Privacy policy

This policy explains how TRIBAL MERCHANTS LTD, trading as tribalmerchant, handles personal information in connection with tribalmerchant.shop, purchases, customer enquiries and related communications. TRIBAL MERCHANTS LTD is the controller of the personal information we use for those purposes.

Who we are and how to contact us

Send privacy questions and requests to support@tribalmerchant.shop. You can also write to our registered office. Please identify the order, account or interaction concerned so we can locate the relevant information, but do not email complete payment-card details or passwords.

Information you provide

When you make a purchase or contact us, we collect the information needed for that interaction. This can include your name, email address, telephone number, billing and delivery addresses, ordered products, transaction references, and the information you include in an enquiry or return request.

If you send photographs to explain a damaged item or product question, those photographs become part of the related support record. Please avoid including unrelated personal information in an image or message. If you create or use a customer account, account information is also processed to provide that service.

Payment providers handle the payment details entered through checkout. We receive the transaction information necessary to administer the order, such as payment status and a transaction reference. We do not store full payment-card numbers or full bank-account details in our customer-service records.

Information collected through the website

Our Shopify-powered store processes technical information such as an IP address, device and browser information, and information about interactions with the website. Cookies and similar technologies support functions such as the shopping basket, account access, security and remembering privacy choices.

The website's cookie-preferences panel provides categories for required functionality, personalisation, marketing and analytics. The use of optional technologies depends on your choices and the services enabled for the store. Our Cookies Policy explains the controls and how to change them.

How we use information and the legal bases

We use order and contact information to take steps at your request before a purchase, process the purchase, arrange delivery, handle returns and provide related customer service. The legal basis is performance of our contract with you or steps necessary to enter that contract.

We keep records required for accounting, taxation and consumer obligations, and respond to lawful requests where required. The legal basis is compliance with the relevant legal obligation.

We use necessary information to protect the store, detect and investigate suspected fraud, resolve complaints, and establish or defend legal claims. Where these activities are not required by law or necessary for the contract, we rely on legitimate interests in operating a secure business and resolving disputes, balanced against your rights.

Where we send optional marketing communications or use optional tracking that requires consent, we rely on your consent. You can withdraw it. Withdrawing marketing or cookie consent does not prevent us from sending essential order, delivery, return or security communications.

Marketing choices

If you choose to receive marketing, you can unsubscribe using the link in a marketing email or by contacting us. We will use a minimal suppression record where necessary to respect your choice and avoid contacting you again with unwanted marketing.

You have the right to object to the use of your personal information for direct marketing, including related profiling. This right is separate from whether you keep a customer account or place future orders. Buying a product, accepting sales terms or contacting customer service does not by itself mean you have agreed to every optional marketing purpose.

Who receives information

Shopify provides the platform used to operate our online store. Payment providers process payments, refunds and related payment checks. Delivery and fulfilment service providers receive the information needed to deliver or return goods. Providers supporting business email, customer communications and website operation may process the information needed for those functions.

Where you choose optional personalisation, analytics or marketing features, relevant technology providers may process information for those purposes. The cookie-preferences panel describes marketing involving partners including Shopify. The exact processing depends on the services used and your applicable choices.

We may also disclose relevant information to professional advisers, regulators, courts or public authorities where reasonably necessary for advice, a legal obligation, a dispute, or protection against fraud. We limit what is shared to information relevant to the purpose.

Providers may act on our instructions or, for some of their own services and legal obligations, as independent controllers. See Shopify's privacy information for its handling of personal information. The selected payment provider's notice applies to its separate processing.

Etsy, Instagram and external links

We link to our Etsy shop and Instagram profile. Visiting or interacting with those platforms is also subject to their own privacy information and controls. Linking to a profile does not mean that activity on that platform is governed solely by this website policy.

If you contact us through a platform or buy through Etsy, we may receive the message, order and contact information that the platform makes available to us. We use it to respond or fulfil the relevant transaction. For a marketplace order, use its order messaging tools where practical so the communication remains associated with that purchase.

International processing

Shopify and other service providers may process information outside the United Kingdom. Shopify describes its international processing and safeguards in its Data Processing Addendum. Depending on the destination and provider, safeguards can include an applicable adequacy arrangement or approved contractual protections with the required UK provisions.

Where we arrange a restricted international transfer, we must use the safeguards required by applicable data-protection law. You can contact us for information about relevant destinations and safeguards, including how to obtain a copy where appropriate. This may be subject to reasonable protection of confidential information.

How long information is kept

We retain order and transaction records for the period needed to administer purchases and meet accounting, tax and legal requirements. Our ordinary order-record retention period is six years; records may be retained longer where a specific legal duty or an unresolved dispute requires it.

Enquiry and support records are kept for as long as needed to deal with the matter and any related complaint or claim. We consider the nature of the issue, whether the order remains within a relevant rights period, and applicable legal limitation periods when deciding when to remove them.

Marketing information is retained while the relevant permission remains valid and the information is needed for that purpose. Withdrawal or objection ends that marketing use, although a minimal suppression record may be retained. Cookie and similar-technology lifetimes depend on the particular technology and its purpose. Retaining order records does not mean retaining every optional browsing record for the same period.

Your data-protection rights

Depending on the circumstances and legal basis, you can request access to your personal information, correction of inaccurate data, deletion, restriction of processing, or a portable copy of information you provided. You may object to processing based on legitimate interests and can withdraw consent where we rely on it.

These rights are not identical in every situation. For example, we may need to keep transaction records to meet a legal obligation even after an account is closed. We will explain any applicable limitation when responding rather than treating it as a reason to ignore your request.

Contact support@tribalmerchant.shop to make a request. We may need proportionate information to confirm your identity and locate the records, particularly before disclosing personal information. We will respond within the period required by applicable law and explain any lawful extension.

Automated checks

Payment and store-security systems can use automated checks to identify potentially fraudulent transactions. If a payment or order is affected and you believe there has been an error, contact us so the matter can be investigated, including with the relevant payment provider where necessary. We do not treat a technical payment error as proof of wrongdoing by a customer.

Providing information and protecting it

We need sufficient contact, delivery and payment information to fulfil an order. If essential information is missing, we may be unable to complete the transaction or delivery. Optional marketing choices are separate from the information required to buy a product.

We use organisational and technical measures appropriate to the information we handle. Access should be limited to people and providers who need it for the relevant task. No internet service can promise absolute security, so please protect your account credentials and tell us about suspected misuse.

Our store is intended for people able to enter into a purchase contract. If you believe a child has supplied personal information inappropriately, contact us so we can investigate and take appropriate action.

Complaints and changes

You can contact us about a privacy concern and you have the right to complain to the UK's Information Commissioner's Office at ico.org.uk/make-a-complaint. You do not have to complete our internal complaint process before approaching the ICO.

We may update this notice to reflect changes in our services or handling of information. Where a material change requires further notice or consent, we will provide it as required. A revised notice does not itself provide permission for a new processing purpose that requires your consent.