Privacy policy

This Privacy Policy explains how punkoutfit.shop collects, uses, stores, shares and otherwise processes personal information when individuals visit our website, communicate with us, create or use an account, place an order or otherwise interact with our online store.

For privacy-related enquiries, contact:

Email: info@punkoutfit.shop

This policy is intended to operate consistently with applicable UK data-protection and electronic-communications legislation, including the UK GDPR, Data Protection Act 2018 and Privacy and Electronic Communications Regulations 2003, as amended.

The Data (Use and Access) Act 2025 has also amended aspects of the UK's data-protection framework. The Information Commissioner's Office confirmed on 19 June 2026 that all of the Act's data-protection provisions were in force.

Our Role

For personal information that punkoutfit.shop determines how and why to process in connection with our ecommerce activities, punkoutfit.shop acts as the relevant data controller to the extent required by applicable law.

We may use Shopify and other service providers to process information on our behalf or provide technical, payment, fulfilment, analytics, security, communication and related services.

Shopify explains that, for merchant stores, it processes certain customer information on behalf of merchants and that merchants make relevant decisions concerning how customer information is used for their stores.

Personal Information We May Collect

Depending on how you interact with punkoutfit.shop, personal information may include:

Contact and Identity Information

This may include:

• Name;
• Email address;
• Telephone number;
• Billing information;
• Shipping and delivery information; and
• Information voluntarily supplied when communicating with us.

Order and Transaction Information

We may process information concerning:

• Products ordered;
• Order value;
• Transaction date;
• Delivery status;
• Returns;
• Refunds;
• Discounts;
• Customer-service history; and
• Related purchase information.

Payment Information

Payments may be handled through Shopify-compatible payment processors and other payment-service providers.

We may receive transaction status, payment method information, billing details or other limited information necessary to administer an order.

Payment-card data may be collected and processed directly by applicable payment providers rather than stored by us in complete form.

Device and Technical Information

When you use our website, information may automatically be generated or collected, including:

• IP address;
• Browser type;
• Operating system;
• Device information;
• Language settings;
• Time zone;
• Website interaction data;
• Referring pages;
• Pages viewed;
• Session information;
• Approximate location inferred from technical information; and
• Security and diagnostic data.

Customer-Service Communications

If you contact us, we may process the contents of your enquiry and information associated with the communication so that we can respond, maintain appropriate records and resolve issues.

Marketing Information

Where permitted by law, we may process information concerning marketing preferences, subscriptions, engagement with marketing communications and whether consent has been provided or withdrawn.

How We Use Personal Information

We may process personal information for purposes including:

• Operating and maintaining punkoutfit.shop;
• Displaying products and website functionality;
• Processing and confirming orders;
• Processing payments;
• Arranging fulfilment and delivery;
• Providing tracking and delivery information;
• Managing returns, refunds and cancellations;
• Responding to customer-service enquiries;
• Maintaining customer accounts where available;
• Detecting, investigating and preventing fraud;
• Protecting the security of our website and customers;
• Maintaining business, accounting and transaction records;
• Complying with tax, consumer, regulatory and legal obligations;
• Establishing, exercising or defending legal claims;
• Improving website performance and customer experience;
• Understanding website use and performance;
• Administering promotions where applicable;
• Sending service-related communications;
• Sending marketing communications where lawful; and
• Managing consent and privacy preferences.

Lawful Bases for Processing

Under applicable UK data-protection law, processing must have an appropriate lawful basis.

Depending on the circumstances, we may rely on:

Contract

We may process personal information when it is necessary to perform a contract with you or take steps at your request before entering into a contract.

For example, we need certain information to process an order, receive payment and arrange delivery.

Legal Obligation

We may process information where necessary to comply with legal requirements, such as accounting, tax, consumer-protection, regulatory or record-keeping obligations.

Legitimate Interests

We may process information where necessary for legitimate business interests and where those interests are not overridden by your rights and interests.

Examples may include maintaining security, preventing fraud, improving our services, administering our business and protecting legal rights.

Consent

Where consent is required, including for certain marketing or storage/access technologies, we may rely on consent.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not make processing carried out before withdrawal unlawful.

Cookies and Similar Technologies

Our website may use cookies, pixels, local storage, scripts and other storage or access technologies for purposes such as:

• Essential website functionality;
• Maintaining shopping-cart functionality;
• Authentication;
• Security and fraud prevention;
• Remembering user preferences;
• Measuring website performance;
• Analytics; and
• Advertising or marketing where permitted.

The UK's PECR framework regulates cookies and other technologies that store information on or access information from a user's device.

The ICO's April 2026 guidance covers cookies, tracking pixels, device fingerprinting and related storage/access technologies, incorporating changes introduced by the Data (Use and Access) Act 2025.

Where consent is legally required, relevant non-essential technologies should not be used until the necessary consent has been obtained.

Where a statutory exception applies, consent may not be required, subject to the conditions of that exception.

Users can use available cookie controls and browser settings to manage certain technologies, although disabling essential technologies may affect website functionality.

Marketing Communications

Where legally permitted, we may send marketing communications regarding products, services, promotions or other store information.

We will seek consent where applicable law requires consent.

You may unsubscribe from electronic marketing by using an unsubscribe mechanism included in the communication or by contacting:

info@punkoutfit.shop

Unsubscribing from marketing does not prevent us from sending necessary transactional or service communications concerning an order or account.

Sharing Personal Information

We do not disclose personal information indiscriminately.

We may share information where reasonably necessary with service providers and other recipients such as:

• Shopify and ecommerce infrastructure providers;
• Payment processors;
• Fraud-prevention and security providers;
• Fulfilment providers;
• Warehousing providers;
• Delivery and logistics companies;
• Customer-service technology providers;
• Email and communications providers;
• Analytics providers;
• Professional advisers;
• Accounting and tax service providers;
• Government authorities, regulators or law-enforcement bodies where legally required; and
• Parties involved in a legitimate business reorganisation, acquisition, financing, sale or transfer, subject to applicable safeguards.

Recipients are expected to process information according to applicable legal and contractual requirements.

Shopify

Our store may be hosted using Shopify ecommerce infrastructure.

Shopify may process customer and visitor information in connection with providing its technology and services to merchants.

The precise processing depends on the Shopify features, applications, payment methods and other services enabled on the store.

Customers may also be subject to Shopify's own privacy terms when separately using Shopify-controlled products or services such as Shop or Shop Pay.

International Transfers

Some service providers may process personal information outside the United Kingdom.

Where UK data-protection law requires safeguards for an international transfer, we seek to rely on a lawful transfer mechanism.

Depending on the destination and circumstances, this may include:

• A UK adequacy regulation;
• Approved contractual safeguards;
• The UK International Data Transfer Agreement;
• An approved UK Addendum to relevant contractual clauses; or
• Another lawful transfer mechanism or applicable derogation.

Additional safeguards may be applied where reasonably necessary.

Data Retention

We retain personal information for no longer than reasonably necessary for the purposes for which it was collected and for legitimate legal, regulatory, accounting, security and dispute-resolution requirements.

Retention periods may vary according to:

• The nature of the information;
• The reason it was collected;
• Whether an active customer relationship exists;
• Applicable limitation periods;
• Accounting and tax obligations;
• Fraud and security requirements; and
• Legal or regulatory obligations.

When information is no longer reasonably required, it may be deleted, anonymised or otherwise securely disposed of according to applicable requirements.

Data Security

We use reasonable administrative, technical and organisational measures designed to protect personal information against accidental or unlawful loss, destruction, alteration, disclosure or access.

However, no internet transmission, electronic storage system or website can be guaranteed to be completely secure.

Customers should also take reasonable precautions to protect their account credentials and devices.

If you believe your interaction with punkoutfit.shop has been affected by a security issue, contact:

info@punkoutfit.shop

Your UK Data-Protection Rights

Subject to applicable legal conditions and exceptions, individuals may have rights including:

• The right to be informed about processing;
• The right to request access to personal information;
• The right to request correction of inaccurate information;
• The right to request erasure in qualifying circumstances;
• The right to request restriction of processing;
• The right to object to certain processing;
• The right to data portability where applicable;
• Rights concerning certain automated decision-making;
• The right to withdraw consent where consent is relied upon; and
• The right to complain to the Information Commissioner's Office.

These rights are not absolute and may depend on the circumstances and lawful basis for processing.

Exercising Your Rights

Privacy requests may be sent to:

info@punkoutfit.shop

We may request information reasonably necessary to verify your identity before responding to a request.

This helps prevent personal information from being disclosed or altered in response to an unauthorised request.

We will respond within the period required by applicable law.

Children

punkoutfit.shop is intended for ordinary ecommerce customers and is not designed for the deliberate collection of personal information from children in circumstances requiring parental authorisation.

If we become aware that personal information has been collected inappropriately from a child, we may take reasonable steps to delete or otherwise address the information.

Automated Processing and Fraud Prevention

We or our service providers may use automated systems to identify potentially fraudulent, abusive or suspicious transactions.

This may involve analysing order, payment, account, device or transaction information.

Where applicable data-protection law provides specific rights concerning solely automated decisions that produce legal or similarly significant effects, those rights remain unaffected.

Legal Disclosure

We may disclose personal information where reasonably necessary to:

• Comply with a legal obligation;
• Respond to a valid legal process;
• Protect legal rights;
• Prevent or investigate fraud;
• Protect customers or others; or
• Establish, exercise or defend legal claims.

Business Transfers

If all or part of our business is reorganised, financed, merged, sold, transferred or acquired, relevant personal information may be transferred as part of that transaction where legally permitted.

Any recipient will be required to handle personal information consistently with applicable data-protection requirements.

Third-Party Websites

Our website may contain links to websites, applications or services operated independently by third parties.

We do not control the privacy practices of independent third parties.

Customers should review the privacy information provided by those third parties before supplying personal information.

Changes to This Privacy Policy

We may update this Privacy Policy when necessary to reflect:

• Changes to our operations;
• Changes to website functionality;
• New service providers;
• Changes to applicable law;
• Regulatory guidance; or
• Other relevant developments.

The updated version will be published with a revised “Last Updated” date where appropriate.

Complaints

If you have concerns about our use of your personal information, please contact us first so that we can review the issue.

Email: info@punkoutfit.shop

You may also have the right to make a complaint to the Information Commissioner's Office (ICO).

Contact

For privacy questions or requests:

punkoutfit.shop
Email: info@punkoutfit.shop