Privacy Notice

In short: we collect only what we need to answer your enquiry and send your order, we do not sell your data, and you can ask us to delete it at any time by emailing shamisoandco@gmail.com.

Who is responsible for your data

SHAMISO is a UK business selling scalp and hair oil. We are the data controller for the information described here. For any privacy question or request, email shamisoandco@gmail.com.

What we collect

Enquiry and order details: your name, email address, the town or postcode area you give us for delivery, the quantity you ask for, and anything you write in the message box.
Order and payment information: what you ordered and when. We do not store card details on this website. Payment is taken through a third party payment provider.
Technical data: standard server logs from our hosting provider (IP address, browser type, pages requested) kept for security and to keep the site working.

What we use it for, and our lawful basis

To answer your enquiry or supply your order: necessary to perform a contract with you, or to take steps before a contract.
To keep records of orders, enquiries and complaints: our legitimate interest in running the business and meeting our legal obligations.
To keep the site secure and working: legitimate interest in preventing abuse and fraud.
To send you marketing: only if you have opted in, and you can unsubscribe at any time. Consent is the lawful basis.

Who else sees your data

We use a small number of processors to run the business: our website host and CDN, our email provider, and our payment provider. They act on our instructions and only for the purposes above. Some of them may process data outside the UK, in which case the transfer is covered by an approved safeguard such as the UK International Data Transfer Addendum or standard contractual clauses. We do not sell or rent your data to anyone.

How long we keep it

Enquiries we keep for up to 24 months so we can pick up a conversation where it left off. Order records we keep for six years, which is how long we need to keep financial records. Marketing consent records we keep until you withdraw consent. Server logs are kept for a short period and then deleted.

Your rights

Under UK GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing based on legitimate interests, ask us to restrict processing, and ask for your data in a portable format. Email shamisoandco@gmail.com and we will respond within one month. If you are unhappy with how we have handled it you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Cookies

See our cookie notice for what the site stores in your browser.

Children

This site is not intended for children under 13 and we do not knowingly collect their data.

Changes

If we change this notice we will update the date at the top of the page.