PRIVACY POLICY

Last updated: 28 July 2026

This Privacy Policy explains how Together Always collects, uses, stores, discloses and protects personal information when you visit our Shopify store, create an account, place an order, contact us or otherwise interact with us.

For the purposes of UK data protection law, Together Always is the controller of the personal data described in this policy, except where another organisation acts as an independent controller.

This policy is intended to comply with the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.

1. Personal Information We Collect

Depending on how you use our store, we may collect the following categories of personal information.

Identity Information

This may include:

• Full name;
• Account username;
• Title;
• Date of birth or age confirmation where relevant;
• Signature where required for delivery or fraud prevention.

Contact Information

This may include:

• Billing address;
• Delivery address;
• Email address;
• Telephone number.

Order and Transaction Information

This may include:

• Products viewed, added to a basket or purchased;
• Order history;
• Payment status;
• Refund and return records;
• Delivery details;
• Discount codes used;
• Communications relating to an order;
• Information required to investigate a disputed payment.

Payment Information

Payments may be processed through Shopify Payments or other payment service providers made available at checkout.

Together Always does not normally receive or store complete payment-card details. Payment providers may process information such as:

• Cardholder name;
• Card type;
• Partial or masked card number;
• Billing address;
• Transaction identifiers;
• Payment authentication and fraud-risk information.

Payment providers process payment information in accordance with their own privacy policies and legal obligations.

Technical and Device Information

This may include:

• Internet Protocol address;
• Device type;
• Browser type and version;
• Operating system;
• Time zone and approximate location;
• Language preferences;
• Cookie identifiers;
• Login information;
• Referring website;
• Pages viewed;
• Date and time of visits;
• Interactions with the store;
• Error reports and security logs.

Marketing and Preference Information

This may include:

• Marketing preferences;
• Newsletter subscription status;
• Cookie preferences;
• Product interests;
• Responses to campaigns, surveys or promotions;
• Engagement with marketing emails and advertisements.

Customer-Service Information

This may include:

• Emails, messages and other correspondence;
• Product reviews;
• Return requests;
• Complaints;
• Photographs or videos sent in relation to a product or delivery;
• Records of customer-service interactions.

Information from Third Parties

We may receive personal information from:

• Shopify;
• Payment processors;
• Delivery and fulfilment providers;
• Fraud-prevention services;
• Analytics providers;
• Advertising and social-media platforms;
• Customer-support services;
• Publicly available sources where lawful;
• A person placing an order or enquiry on your behalf.

2. How We Collect Personal Information

We collect personal information:

• Directly from you when you place an order, create an account, subscribe to marketing or contact us;
• Automatically through cookies and similar technologies when you use our store;
• From Shopify and service providers involved in operating the store;
• From payment, delivery, advertising, analytics and fraud-prevention partners;
• From public sources or third parties where permitted by law.

3. How We Use Personal Information

Together Always may use personal information to:

• Process and fulfil orders;
• Take and verify payments;
• Deliver products;
• Provide order confirmations and delivery updates;
• Manage returns, refunds, cancellations and complaints;
• Provide customer support;
• Create and administer customer accounts;
• Detect and prevent fraud, misuse and security incidents;
• Protect our legal rights and enforce agreements;
• Comply with tax, accounting, consumer-protection and other legal obligations;
• Improve our website, products and customer experience;
• Analyse store performance and customer behaviour;
• Personalise store content and recommendations;
• Send marketing communications where permitted;
• Measure advertising effectiveness;
• Respond to legal requests or regulatory requirements;
• Establish, exercise or defend legal claims.

4. Lawful Bases for Processing

Under UK data protection law, we must have a lawful basis for processing personal information.

Depending on the activity, we may rely on the following lawful bases.

Performance of a Contract

We process personal information where necessary to:

• Accept and fulfil your order;
• Process payment;
• Deliver products;
• Manage returns and refunds;
• Communicate with you about your purchase;
• Provide requested customer support.

Legal Obligation

We process personal information where necessary to comply with legal obligations, including:

• Tax and accounting requirements;
• Consumer-protection laws;
• Product-safety obligations;
• Fraud-prevention and financial regulations;
• Lawful requests from courts, regulators or public authorities.

Legitimate Interests

We may process information where necessary for our legitimate business interests, provided that those interests are not overridden by your rights and freedoms.

These interests may include:

• Operating and improving the store;
• Protecting customers and the business from fraud;
• Securing our systems;
• Understanding store performance;
• Managing customer relationships;
• Defending legal claims;
• Promoting similar products to existing customers where permitted by law.

Consent

We may rely on consent for activities such as:

• Certain marketing communications;
• Non-essential advertising or analytics cookies;
• Specific uses of information where consent is legally required.

You may withdraw consent at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

5. Shopify

Our store is hosted by Shopify.

Shopify provides the e-commerce platform that enables Together Always to offer products and services to customers.

When you use the store, Shopify may collect and process personal information to provide hosting, checkout, security, fraud prevention, analytics and other platform functions.

Depending on the processing activity, Shopify may act as our processor, a separate controller or another legally recognised participant in the processing.

Shopify may process information in countries outside the United Kingdom using appropriate legal safeguards.

6. Sharing Personal Information

We may share personal information with carefully selected third parties where reasonably necessary, including:

• Shopify and e-commerce platform providers;
• Payment processors and banks;
• Delivery companies, postal operators and couriers;
• Warehouses, suppliers and fulfilment partners;
• Customer-service providers;
• Email and communications providers;
• Website hosting and technical-support providers;
• Analytics and performance providers;
• Advertising and social-media platforms;
• Fraud-prevention, identity-verification and security providers;
• Accountants, auditors, insurers and professional advisers;
• Regulators, courts, law-enforcement bodies and public authorities;
• A purchaser, investor or successor in connection with a sale, merger, reorganisation or transfer of the business.

We require service providers to handle personal information securely and only for authorised purposes, where applicable.

We do not sell personal information in the ordinary meaning of selling customer data for money.

Some advertising technologies may involve sharing identifiers or online activity with advertising partners. Where consent is legally required, these technologies will be used only after valid consent has been obtained.

7. International Transfers

Some service providers may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we will take reasonable steps to ensure that an appropriate legal transfer mechanism is used.

This may include:

• Transfers to countries recognised by the UK Government as providing adequate protection;
• The UK International Data Transfer Agreement;
• The UK Addendum to approved standard contractual clauses;
• Another lawful transfer mechanism;
• Additional security or contractual safeguards where appropriate.

8. Cookies and Similar Technologies

Together Always and our service providers may use cookies, pixels, tags, local storage and similar technologies.

These technologies may be used to:

• Keep the store functioning;
• Remember basket contents and preferences;
• Enable secure checkout;
• Prevent fraud;
• Understand how visitors use the store;
• Measure website performance;
• Personalise content;
• Provide and measure advertising.

Strictly Necessary Cookies

These cookies are required for core store functions, security, checkout, basket management and account access.

They do not normally require consent where they are strictly necessary for a service requested by the user.

Analytics Cookies

These cookies help us understand how customers use the store, identify technical issues and improve performance.

Where legally required, they will be used only with your consent.

Advertising Cookies

These cookies may be used to build an understanding of interests, personalise advertisements, limit advertising frequency and measure campaign effectiveness.

Where legally required, they will be used only with your consent.

Preference Cookies

These cookies remember choices such as language, region or display preferences.

You may manage non-essential cookies through the cookie banner or preference tool available on the store.

You may also configure your browser to block or delete cookies. Blocking some cookies may affect store functionality.

9. Direct Marketing

Together Always may send marketing emails or messages where:

• You have given consent;
• The law otherwise permits us to contact you, including in certain circumstances involving existing customers and similar products;
• You have not opted out.

Every electronic marketing message will include an unsubscribe option where required.

You may withdraw consent or object to marketing at any time by:

• Using the unsubscribe link in a marketing email;
• Changing your account or cookie preferences where available;
• Contacting contact@shoptogetheralways.com

Service messages relating to an order, payment, delivery, account, security issue or legal notice are not marketing communications and may still be sent where necessary.

10. Data Retention

We keep personal information only for as long as reasonably necessary for the purposes described in this policy.

Retention periods depend on:

• The nature of the information;
• The reason it was collected;
• Contractual requirements;
• Tax, accounting and regulatory obligations;
• Fraud-prevention needs;
• Applicable limitation periods;
• The need to establish, exercise or defend legal claims.

Order and transaction records may be retained for up to six years after the end of the relevant financial or contractual period, or for a longer period where legally required.

Marketing information is kept until you unsubscribe, withdraw consent or object, subject to retaining limited suppression information to ensure that your preference is respected.

Customer-service and complaint records may be retained for as long as reasonably necessary to resolve the matter and protect legal rights.

Information that is no longer required will be deleted, anonymised or securely destroyed where reasonably practicable.

11. Data Security

We use reasonable technical and organisational measures designed to protect personal information against:

• Unauthorised access;
• Accidental loss;
• Destruction;
• Alteration;
• Misuse;
• Unlawful disclosure.

These measures may include access controls, authentication, encryption, secure payment processing, staff or contractor restrictions and security monitoring.

No method of internet transmission or electronic storage is completely secure. We therefore cannot guarantee absolute security.

You are responsible for keeping account credentials confidential and notifying us if you suspect unauthorised access.

12. Your Data Protection Rights

Subject to applicable law and any relevant exemptions, you may have the right to:

• Request access to your personal information;
• Request correction of inaccurate or incomplete information;
• Request deletion of personal information;
• Request restriction of processing;
• Object to processing based on legitimate interests;
• Object to direct marketing;
• Request transfer of information in a structured, commonly used and machine-readable format;
• Withdraw consent;
• Ask about safeguards used for international transfers;
• Challenge certain decisions made solely by automated means;
• Complain to the Information Commissioner’s Office.

These rights are not absolute and may depend on the circumstances.

To exercise a right, contact contact@shoptogetheralways.com

We may request information necessary to confirm your identity and protect personal information from unauthorised disclosure.

We will respond within the period required by applicable law. In most cases, this is within one month, although the period may be extended for complex or multiple requests where the law permits.

13. Automated Decision-Making and Fraud Prevention

Payment providers, Shopify or fraud-prevention partners may use automated systems to assess transactions for potential fraud, misuse or security risks.

These systems may consider information such as:

• Transaction value;
• Delivery and billing details;
• Device information;
• Location;
• Order history;
• Payment-verification results;
• Unusual purchasing behaviour.

A transaction may be delayed, declined or referred for manual review where it is identified as potentially high risk.

Where applicable, you may contact us to request information or human review.

14. Children’s Information

The store is not intended for children who do not have legal capacity to enter into a purchase contract.

We do not knowingly collect personal information directly from children for marketing purposes.

If you believe that a child has provided personal information without appropriate authority, contact us so that we can review and, where appropriate, delete it.

15. Third-Party Websites

The store may contain links to third-party websites, social-media platforms or services.

Together Always is not responsible for the privacy, security or content practices of third parties. You should review their privacy policies before providing personal information.

16. Changes to This Privacy Policy

Together Always may update this Privacy Policy to reflect:

• Changes to our practices;
• New services or technology;
• Legal or regulatory developments;
• Operational or security requirements.

The updated version will be published on the store with a revised “Last updated” date.

Where a material change requires notice or consent, we will take appropriate steps.

17. Complaints

Please contact us first if you have a concern about how personal information has been handled.

You also have the right to complain to the UK Information Commissioner’s Office.

Your right to complain to a regulator is not affected by contacting Together Always first.

Contact

For privacy questions, requests or complaints, contact Together Always at:

contact@shoptogetheralways.com