

Last updated

Before this page goes live

2 details on this page are still placeholders. They are marked in amber below. Replace each one with the real figure, then bring the last-updated date above into line. This page should not be published until they are gone.

  • [COMPANY NUMBER TO BE CONFIRMED]
  • [VAT NUMBER TO BE CONFIRMED]

In short

This policy explains what personal data Faiza's Boutique collects when you shop with us, why we need it, how long we keep it, who we share it with, and the rights you have over it. In short: we collect what we need to sell you something and get it to you, we never sell your data, and you can ask us for a copy or ask us to delete it at any time.

Who we are

Owner action required

This section still contains 2 details only you can supply. Replace them before this page goes live.

  • [COMPANY NUMBER TO BE CONFIRMED]
  • [VAT NUMBER TO BE CONFIRMED]

Faiza's Boutique is an Asian designer-wear boutique trading from Nimra Halal Foods, 89/90 Parnell Street, Dublin 1, D01 K302, Ireland. We sell to customers in Ireland, the United Kingdom and the rest of the European Union.

For the purposes of the General Data Protection Regulation (GDPR), we are the data controller. That means we decide why and how your personal data is used, and we are responsible for looking after it.

You can reach us about anything in this policy by email at Faizaboutique110@gmail.com, by phone or WhatsApp on 089 950 8906 (from outside Ireland, +353 89 950 8906), or by post at the address above.

Note

Owner action required before launch: our company registration number and VAT number are not yet confirmed and must be added here and to the Terms and Conditions. Insert them where you see [COMPANY NUMBER TO BE CONFIRMED] and [VAT NUMBER TO BE CONFIRMED]. Do not publish this page until those two placeholders have been replaced.

What we collect, and why

We only collect personal data that we actually need. Here is the full picture.

Order and delivery details. When you place an order we collect your name, email address, phone number, delivery address, the items you ordered, and any note you add for us or for the courier. We need this to pick, pack, send and invoice your order, and to contact you if there is a problem with it.

Payment information. Payments are processed by Stripe. You enter your card details on Stripe's secure payment page. We receive confirmation that the payment succeeded, the amount, the last four digits of the card and the card brand so we can match the payment to your order and handle refunds. We never see or store your full card number, your card security code, or your Apple Pay or Google Pay credentials.

Enquiries, appointments and alterations. If you contact us about a bridal consultation, a made-to-measure outfit, henna or mehndi artistry, or an alteration, we keep your name, contact details and notes about what you asked for. For made-to-measure and alteration work we also keep the measurements and fitting notes needed to do the work and to get it right if you come back to us.

Newsletter and marketing. If you sign up for our newsletter we keep your email address, the date you signed up, the exact wording you agreed to, and the date you confirmed your subscription. We use a double opt-in: you are only added after you click the confirmation link we email you.

Website and security information. Our servers keep standard technical logs, which include your IP address, browser type and the pages you requested. We use these to keep the site running, to prevent fraud and abuse, and to investigate problems.

Analytics. Our site is built so that analytics cookies are switched off until you agree to them. If you agree, we collect aggregated information about how the site is used, such as which pages are popular. See our Cookie Policy for the detail.

Note

We do not ask for information about your religion, health, ethnicity or political opinions, and we do not want it. If you choose to tell us something of that kind — for example when arranging henna for a religious celebration — we will only use it to provide the service you asked for, and we will ask for your explicit consent before we write it down anywhere.

Our lawful basis for using your data

The GDPR requires us to have a lawful basis for everything we do with your personal data. The six lawful bases are set out in Article 6 of the GDPR. These are the ones we rely on, and what each one covers.

  • Performance of a contract (Article 6(1)(b)) — taking your order, taking payment, arranging delivery, handling returns and refunds, and carrying out alteration or made-to-measure work you have asked for. Without this data we cannot complete your order.
  • Legal obligation (Article 6(1)(c)) — keeping sales, VAT and accounting records for the period Irish tax law requires, and responding to lawful requests from Revenue or An Garda Siochana.
  • Legitimate interests (Article 6(1)(f)) — keeping the website secure, preventing fraudulent orders, protecting our staff and stock, recovering debts, and defending legal claims. We have weighed our interests against your rights and we only rely on this basis where your rights do not override ours.
  • Consent (Article 6(1)(a)) — sending you marketing emails, and setting analytics cookies. You can withdraw consent at any time and it will not affect anything we did before you withdrew it.
  • Vital interests (Article 6(1)(d)) — in the highly unlikely event that we need to protect somebody's life, for example by passing your address to emergency services.

How long we keep it

We keep personal data only for as long as we need it. These are our standard retention periods.

  • Orders, invoices and VAT records: six years. Irish tax rules require us to keep sales and VAT records for six years, and we may need them to deal with a tax query or a legal claim.
  • Delivery details held by our couriers: normally deleted or anonymised within 90 days of delivery, unless a claim or investigation is open.
  • Made-to-measure measurements, fitting notes and alteration records: kept while you are an active customer so that repeat work fits properly, and deleted on request once your order is complete and any return window has closed.
  • Enquiries that never become an order: up to 12 months, so we can pick up the conversation if you come back to us.
  • Newsletter subscriptions: until you unsubscribe. We keep a record of your consent for as long as we need to prove we had it, and we keep a suppression record afterwards so we do not email you again by mistake.
  • Server and security logs: up to 12 months.
  • Cart cookie on your device: 30 days.

Note

We may keep data for longer than the periods above where the law requires it, where a complaint or legal claim is live, or where a regulator has asked us to preserve it. When the reason ends, we delete it or make it anonymous.

Who we share your data with

We do not sell your personal data, and we do not rent or swap it. We share it only with the suppliers who help us run the shop, and only as much as each one needs.

  • Stripe — card, Apple Pay and Google Pay payments, refunds and fraud screening. Stripe acts as an independent controller for some of this processing, including fraud prevention. See Stripe's privacy policy for how Stripe handles your data.
  • An Post and DPD — delivering your parcel. They receive your name, delivery address, phone number or email address, and the contents description needed for the label.
  • Our website hosting and database provider — storing the site, your order and your cart.
  • Our email provider — sending order confirmations, dispatch notices and, if you have opted in, our newsletter.
  • Our accountant and professional advisers — where necessary to keep proper books and records, and to obtain legal advice.
  • Revenue, An Garda Siochana, the CCPC or a court — where the law requires us to disclose information, or where we need to establish, exercise or defend a legal claim.

Sending data outside the EEA

Some of our suppliers are based in, or store data in, countries outside the European Economic Area, in particular the United States. Where that happens we make sure a lawful transfer mechanism is in place.

The safeguards we rely on are an adequacy decision of the European Commission — including the EU-US Data Privacy Framework where the supplier is certified under it — or the European Commission's Standard Contractual Clauses together with any extra measures needed.

You can ask us for more detail about the safeguard that applies to a particular supplier by emailing Faizaboutique110@gmail.com.

Your rights

You have the following rights over your personal data. They are free to use, and we will not treat you differently for using them.

  • Right of access (Article 15) — a copy of the personal data we hold about you, plus information about how we use it.
  • Right to rectification (Article 16) — correcting data that is wrong or incomplete.
  • Right to erasure (Article 17) — asking us to delete your data, sometimes called the right to be forgotten. This is not absolute: we cannot delete records we are legally required to keep, such as VAT records.
  • Right to restriction of processing (Article 18) — asking us to pause using your data, for example while we check whether it is accurate.
  • Right to data portability (Article 20) — receiving the data you gave us in a structured, commonly used, machine-readable format, or having us send it to another organisation, where our basis for processing it is consent or a contract.
  • Right to object (Article 21) — objecting to processing based on our legitimate interests, and objecting at any time to direct marketing. If you object to marketing, we stop immediately.
  • Right to withdraw consent — where we rely on consent, you can withdraw it at any time. Use the unsubscribe link in any marketing email, or contact us.
  • Rights about automated decisions (Article 22) — you have the right not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you. We do not make decisions like that about our customers.

How to exercise your rights

Email Faizaboutique110@gmail.com, or write to us at Faiza's Boutique, Nimra Halal Foods, 89/90 Parnell Street, Dublin 1, D01 K302, Ireland. Please tell us what you want and enough about your order or enquiry for us to find you.

We reply within one month of receiving your request. If your request is complex, or if you have made several requests, we may extend that by up to two further months — if so, we will tell you within the first month and explain why.

There is normally no charge. We may charge a reasonable fee, or refuse to act, if a request is clearly unfounded or excessive, and we will explain our reasons if that happens.

If we cannot do what you have asked, we will tell you why, and remind you that you can complain to the Data Protection Commission or go to court.

Complaining about how we handle your data

Please tell us first. Most problems are a misunderstanding and we would much rather fix it directly.

If you are not satisfied, you have the right to lodge a complaint with the Data Protection Commission. It is the independent Irish supervisory authority for data protection.

Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland. Website: dataprotection.ie. The quickest route is the Contact Us Online form on the DPC website.

You also have the right to an effective judicial remedy against us or against the DPC.

Cookies

We use a small number of cookies. Our Cookie Policy explains each one, what it is for, how long it lasts, and how to change or withdraw your consent. The short version: the basket cookie and the staff login cookie are strictly necessary, and analytics cookies are only set after you agree to them.

Children's data

Our shop is meant for adults. We do not knowingly collect personal data from children, and we do not run a service aimed at children.

In Ireland the digital age of consent is 16. This is set by section 31 of the Data Protection Act 2018. That means that where we rely on consent — for example for a newsletter subscription — a child under 16 cannot give that consent themselves.

If you are under 16 and want to buy something, please ask a parent or guardian to place the order and to talk to us. If we find out we have collected personal data from a child under 16 without a parent's or guardian's consent, we will delete it. If you believe that has happened, email Faizaboutique110@gmail.com and we will deal with it.

Keeping your data safe

We use HTTPS across the site, so data travelling between your browser and us is encrypted. Payments go directly to Stripe, so card data never touches our servers.

Access to customer data is limited to the people who need it to do their job, and our admin accounts are protected by strong passwords and session controls. Staff sessions are stored as hashes, not as readable tokens.

No system is perfect. If a breach ever happens that is likely to put your rights and freedoms at risk, we will tell you and the Data Protection Commission without undue delay, as Article 34 of the GDPR requires.

Changes to this policy

If we change how we use your personal data we will update this page and change the date at the top. If the change is significant, and we have your email address, we will tell you about it directly. It is worth checking this page every so often.

Sources and further reading

Every legal claim on this page can be checked against the primary sources below. They open on the website of the body that publishes them.