Privacy Policy

Maria's ("we", "us", "our") is committed to protecting your privacy. This policy explains what personal data we collect, why we collect it, and what rights you have over it, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Maria's is the data controller responsible for your personal data. You can contact us at:
Email: hello@itsmaria.shop

2. What Personal Data We Collect

When you visit our site, place an order, or contact us, we may collect:

• Contact details: name, email address, delivery/billing address, phone number
• Order details: items purchased, order value, order history
• Payment information: processed securely by our payment provider(s) — we do not store your full card details
• Technical data: IP address, browser type, device information, pages visited (via cookies and similar technologies)
• Marketing preferences: whether you've opted in to receive marketing emails

3. How We Use Your Data

We use your personal data to:

• Process and fulfil your orders, including shipping and customer service
• Communicate with you about your order (confirmations, shipping updates, refund status)
• Send marketing communications, where you've opted in — you can unsubscribe at any time
• Improve our website and product offering
• Comply with our legal and tax obligations
• Prevent fraud and protect the security of our website

4. Legal Basis for Processing

We rely on the following legal bases under UK GDPR:

• Contract — processing necessary to fulfil your order
• Consent — for marketing communications, which you can withdraw at any time
• Legitimate interests — for fraud prevention, website analytics, and improving our service
• Legal obligation — for tax, accounting, and other regulatory requirements

5. Who We Share Your Data With

We share personal data with third parties who help us run our business, including:

• Shopify (our e-commerce platform provider)
• Payment processors (e.g. Shopify Payments, PayPal)
• Delivery couriers, to fulfil your order
• Email marketing providers, if you've opted in to marketing
• Analytics providers, to help us understand website usage

We do not sell your personal data to third parties.

6. International Data Transfers

Some of our service providers (such as Shopify) may store or process data outside the UK. Where this happens, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or equivalent UK-approved transfer mechanisms.

7. How Long We Keep Your Data

We retain your personal data for as long as necessary to fulfil the purposes outlined in this policy, including to meet legal, accounting, or reporting requirements.

8. Cookies

We use cookies and similar technologies to operate our website, remember your preferences, and understand how visitors use our site. You can control cookies through your browser settings.

9. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten"), subject to legal exceptions
• Object to or restrict certain processing
• Request a copy of your data in a portable format
• Withdraw consent to marketing at any time

To exercise any of these rights, contact us at hello@itsmaria.shop. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been mishandled.

10. Children's Privacy

Our website and products are not intended for children, and we do not knowingly collect personal data from anyone under 18.

11. Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with an updated "last updated" date.

12. Contact Us

If you have any questions about this policy or how we handle your data, contact us at hello@itsmaria.shop.