PRIVACY
POLICY.

Bones The Label is operated by Cyber Catalyst Ltd, a company registered in England and Wales.

We are registered with the Information Commissioner's Office (ICO).

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website, place an order, or interact with our brand.

We collect personal data in the following circumstances:

• When you place an order — name, email address, delivery address, phone number, and payment information (processed securely by Shopify Payments)
• When you create a Bones account — name, email address, and account preferences
• When you contact us — your name, email, and the content of your message
• When you sign up to our mailing list — your email address
• Automatically when you browse our site — IP address, browser type, pages visited, and device information via cookies and analytics tools

We do not collect payment card details directly. All payment processing is handled by Shopify Payments, which is PCI DSS compliant.

We use your personal data for the following purposes:

• Processing and fulfilling your orders, including sending dispatch and tracking information
• Managing your Bones account, including your points balance, tokens, collectables, and access records
• Communicating with you about your orders, account, or enquiries
• Sending marketing emails if you have opted in - you can unsubscribe at any time
• Improving our website and understanding how customers use it
• Complying with our legal obligations

Our legal basis for processing your data is: contract performance (for order fulfilment), legitimate interests (for improving our service), consent (for marketing), and legal obligation (for compliance).

We share your personal data with third parties only where necessary to operate our business. These include:

• Shopify — our e-commerce platform, which processes your orders and stores your account data
• Resend — transactional email service used to deliver order and account communications
• Meta (Facebook/Instagram) — we use the Facebook Pixel to measure the effectiveness of our advertising. This may involve sharing limited data about your visit to our site
• Google Analytics — we use Google Analytics to understand how visitors use our site. This data is anonymised and aggregated
• TikTok — we may use TikTok Pixel for advertising measurement purposes

We do not sell your personal data to any third party.

Our website uses cookies — small text files stored on your device. We use the following types:

• Essential cookies — required for the site to function, including your shopping cart and account session
• Analytics cookies — used by Google Analytics to understand site usage. These are anonymised
• Marketing cookies — used by Facebook Pixel and TikTok Pixel to measure ad performance

When you first visit our site, you will be asked to consent to non-essential cookies. You can update your preferences at any time via the cookie settings link in our footer.

You can also control cookies through your browser settings. Disabling cookies may affect the functionality of the site.

We retain your personal data for as long as necessary to provide our services and comply with legal obligations:

• Order data — 7 years, in line with HMRC requirements
• Account data — for the duration your account is active, plus 2 years after your last purchase
• Marketing data — until you unsubscribe or request deletion
• Contact enquiry data — 2 years

Under UK GDPR, you have the following rights regarding your personal data:

• Right to access — request a copy of the data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your data, subject to legal obligations
• Right to restriction — request that we limit how we use your data
• Right to portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing

To exercise any of these rights, contact us at bonesthelabel@outlook.com. We will respond within 30 days.

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the ICO at ico.org.uk or by calling 0303 123 1113.

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. Our site uses HTTPS encryption and our e-commerce platform (Shopify) is PCI DSS compliant.

No method of transmission over the internet is completely secure. While we take every reasonable precaution, we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. The date at the top of this page indicates when it was last revised. Continued use of our site after any changes constitutes acceptance of the updated policy.

For significant changes, we will notify you by email if you have an account with us.