Privacy Policy
1. Introduction
Khizu (“we,” “us,” or “our”) operates the www.khizu.com e-commerce platform in full compliance with the UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018. This comprehensive Privacy Policy establishes our commitment to protecting your personal information by transparently outlining our data collection, processing, storage, and protection practices.
2. Information Collection
We systematically collect several categories of personal data to deliver and continuously enhance our services. This includes identifiable personal information such as your full name, contact details including email address and telephone number, and complete shipping/billing addresses. For transaction processing, we collect payment card details through PCI-DSS compliant payment gateways, ensuring maximum security. Our systems automatically gather technical data encompassing IP addresses, browser specifications, device characteristics, and operating system details. We maintain records of your usage patterns including pages visited, products viewed, and purchase history. Additionally, we document your explicit marketing communication preferences and consents.
3. Purpose of Data Processing
The personal data we collect serves multiple legitimate business purposes. Primarily, we process your information to efficiently complete and fulfill your orders, including payment processing and product delivery. We utilize your data to provide comprehensive customer support and effectively manage your account. Continuous improvement of our website functionality and overall user experience represents another key purpose. Your information plays a crucial role in our fraud prevention systems and security enhancement measures. Where explicit consent has been provided, we use personal data to deliver personalized marketing communications. Finally, we process data as necessary to comply with our legal and regulatory obligations.
4. Third-Party Data Sharing
We maintain strategic partnerships with carefully vetted third-party service providers to ensure seamless service delivery. For order fulfillment, we share necessary information with certified payment processors including Stripe and PayPal, reputable warehouse operators, logistics specialists, and established shipping carriers. Our marketing ecosystem includes collaborations with digital marketing agencies, advertising platforms such as Google Ads and Facebook, and analytics providers including Google Analytics. For security purposes, we may share data with fraud prevention agencies, credit reference services, and when legally compelled, with law enforcement authorities. All third-party processors are contractually bound by strict data protection obligations and undergo rigorous due diligence to ensure compliance with applicable data protection laws.
5. Legal Basis for Processing
We process personal data under multiple lawful bases as defined by UK GDPR. The primary basis is contractual necessity to fulfill orders and provide requested services. For marketing activities, we rely exclusively on obtained consent. Our legitimate business interests justify processing for fraud prevention, service improvement, and security enhancement. Certain processing activities are mandatory to comply with our legal obligations.
6. International Data Transfers
In the course of business operations, personal data may be transferred outside the UK/EEA. All such transfers are conducted with appropriate safeguards in place, including implementation of Standard Contractual Clauses approved by UK authorities, adherence to UK Adequacy Regulations where applicable, and where relevant, the application of Binding Corporate Rules for intra-organizational transfers.
7. Data Retention Policy
We adhere to strict data retention periods aligned with legal requirements and business needs. Order information is retained for six years to comply with tax and accounting regulations. Marketing data is maintained until consent is withdrawn or the data becomes obsolete. Customer service records are preserved for three years following the last interaction to ensure continuity of service and dispute resolution.
8. Your Data Protection Rights
Under UK GDPR, you possess several important rights regarding your personal data. These include the right to request access to your personal information, the right to have inaccurate data corrected, and the right to request erasure of your data under certain circumstances (commonly known as the ‘right to be forgotten’). You may object to specific processing activities, request restriction of processing in particular situations, and exercise data portability rights where applicable. Importantly, you retain the absolute right to withdraw previously given consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
9. Cookies and Tracking Technologies
Our WooCommerce platform employs a sophisticated system of cookies and tracking technologies. Essential cookies maintain session integrity, shopping cart functionality, and checkout processes. Analytics cookies, including those from Google Analytics (for which an opt-out mechanism is provided), enable us to track user behavior and monitor site performance. Marketing cookies facilitate retargeting campaigns, advertisement performance measurement, and content personalization. Cookie preferences can be managed through our comprehensive cookie consent management tool or directly through browser settings, though certain website features may be impaired by disabling essential cookies.
10. Security Framework
We implement a multi-layered security framework to protect your personal data. All data transmissions are encrypted using TLS/SSL protocols. Payment processing strictly adheres to PCI-DSS standards. Our security posture is continuously evaluated through regular audits and penetration testing. We enforce strict access controls complemented by ongoing staff training programs. The principle of data minimization guides all our processing activities.
11. External Website Links
Our digital properties may contain hyperlinks to third-party websites, each maintaining independent privacy policies. We strongly advise reviewing these external policies before disclosing any personal information, as we cannot accept responsibility for third-party data practices.
12. Policy Updates and Modifications
This Privacy Policy may be updated periodically to reflect evolving legal requirements and business practices. Substantial changes will be prominently displayed on our website with updated effective dates. Significant modifications affecting your rights will be communicated directly via email where appropriate, and may require renewed consent for certain processing activities.
13. Contact Information
For all privacy-related inquiries or to exercise your data protection rights, please contact our Data Protection Officer:
Phone: +44 7365695675
Email: support@khizu.com
