Privacy policy
How Duck & Pippin collects, uses and protects your personal data when you visit our shop or buy from us.
Who we are
Duck & Pippin is run by [TO FILL: legal company name], [TO FILL: registered address], company registration number [TO FILL: company registration number]. We are the controller of your personal data. For anything about privacy, write to hey@duckandpippin.com.
What we collect
- Order details: your name, delivery and billing address, email, phone number and what you bought.
- Payment details: handled by our payment providers. We never see or store your full card number.
- Your messages: emails and contact forms, including any photos you send us.
- Newsletter, welcome gifts and the birthday club: your email and, only if you tell us, your child's age range, interests, first name and birthday (day and month).
- Reviews: your name, country and review when you review an order on Trustpilot.
- Device and usage data: IP address, browser, pages viewed and cookies, as explained in our cookie policy.
Why we use it, and our legal basis
| What we do | Legal basis |
|---|---|
| Process and deliver your order, answer your questions | Contract |
| Keep bookkeeping, tax and product safety records | Legal obligation |
| Prevent fraud and keep the shop secure | Legitimate interests |
| Ask you to review your order after delivery | Legitimate interests, you can opt out any time |
| Send the newsletter, welcome gifts and birthday emails | Consent |
| Analytics and marketing cookies, including ad pixels | Consent |
Your child's data
Our shop is for adults buying for children. We do not knowingly collect data directly from children. If you join the birthday club, you give us your child's first name and birthday (day and month, never the year) so we can send you a birthday email. You can remove these details at any time.
Who we share it with
We share only what each partner needs to do their job:
- Shopify, the platform our shop runs on.
- Our payment providers, which you choose at checkout.
- Our suppliers and fulfilment partners, who pack and send your order, and carriers such as YunExpress and the delivery companies in your country.
- Our email service provider, for newsletters, only if you signed up.
- Trustpilot, to invite you to review your order.
- Meta, TikTok and Google, only if you accept marketing cookies.
- Authorities, when the law requires it.
We never sell your personal data.
Transfers outside the EU and EEA
Some partners process data outside the EU and EEA, for example our suppliers and their shipping partners, who pack and send your order, and some service providers in the USA. We protect these transfers with the European Commission's standard contractual clauses or an adequacy decision.
How long we keep it
- Order and invoice records: for as long as bookkeeping and tax law requires.
- Customer service messages: 2 years after your last contact.
- Newsletter and birthday club details: until you unsubscribe or ask us to delete them.
- Cookies: as listed in our cookie policy.
Your rights
You can ask to see, correct, delete or move your data, object to how we use it, restrict it, and withdraw any consent at any time. Write to hey@duckandpippin.com and we reply within one month.
You can also complain to the data protection authority where you live or work, or where you think the problem happened. In Sweden that is the Swedish Authority for Privacy Protection (imy.se), in Norway Datatilsynet (datatilsynet.no), in Germany the data protection authority of your federal state (listed at bfdi.bund.de) and in the United Kingdom the Information Commissioner's Office (ico.org.uk).
Security
Payments are encrypted and handled by our payment providers. Only the people who need customer data to do their work can access it.
Changes to this policy
If we change this policy, we publish the new version on this page. If the change is important, we also tell you by email.
