Privacy Policy

• Contact Details: Your first name, surname, email address, physical shipping address, billing address, telephone number, and postcode.
• Social Media Profile Integrations: If you choose to register an account or log into our Site using a third-party single sign-on service (such as Facebook, Google, or Apple), you authorise that network to share specific profile data with us. This typically includes your first name, surname, profile email address, and account authentication token. Your password for that social network is never shared with or stored by us.
• Bespoke Order Customisation Details: Text strings, names, dates, layouts, and personalisation details submitted by you for customised labels and bespoke wedding/event candle collections.
• Financial & Payment Details: Transaction payment confirmations, preferred payment types, and account transaction logs. Secure credit/debit card details are processed directly by our third-party encrypted payment gateways and are never stored on our servers.
• Account Settings: Usernames, encrypted account access passwords, and selected shopping or communication preferences.
• Customer Support Logs: The full text, contents, and attachments of any emails you send us when contacting hello@salmamya.co.uk.

• Device Profiles: Web browser version, operating system, screen resolution, language settings, time zone, mobile network provider, and IP address.
• Interaction Data: How you arrive at our Site (e.g. via a Google search, social media ad, or direct link), date/time stamps, page interaction metrics (scroll depth, click maps), items viewed, items placed into your cart, and abandoned cart history.

• Consent: Where you give explicit, informed, and freely given permission for us to process your data, such as opting into our marketing newsletters. You have the right to withdraw this consent at any time.
• Performance of a Contract: Where processing your data is necessary to fulfil our contractual obligations to you — specifically processing payments, pouring your custom candle specifications, printing personalised labels, and organising courier dispatch.
• Legal Obligation: Where data retention is required to comply with our statutory obligations under UK law, including accounting, tax records, or responding to lawful government requests.
• Legitimate Interests: Where processing supports our legitimate business goals (such as monitoring fraud at checkout, running web analytics to improve user experience, or maintaining digital security), provided these interests do not override your fundamental data rights and freedoms.

• Fulfilling Orders & Bespoke Contracts: To accept payments, manage your cart, process and hand-craft your custom-tailored designs, print shipping labels, send automated tracking and invoices, and manage post-purchase support.
• Customer Communications & Review Management: To respond to customer support enquiries, alert you to shipping changes, and send automated feedback or product review requests via our verified partners (e.g. Trustpilot, Reviews.io).
• Marketing & Behavioural Advertising: To send newsletters, flash sale notices, and promotional updates by email or text (where you've given explicit opt-in consent), and to show targeted advertisements across external platforms (Meta, Instagram, Google) based on your past browsing activity.
• Security & Fraud Prevention: To monitor transactions for card-not-present fraud, audit checkout behaviour to block malicious bot traffic, secure your account, and maintain safe web operations.
• Technical Optimisation: To identify broken links, monitor site performance, and make the Site responsive across all devices.
• Legal Reasons: To comply with applicable law, respond to valid legal requests (including from law enforcement or government agencies), and to enforce or investigate potential violations of our Terms & Conditions or this Policy.

• Shopify Inc.: Our e-commerce platform, hosting our entire store, shopping engine, and administrative dashboard.
• Payment Infrastructure Providers: Encrypted gateways including Shop Pay, Apple Pay, Google Pay, Mastercard, and Visa, to safely process transactions. We plan to introduce Klarna as a payment option in future — when we do, this Policy will be updated to explain how your data is shared with them.
• Shopify Network Intelligence & Fraud Prevention: We use Shopify's built-in fraud analysis services. When you attempt a transaction, your IP address, billing details, and device signals are analysed automatically to detect potential card-not-present fraud and protect our store against malicious bot activity.
• Logistics & Fulfilment Couriers: Shipping management tools and delivery carriers (such as Royal Mail, DHL, or DPD) to process, sort, and deliver your parcels.
• Digital Marketing & Audience Matching: Google Analytics, Klaviyo, Mailchimp, and Meta (Facebook/Instagram Pixels). To deliver relevant advertisements, we may share encrypted personal identifiers (such as your email address) with Meta or Google using cryptographic hashing — a process that scrambles your email into a secure string of text so these platforms can match you to your existing account without exposing your raw email address.
• Business Transfers: In connection with a business transaction such as a merger, acquisition, or sale of assets, to comply with applicable legal obligations, to enforce our Terms & Conditions or this Policy, and to protect the rights and safety of our business and our users.
• Regulatory & Law Enforcement Bodies: On rare occasions where we are compelled by statutory law, search warrants, or court orders.

• Financial & Transaction Records: Retained for 6 years following the end of the relevant tax year, to satisfy UK HMRC reporting, audit, and accounting obligations.
• Customer Accounts: Retained until you request account closure or erasure.
• Marketing Profiles & Ad Audiences: Retained until you unsubscribe, or after 24 months of email inactivity, at which point your profile is permanently removed from our active marketing systems. Any temporary identifiers uploaded to Meta or Google for encrypted audience matching are held by those platforms in line with their own data policies (typically deleted or anonymised within 48 hours to 20 days of a campaign ending).

• Right of Access: To receive a copy of the personal information we hold about you.
• Right to Rectification: To have inaccurate or incomplete records corrected.
• Right to Erasure ("Right to be Forgotten"): To request permanent deletion of your personal data, subject to legal limits.
• Right to Restrict or Object to Processing: To pause or stop our processing of your data for specific purposes, including direct marketing.
• Right to Data Portability: To receive a machine-readable copy of your personal data, to transfer to another provider.
• Right to Withdraw Consent: To cancel any marketing consent you've previously given, at any time — including by clicking "Unsubscribe" in our emails.