Privacy policy

This Privacy Policy explains how willowandmum.shop collects, uses, discloses, stores and otherwise processes personal information when individuals visit our website, communicate with us, create or use relevant customer functionality or purchase products from us.

For privacy enquiries, contact:

Email: info@willowandmum.shop

We seek to process personal information in accordance with applicable UK data-protection and electronic-communications law, including the UK GDPR, Data Protection Act 2018, PECR and applicable amendments introduced by the Data (Use and Access) Act 2025. The ICO confirms that all of the DUAA's data-protection provisions are now in force.

1. Information We May Collect

Depending on how an individual interacts with willowandmum.shop, we may collect information including:

• Name;
• Billing address;
• Delivery address;
• Email address;
• Telephone number where provided;
• Order information;
• Product selections;
• Payment-related information;
• Transaction details;
• Customer-service communications;
• Returns and refund information;
• Account information where account functionality is offered;
• IP address;
• Browser and device information;
• Website activity;
• Cookie identifiers;
• Shopping basket activity;
• Fraud-prevention information; and
• Marketing preferences.

We seek to collect only information reasonably necessary for the purposes described in this policy.

2. How We Collect Information

Personal information may be collected:

• Directly from customers;
• Through the checkout process;
• When customers contact customer support;
• When customers place or manage orders;
• When customers request returns or refunds;
• Through cookies and similar technologies;
• Through payment service providers;
• Through delivery and fulfilment providers;
• Through Shopify and ecommerce functionality; and
• From other service providers where legally permitted.

3. Purposes for Processing Personal Information

We may process personal information to:

• Operate willowandmum.shop;
• Display and provide ecommerce functionality;
• Process and fulfil orders;
• Process payments;
• Provide order confirmations;
• Arrange shipping and delivery;
• Provide customer support;
• Process returns and refunds;
• Detect and prevent fraud;
• Secure our website;
• Maintain business and transaction records;
• Comply with legal obligations;
• Respond to lawful requests;
• Establish, exercise or defend legal claims;
• Improve website operation;
• Understand website performance;
• Manage customer relationships;
• Provide marketing where legally permitted; and
• Protect our legitimate business interests.

4. Lawful Bases

Where UK data-protection law applies, we rely on an appropriate lawful basis before processing personal information.

Depending on the processing activity, this may include:

Contract

We may process information when necessary to enter into or perform a contract with a customer, including processing an order, taking payment, arranging delivery and managing a return.

Legal Obligation

We may process information when required to comply with tax, accounting, consumer-protection, fraud-prevention or other legal obligations.

Legitimate Interests

We may process information where necessary for our legitimate interests or those of another party, provided those interests are not overridden by the individual's rights and interests.

Legitimate interests may include website security, fraud prevention, business administration, customer-service improvement and establishment or defence of legal claims.

Consent

Where consent is required, including for certain marketing or non-essential tracking technologies, we will seek consent in accordance with applicable law.

The ICO confirms that organisations must have a valid lawful basis for handling personal information.

5. Shopify

willowandmum.shop may be hosted or powered using Shopify ecommerce services.

Shopify may process certain customer personal data to provide ecommerce infrastructure, checkout functionality, fraud prevention and related services.

Shopify's current Data Processing Addendum governs processing of merchant customer personal data in connection with Shopify's services.

6. Payment Processing

Payments may be handled by Shopify Payments or other payment service providers made available through checkout.

Payment providers may collect and process information required to authorise, complete, protect and record transactions.

We do not necessarily receive or retain complete payment-card credentials when transactions are processed directly by an authorised payment provider.

7. Service Providers

We may disclose information where reasonably necessary to providers assisting us with:

• Ecommerce hosting;
• Payment processing;
• Order fulfilment;
• Shipping and delivery;
• Customer service;
• Website security;
• Fraud prevention;
• IT services;
• Analytics;
• Marketing where permitted;
• Professional advice; and
• Compliance obligations.

Service providers receive information only to the extent reasonably necessary for the relevant function or as otherwise legally permitted.

8. Cookies and Similar Technologies

willowandmum.shop may use cookies, pixels, local storage, scripts, tags and similar technologies.

These technologies may be used for purposes such as:

• Keeping the website functioning;
• Maintaining shopping-basket contents;
• Providing secure checkout functionality;
• Remembering relevant preferences;
• Measuring website performance;
• Analytics;
• Fraud prevention; and
• Advertising or marketing where permitted.

UK PECR rules apply broadly to technologies that store information on or access information from a user's device, not only conventional cookies. For most non-exempt uses, clear information and prior valid consent are required.

9. Essential and Non-Essential Technologies

Certain technologies may be strictly necessary to provide a service requested by the user, such as shopping-basket or essential security functionality.

Other technologies, including certain analytics and advertising technologies, may require consent.

Where consent is required, we seek to provide appropriate controls enabling visitors to make a choice concerning those technologies.

The ICO states that refusing non-exempt storage/access technologies should be as easy as accepting them and that withdrawal controls should be available.

10. Direct Marketing

Where permitted by law, we may send customers information about products, promotions or related services.

Marketing messages to individual subscribers will only be sent where an appropriate legal basis and PECR permission exists, including valid consent or the applicable products-and-services soft opt-in.

Where the soft opt-in is relied upon, relevant conditions must be satisfied, including obtaining contact information directly during a sale or negotiation for a sale, marketing similar products or services and giving an opportunity to opt out.

Recipients may unsubscribe from marketing communications at any time using the unsubscribe method provided or by contacting:

info@willowandmum.shop

11. Transactional Communications

Order confirmations, shipping updates, security notifications, customer-service messages and other communications necessary for carrying out a transaction are not necessarily marketing messages.

Customers may continue to receive necessary transactional communications even if they opt out of promotional marketing.

12. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and for legitimate legal, accounting, fraud-prevention, dispute-resolution and business-record requirements.

Retention periods may vary according to:

• The type of information;
• The purpose for which it is used;
• Contractual requirements;
• Statutory limitation periods;
• Tax and accounting requirements;
• Fraud and security requirements; and
• Actual or potential disputes.

When information is no longer reasonably required, it may be deleted, anonymised or otherwise handled in accordance with applicable requirements.

13. Data Security

We use reasonable organisational and technical measures intended to protect personal information from accidental or unlawful loss, misuse, unauthorised access, disclosure, alteration or destruction.

However, no online system can be guaranteed to be completely secure.

Customers should protect account credentials where account functionality is available and should notify us if they believe their account or information has been compromised.

14. International Data Transfers

Some technology, payment, fulfilment, support or other service providers may process information outside the United Kingdom.

Where UK personal information is transferred internationally and applicable law requires safeguards, we seek to use an appropriate lawful transfer mechanism, such as:

• UK adequacy regulations;
• Appropriate contractual safeguards;
• The UK International Data Transfer Agreement;
• The UK Addendum to approved standard contractual clauses; or
• Another legally recognised transfer mechanism.

15. Your Data Protection Rights

Subject to applicable conditions and exemptions, individuals may have rights including:

• The right to be informed;
• The right of access;
• The right to rectification;
• The right to erasure;
• The right to restrict processing;
• The right to data portability;
• The right to object;
• Rights relating to certain automated decision-making; and
• The right to withdraw consent where processing is based on consent.

For example, the ICO confirms that individuals may object to certain uses of personal information and may withdraw consent where consent is the basis for processing.

16. Exercising Privacy Rights

Privacy requests may be sent to:

info@willowandmum.shop

We may request information reasonably necessary to verify the identity of a person making a request and to protect personal information from unauthorised disclosure.

We will respond in accordance with applicable legal requirements.

17. Complaints

Customers who have concerns about our handling of personal information should contact us first so that we have an opportunity to investigate the matter.

Individuals may also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data-protection regulator.

18. Children's Privacy

Our services are not intended to be used independently by children who do not have legal capacity to enter into the relevant purchase contract.

We do not knowingly seek to collect personal information from children in circumstances where parental or guardian involvement is legally required.

19. Disclosure Required by Law

We may disclose information where reasonably necessary to:

• Comply with applicable law;
• Respond to lawful court orders;
• Respond to valid regulatory or governmental requests;
• Investigate suspected fraud;
• Protect legal rights;
• Protect customers or other persons; or
• Establish, exercise or defend legal claims.

20. Business Transfers

If our business or relevant assets are reorganised, sold, transferred, merged or acquired, information may be transferred as part of that transaction where legally permitted and subject to applicable data-protection requirements.

21. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in law, technology, business practices, Shopify functionality or our processing activities.

The updated version will be published on willowandmum.shop with an updated effective date.

22. Contact

Privacy questions and requests may be directed to:

willowandmum.shop
Email: info@willowandmum.shop