1. Introduction
This Privacy Policy describes how puffscrub (“we”, “us”, or “our”), operating the website www.puffscrub.com, collects, uses, processes, and protects the personal data of users and customers (“you”) accessing our website or purchasing our products within the European Economic Area (EEA), the United Kingdom, and internationally.
We act as the Data Controller responsible for your personal data. We are committed to processing personal data in full compliance with the General Data Protection Regulation (GDPR), the UK GDPR, and applicable local data protection laws.
2. Information We Collect
We collect personal information that you provide to us directly or that is generated automatically when you interact with our website:
Contact and Account Data: Name, email address, delivery address, billing address, and contact preferences.
Order and Transaction Data: Details about products ordered, transaction history, and associated customer service communications.
Technical and Usage Data: IP address, browser type, device details, operating system, network connection, and usage statistics collected via functional cookies and tracking technologies.
3. Lawful Basis and Purposes of Processing
We process personal data under the following legal bases:
Performance of a Contract: To process, fulfill, and deliver orders, and to provide customer support regarding purchases.
Compliance with Legal Obligations: To maintain accounting and financial records, fulfill tax reporting requirements, and comply with regulatory inquiries.
Legitimate Interests: To maintain website stability and security, improve site functionality, prevent fraud, and handle administrative matters, provided these interests do not override your fundamental data rights.
Consent: Where required by law, such as for the placement of non-essential cookies or specific electronic marketing messages. Consent may be withdrawn at any time.
4. Payment Processing
All payments made on www.puffscrub.com are processed securely through our third-party payment infrastructure partner, Stripe.
When you place an order, your payment credentials and transaction details are transmitted directly to Stripe. We do not store, process, or have direct access to your full credit card numbers, CVV codes, or sensitive payment credentials on our servers.
Stripe handles personal data in accordance with strict international standards, including PCI-DSS compliance, and acts as an independent or joint data controller regarding payment verification, risk assessment, and financial compliance. Data transferred to Stripe is processed in accordance with Stripe’s privacy policies and applicable global privacy laws.
5. Data Sharing and Third-Party Transfers
We do not sell, rent, or trade personal data. Data is shared exclusively with service providers operating on our behalf under strict confidentiality agreements and data processing terms:
Payment Processors: Stripe (for card and transaction handling).
Logistics Providers: Third-party carrier services necessary to package and transport purchased items to your designated delivery address.
Technical Infrastructure: Hosting, database maintenance, and communication tools.
Where personal data is transferred outside the European Economic Area (EEA) or the UK, such transfers are safeguarded using Standard Contractual Clauses approved by the European Commission or equivalent UK transfer mechanisms to ensure standard data protections apply.
6. Data Retention Period
Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, or to comply with statutory legal obligations:
Transaction and Accounting Records: Retained for up to seven (7) years following completion of an order to comply with statutory tax, commercial, and financial record-keeping laws.
Customer Inquiries: Retained for up to two (2) years from the date of resolution to ensure consistent service and handle potential follow-up requests.
Technical Logs and Analytical Data: Retained for up to twelve (12) months unless extended retention is necessary for technical security audits.
Upon expiry of the applicable retention periods, personal data is either permanently deleted or securely anonymised.
7. Data Rights
Under applicable European and UK data protection laws, you possess the following rights regarding your personal data:
Access: The right to request copies of your personal data processed by us.
Rectification: The right to request correction of inaccurate or incomplete personal data.
Erasure (“Right to be Forgotten”): The right to request deletion of personal data, subject to legal retention obligations.
Restriction: The right to request restriction of processing under specific legal conditions.
Data Portability: The right to receive personal data provided to us in a structured, commonly used machine-readable format.
Objection: The right to object to processing based on legitimate interests.
To exercise any of these rights, please contact us at cleaner@puffscrub.com. You also retain the right to lodge a formal complaint with a national Data Protection Authority within the EU/EEA or the UK Information Commissioner’s Office (ICO).
8. Data Security Measures
We implement appropriate technical and organizational measures—including encryption protocols, access controls, and secure socket layer (SSL) transmission—designed to safeguard personal data against unauthorized access, loss, disclosure, or alteration. While we employ standard industry safeguards, electronic transmission and storage methods cannot guarantee absolute protection against all external security breaches.
9. Contact Information
For questions regarding this Privacy Policy or to exercise data privacy rights, please contact:
Brand Name: puffscrub
Website: www.puffscrub.com
Contact Email: cleaner@puffscrub.com