Privacy policy

 

This Privacy Policy explains how personal information is used when you visit or buy from didb.shop, contact us, use an account, subscribe to communications or otherwise interact with the shop. It is intended to reflect the UK GDPR, Data Protection Act 2018, Privacy and Electronic Communications Regulations 2003 and the Data (Use and Access) Act 2025.

1. Controller and contact

The controller is the legal operator trading as DIDB. Privacy requests and complaints may be sent to info@didb.shop. The controller’s full legal name and geographical business address must be added before publication because they were not supplied and cannot safely be inferred from the domain.

2. Information we collect

  • Identity and contact information: name, billing and delivery addresses, email address, telephone number where supplied, and account details.
  • Order and transaction information: products, order value, currency, discounts, payment status, delivery, returns, refunds and communications. Payment providers normally process full card or bank credentials.
  • Technical and usage information: IP address, device and browser data, timestamps, security logs, pages viewed, referring information, language and approximate location.
  • Preference and marketing information: subscriptions, consent choices, campaign interaction and suppression records.
  • Support content: messages, attachments, reviews and other information voluntarily provided.

Information is collected directly from you, automatically from devices, and from providers involved in payments, fraud prevention, hosting, analytics, delivery and support.

3. Purposes and lawful bases

  • Contract: checkout, payment, order confirmation, fulfilment, delivery, returns and requested support.
  • Legal obligation: tax and accounting records, product-safety duties, consumer documentation and lawful authority requests.
  • Legitimate interests: securing the shop, preventing fraud, managing claims, improving operations, keeping proportionate records and defending legal rights after balancing individual interests.
  • Consent: non-exempt storage or access technologies and electronic marketing where consent is required. Consent may be withdrawn without affecting earlier lawful processing.

Where information is necessary to enter into or perform a contract, failure to provide it may prevent checkout, payment or delivery.

4. Cookies and storage or access technologies

We may use technologies necessary to provide requested services, maintain a basket, secure checkout, authenticate users and remember privacy choices. UK law also permits specified limited uses without consent where a statutory exemption applies, including certain low-risk statistical or functionality purposes subject to their legal conditions and appropriate transparency or choice. For advertising, cross-site tracking and other non-exempt purposes, we obtain consent before access or storage. Settings should make withdrawal or refusal straightforward.

5. Direct marketing

We send electronic marketing only where PECR and data-protection law permit it, such as with valid consent or the limited existing-customer exception where all conditions are met. Every marketing message includes a clear opt-out. An objection to direct marketing is honoured and a minimal suppression record may be retained to prevent further sends.

6. Recipients

Information may be shared as necessary with the commerce platform, payment providers, banks, fraud-prevention services, fulfilment partners, warehouses, carriers, customer-support and IT providers, professional advisers, analytics or advertising providers used lawfully, and public authorities. Processors are contractually restricted. Some recipients, particularly payment providers, may act as independent controllers.

7. International transfers

Where information is transferred outside the United Kingdom, we use a lawful mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another permitted safeguard, with supplementary measures where necessary. Details of relevant safeguards may be requested.

8. Retention

Information is kept only as long as needed for fulfilment, support, security, legal claims and statutory records. Order, invoice and tax data may be retained for UK accounting and tax periods. Account information is kept while active and for a proportionate period afterwards. Marketing information is kept until opt-out or withdrawal, subject to suppression records. Data is then deleted or anonymised unless continued retention is legally required.

9. Your rights

Subject to legal conditions and exemptions, you may request access, correction, erasure, restriction and portability of personal information. You may object to direct marketing at any time and may object to processing based on legitimate interests in relevant circumstances. You may withdraw consent at any time. You may also complain to the Information Commissioner’s Office at ico.org.uk.

Send a rights request or data-protection complaint to info@didb.shop. We may request proportionate proof of identity. Requests are handled without undue delay, and access requests are answered within the applicable statutory period. We will acknowledge and investigate data-protection complaints and provide the electronic route required by current UK law.

10. Automated decisions, children and security

We do not make solely automated decisions producing legal or similarly significant effects unless disclosed and permitted by law. The shop is not directed to children. If the service is likely to be accessed by children, their needs and the Age Appropriate Design Code will be taken into account. Appropriate technical and organisational safeguards are used, although no system is completely secure.

11. Changes

We may update this policy for legal, technical or operational changes. The current version and revision date remain available on the shop, and material changes will be communicated where required.