1. Introduction

This Privacy Policy explains how Oastine ("we", "us", "our") collects, uses, discloses, and protects your personal information when you visit or make a purchase from our online store (the "Site").

We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the requirements of our payment processor, Shopify Payments. By using our Site, you agree to the collection and use of information as described in this policy.

2. Information We Collect

Information you provide to us

• Name, billing and shipping address
• Email address and phone number
• Payment details (processed securely by Shopify Payments – see Section 5)
• Order history and communications with our customer service team
• Account login details, if you create an account

Information collected automatically

• IP address, browser type, and device information
• Pages viewed, time spent on the Site, and referring URLs
• Location data (general, based on IP address)
• Cookies and similar tracking technologies (see Section 6)

Information from third parties

• Fraud prevention and risk assessment data from Shopify Payments
• Analytics data from services such as Google Analytics or Meta Pixel, where enabled

3. How We Use Your Information

We use the personal information we collect to:

• Process and fulfil your orders, including payment, shipping, and returns
• Communicate with you about your order, account, or customer service enquiries
• Send you marketing communications, where you have consented to receive them
• Improve our Site, products, and customer experience
• Detect and prevent fraud, unauthorised transactions, and other liabilities
• Comply with legal obligations, including tax, accounting, and reporting requirements

4. Sharing Your Information

We do not sell your personal information. We may share your information with:

• Shopify Inc., our e-commerce platform provider, which hosts our Site and processes data on our behalf
• Shopify Payments, for payment processing and fraud prevention (see Section 5)
• Shipping and fulfilment partners, to deliver your orders
• Marketing and analytics providers, such as Google Analytics or Meta, where you have consented to tracking
• Law enforcement or regulators, where required by law

All third parties are required to handle your data securely and only for the purposes we specify.

5. Payment Processing

Payments made on our Site are processed by Shopify Payments. When you make a purchase, your payment information (such as card number, CVV, and billing address) is transmitted directly to Shopify Payments via a secure, encrypted connection. We do not store your full payment card details on our own servers.

Shopify Payments is PCI-DSS compliant and processes data in accordance with its own privacy policy, available at shopify.com/legal/privacy. Shopify Payments may also use your information for fraud detection and risk analysis purposes.

6. Cookies & Tracking Technologies

We use cookies and similar technologies to:

• Keep items in your cart between visits
• Remember your preferences and login status
• Understand how visitors use our Site (analytics)
• Deliver relevant advertising, where consented

You can control or disable cookies through your browser settings. Please note that disabling cookies may affect the functionality of our Site, such as your ability to complete a purchase.

7. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes outlined in this policy, including satisfying any legal, accounting, or reporting requirements (such as UK tax record-keeping obligations, typically 6 years). Once retention is no longer necessary, we securely delete or anonymise your data.

8. Your Rights (UK GDPR)

As a UK resident (or resident of the EEA), you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict certain processing of your data
• Request a copy of your data in a portable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, please contact us using the details in Section 13.

9. Children's Privacy

Our Site is not directed at children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

10. International Data Transfers

As we use third-party providers such as Shopify (headquartered in Canada) and Shopify Payments, your data may be transferred to and processed in countries outside the UK/EEA. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs), to protect your information in accordance with UK GDPR requirements.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction, including SSL encryption and secure hosting via Shopify's PCI-DSS compliant infrastructure. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any updates will be posted on this page with a revised "Last updated" date. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us: