Privacy policy

Privacy Policy

(Same structure as your draft, updated address and a couple of UK-specific tweaks — UK GDPR reference and ICO as the supervisory authority instead of a generic EEA link.)

Last updated: July 5, 2026

Pastilak operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the "Services"). Pastilak is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase or other transaction using the Services or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described in this Privacy Policy.

Personal Information We Collect or Process

When we use the term "personal information," we are referring to information that identifies or can reasonably be linked to you or another person. Personal information does not include information that is collected anonymously or that has been de-identified, so that it cannot identify or be reasonably linked to you. We may collect or process the following categories of personal information, depending on how you interact with the Services, where you live, and as permitted or required by applicable law:

  • Contact details — name, address, billing address, shipping address, phone number, email address.
  • Financial information — card numbers, financial account information, transaction details, payment confirmations.
  • Account information — username, password, security questions, preferences and settings.
  • Transaction information — items viewed, added to cart or wishlist, purchases, returns, exchanges, cancellations.
  • Communications with us — the content of any support inquiries or messages you send us.
  • Device information — device, browser, network connection, IP address, and other identifiers.
  • Usage information — how and when you interact with the Services.

Personal Information Sources

  • Directly from you (account creation, use of the Services, communications).
  • Automatically through the Services (cookies and similar technologies).
  • From our service providers who process personal information on our behalf.
  • From our partners or other third parties.

How We Use Your Personal Information

  • Provide, Tailor, and Improve the Services — process payments, fulfill orders, manage your account, arrange shipping, handle returns and exchanges, personalize your shopping experience.
  • Marketing and Advertising — send marketing communications and show relevant ads, where you have consented or as otherwise permitted by law.
  • Security and Fraud Prevention — authenticate accounts, secure payments, detect and investigate fraud or illegal activity.
  • Communicating with You — customer support and general correspondence.
  • Legal Reasons — compliance with law, legal process, or enforcement of our terms.

How We Disclose Personal Information

  • With Shopify and other vendors performing services on our behalf (IT, payments, analytics, support, fulfillment).
  • With business and marketing partners, in accordance with your preferences and applicable law.
  • Where you direct or consent to disclosure.
  • With our affiliates or corporate group.
  • In connection with a business transaction, legal obligation, or to protect our rights and the rights of others.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve them. Shopify may use certain enhanced features that incorporate data from your interactions with our store and other merchants. In these circumstances, Shopify is responsible for processing your personal information for those purposes. Learn more at the Shopify Consumer Privacy Policy, or exercise your rights via the Shopify Privacy Portal.

Third-Party Websites and Links

We are not responsible for the privacy or security practices of any third-party websites linked from our Services. Please review their policies independently before engaging with them.

Children's Data

Our Services are not intended for use by children, and we do not knowingly collect personal information from children under the age of majority in their jurisdiction. If you are a parent or guardian and believe your child has provided us with personal information, contact us to request deletion.

Security and Retention

No security measures are perfect. We retain personal information only as long as necessary to provide the Services, comply with legal obligations, resolve disputes, or enforce our agreements.

Your Rights and Choices

Depending on where you live, you may have rights including:

  • Right to Access/Know
  • Right to Delete
  • Right to Correct
  • Right of Portability
  • Managing Communication Preferences — unsubscribe from promotional emails at any time; you may still receive non-promotional, order-related emails.

If you are in the UK, you additionally have rights under UK GDPR, including:

  • Objection to Processing / Restriction of Processing
  • Withdrawal of Consent

You may exercise these rights by contacting us at the details below. To learn more about Shopify's role in processing, visit privacy.shopify.com/en.

We will not discriminate against you for exercising these rights. We may need to verify your identity before processing a request, and you may authorize an agent to act on your behalf subject to verification.

Complaints

If you have concerns about our processing of your personal information, contact us using the details below. UK residents also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

International Transfers

We may transfer, store, and process your personal information outside the country you live in. Where we transfer personal information out of the UK, we rely on appropriate safeguards such as the UK's International Data Transfer Agreement or Standard Contractual Clauses, unless the destination country has been found to provide an adequate level of protection.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised "Last updated" date, and we will provide notice as required by law.

Contact

Questions about this Privacy Policy, or requests to exercise your rights, can be sent to:
business.pastilak@gmail.com, or Pastilak, Centenary Square, Birmingham, B1 2DR, United Kingdom.

For the purposes of applicable data protection law, we are the data controller of your personal information.