Privacy policy

This Privacy Policy describes how santacruzbicyclesa.shop collects, uses, discloses and otherwise processes personal information when you visit our website, place an order, communicate with us or otherwise interact with our services.

For privacy enquiries, contact:

info@santacruzbicyclesa.shop

1. Who We Are

For the purposes described in this Privacy Policy, santacruzbicyclesa.shop is responsible for determining how personal information relating to our customers and website users is used in connection with our store, except where another organisation acts independently as a controller of particular information.

Our website is powered using Shopify ecommerce technology.

Shopify and other service providers may process information in accordance with their own responsibilities, contractual arrangements and privacy policies.

2. Information We May Collect

Depending on how you interact with our website, we may process information including:

Identity Information

This may include:

• name;
• account name;
• billing identity information; and
• other information supplied during an order or customer-service interaction.

Contact Information

This may include:

• email address;
• telephone number;
• billing address;
• shipping address; and
• other contact details you provide.

Order and Transaction Information

This may include:

• products ordered;
• order number;
• order date;
• purchase value;
• payment status;
• shipping information;
• returns;
• refunds; and
• customer service history.

Payment Information

Payments may be processed by Shopify, payment processors, card providers, banks or other payment-service providers.

We generally do not receive or store complete card numbers when payment information is handled directly by an authorised payment processor.

Device and Technical Information

When you use our website, information may automatically be generated or collected, including:

• IP address;
• browser type;
• device type;
• operating system;
• language;
• device identifiers;
• network information;
• referring pages;
• pages viewed;
• interaction data; and
• cookie or similar technology information.

Account Information

If customer accounts are available, we may process account-related information such as login identifiers, saved addresses, preferences and purchase history.

Communications

When you contact us, we may process your message, email address, order details and other information included in your communication.

3. How We Collect Information

Personal information may be collected:

• directly from you;
• automatically through your use of our website;
• from Shopify;
• from payment processors;
• from shipping and fulfilment providers;
• from fraud-prevention providers;
• from analytics or advertising providers where lawfully permitted;
• from customer-support systems; and
• from other service providers involved in operating our store.

4. Purposes for Processing Personal Information

We may process personal information to:

Process Orders

This includes:

• receiving orders;
• confirming purchases;
• processing payments;
• fulfilling orders;
• arranging shipment;
• providing delivery information;
• managing returns; and
• issuing refunds.

Provide Customer Service

We may use information to:

• answer questions;
• locate orders;
• resolve complaints;
• investigate delivery issues;
• assist with returns;
• provide product support; and
• respond to requests.

Maintain and Improve Our Store

We may process information to understand website functionality, diagnose technical issues, improve performance and develop our services.

Protect Our Store

Information may be processed for:

• fraud prevention;
• payment security;
• cybersecurity;
• abuse detection;
• account protection; and
• enforcement of our contractual rights.

Comply With Legal Obligations

We may process and retain information where necessary to comply with applicable laws, accounting requirements, tax obligations, legal proceedings, regulatory requests or lawful government demands.

Marketing

Where permitted, we may send information regarding products, services or promotions.

Where consent is required, marketing communications will be sent only where the required consent has been obtained.

You may unsubscribe from marketing emails using an available unsubscribe mechanism or by contacting info@santacruzbicyclesa.shop.

5. Lawful Bases Under UK Data Protection Law

Where UK GDPR applies, we rely on one or more lawful bases depending on the processing activity.

These may include:

Performance of a Contract

Processing may be necessary to:

• process your order;
• receive payment;
• arrange delivery;
• communicate about your order;
• handle a return; or
• provide customer support relating to your purchase.

Legal Obligation

We may process information when required to comply with accounting, tax, regulatory, consumer-protection or other legal requirements.

Legitimate Interests

We may process information where necessary for legitimate business interests, provided those interests are not overridden by your rights and freedoms.

Examples may include:

• preventing fraud;
• protecting our website;
• improving customer service;
• maintaining records;
• defending legal claims; and
• understanding the operation of our business.

Consent

Where applicable, we may rely on consent for activities such as certain electronic marketing or non-essential tracking technologies.

UK GDPR requires organisations to identify and communicate appropriate lawful bases for personal-data processing.

6. Shopify

Our store is hosted using Shopify's ecommerce infrastructure.

Shopify provides technology that enables us to operate our online store and may process merchant and customer personal information as part of providing its services.

Shopify maintains documentation regarding its privacy and GDPR-related practices. Shopify states that merchants remain responsible for analysing their own compliance obligations.

7. Cookies and Similar Technologies

Our website may use cookies, pixels, local storage, tags and similar technologies.

These technologies may be used for:

• essential website operation;
• shopping-cart functionality;
• checkout;
• security;
• remembering preferences;
• analytics;
• measuring website performance; and
• advertising where enabled and lawfully permitted.

Where applicable law requires consent before a particular non-essential technology is used, we intend to obtain the required consent through available consent-management mechanisms.

Current ICO guidance states that PECR applies to cookies and a broader category of technologies that store or access information on user devices.

Advertising-related storage or access technologies are subject to consent requirements under current ICO guidance.

8. How We May Share Personal Information

We may disclose information to organisations that assist us in operating our business, including:

Shopify

For ecommerce hosting and store functionality.

Payment Processors

To authorise and process payments, refunds and payment-related security checks.

Shipping and Fulfilment Providers

To prepare, dispatch, transport and deliver customer orders.

Technology Providers

Including hosting, security, analytics, communications and customer-support service providers.

Professional Advisers

Such as accountants, auditors, lawyers, insurers or consultants where reasonably necessary.

Authorities

We may disclose information when reasonably necessary to comply with law, respond to lawful requests, protect legal rights, prevent fraud or enforce agreements.

Business Transactions

If our business or assets are involved in a merger, acquisition, financing, reorganisation or sale, information may be disclosed as reasonably necessary in connection with the transaction and subject to applicable legal safeguards.

9. International Transfers

Some service providers that support our website may operate internationally.

As a result, personal information may be processed outside the United Kingdom.

Where UK data protection law requires safeguards for an international transfer, we intend to use an applicable lawful transfer mechanism or rely on another valid legal basis for the transfer.

Shopify states that certain merchant and customer personal information for European merchants may be stored in the EEA, UK and/or Switzerland while its infrastructure and subprocessors may involve other jurisdictions.

10. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and to satisfy applicable legal, accounting, tax, dispute-resolution and enforcement requirements.

Retention periods may vary based on:

• the type of information;
• the purpose of processing;
• legal requirements;
• potential disputes;
• security requirements; and
• contractual obligations.

When information is no longer required, it may be deleted, anonymised or otherwise handled in accordance with applicable requirements.

11. Data Security

We use reasonable administrative, organisational and technical measures intended to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.

No internet transmission or electronic storage system can be guaranteed to be completely secure.

Customers should therefore use appropriate precautions when accessing online accounts and should keep passwords confidential.

The UK GDPR security principle requires organisations to implement appropriate technical and organisational security measures having regard to risk.

12. Your UK Data Protection Rights

Depending on the circumstances and applicable law, you may have rights including:

• the right to access personal information;
• the right to request correction of inaccurate information;
• the right to request deletion in applicable circumstances;
• the right to restrict processing in applicable circumstances;
• the right to object to certain processing;
• the right to data portability where applicable;
• the right to withdraw consent where processing is based on consent; and
• rights relating to certain automated decision-making where applicable.

The precise scope of these rights depends on the circumstances and applicable exemptions.

ICO guidance confirms that UK GDPR provides individuals with a range of rights over their personal information.

13. Exercising Your Rights

To make a privacy request, contact:

info@santacruzbicyclesa.shop

Please describe the request clearly.

We may request information reasonably necessary to verify your identity before providing personal information or completing certain privacy requests.

We will respond within the period required by applicable law.

14. Marketing Preferences

You may unsubscribe from marketing communications at any time through an unsubscribe link where provided or by contacting us.

Unsubscribing from marketing does not prevent us from sending essential transactional communications concerning an existing order or customer-service matter.

15. Children's Privacy

Our store is intended for general ecommerce use and is not designed to knowingly collect personal information from children contrary to applicable law.

If you believe that a child has provided personal information improperly, contact us at info@santacruzbicyclesa.shop.

16. Third-Party Websites

Our website may contain links to websites operated by third parties.

We are not responsible for the privacy practices of independent third-party websites.

You should review the privacy information provided by the relevant third party before providing personal information.

17. Complaints

If you have a concern about how santacruzbicyclesa.shop handles your personal information, contact us first at:

info@santacruzbicyclesa.shop

UK individuals may also have the right to complain to the Information Commissioner's Office (ICO) if they believe their data protection rights have been infringed.

18. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to:

• our business practices;
• technology;
• service providers;
• legal requirements; or
• our website.

The current version will be published on santacruzbicyclesa.shop with an updated revision date.

19. Contact

For privacy questions or requests:

santacruzbicyclesa.shop
Email: info@santacruzbicyclesa.shop