Privacy policy

Privacy Policy

Who we are

We are Mornings & Tails, a sole proprietorship registered with the Dutch Chamber of Commerce (KvK) under number 91340438, with VAT number NL004886473B64. You can find us at morningsandtails.com. We are the controller responsible for processing your personal data as described in this privacy policy.

What data we process

Depending on how you use our store, we process the following data:

Name, delivery address and billing address
Email address and phone number
Order details: what you bought, when, and for what amount
Payment details: which payment method you used and whether the payment succeeded. We never receive your full card details; these stay with the payment provider.
Account details if you create an account, including your subscription
Messages you send to our customer service
Technical data such as IP address, browser type and device information
Data about how you use our store, collected via Shopify and, with your consent, the Meta pixel

Why we use your data and on what legal basis

We only process your data when we have a legal basis to do so under the General Data Protection Regulation (GDPR) and, for customers in the United Kingdom, the UK GDPR.

Performance of a contract: to process, deliver and update you about your order, to handle returns and withdrawals, and to manage your account and subscription.
Legal obligation: we keep order and invoice data for seven years to meet our tax record-keeping obligations.
Legitimate interest: to prevent fraud and to respond when you contact us about your order.
Consent: we only send you newsletters or marketing emails, and only place marketing cookies and the Meta pixel, if you have given your consent. You can withdraw your consent at any time.

Who we share your data with

We only share your data with parties we need to run our store:

Shopify, our e-commerce platform, which processes your order and account data on our behalf under a data processing agreement.
Payment providers for card payments, PayPal, Klarna, Apple Pay and Google Pay. They process your payment data on our behalf and are also independently responsible for their own processing, such as fraud checks.
Delivery companies, including Relay and Royal Mail, which receive your name and delivery address to deliver your parcel. They are independently responsible for their own processing.
Our supplier and fulfilment partner. Because some orders are shipped directly by our supplier, they receive your name and delivery address and nothing more than is needed for delivery.
Meta, which measures the effectiveness of our advertising through the Meta pixel when you have given consent. For this measurement, Meta and we are joint controllers.
Our email service provider, which sends order emails and, with your consent, marketing emails on our behalf.

We have data processing agreements in place with all processors as required by law. We never sell your data and never share it with parties that have no role in serving you.

International transfers

Some of the services we use, such as Shopify and Meta, may transfer data to countries outside the United Kingdom and the European Economic Area, in particular the United States. Our supplier is also located outside the EU. When data is transferred, we rely on an adequacy decision for the country concerned or on the standard contractual clauses approved by the European Commission, together with the UK International Data Transfer Addendum where applicable.

How long we keep your data

Order and invoice data: 7 years, to meet our tax record-keeping obligations.
Account and subscription data: for as long as your account exists. After you close your account, we delete or anonymise this data unless we are legally required to keep it.
Customer service messages: for as long as needed to handle your question or complaint, and then no longer than 2 years.
Data collected through the Meta pixel: in line with the cookie lifetimes set out in our Cookie Policy.
Data relating to a return or dispute: for as long as needed to resolve the matter and any related legal claims.

Cookies

We use functional cookies that are needed for our store to work and to process your order. With your consent, we also use the Meta pixel, which places marketing and tracking cookies. You can read all the details in our Cookie Policy.

Security

We take appropriate technical and organisational measures to protect your data, including:

A secure (SSL) connection on our store
Access to personal data only for people who need it
Data processing agreements with the parties that process data for us
Working only with reliable processors

Your rights

You have the following rights:

Access: to see what data we hold about you
Rectification: to have incorrect data corrected
Erasure: to have your data deleted, except where we are legally required to keep it, such as order data for tax purposes
Restriction: to have the processing of your data temporarily restricted
Portability: to receive your data in a common format or have it transferred
Objection: to object to certain processing, such as processing based on legitimate interest
Withdrawal of consent: for example for newsletters or marketing cookies, at any time and without giving a reason

Send your request via the contact page on morningsandtails.com. We respond within one month. To prevent misuse, we may ask you to verify your identity.

Complaints

If you are not happy with how we handle your data, please contact us first so we can resolve it together. You also have the right to complain to a supervisory authority: in the United Kingdom, the Information Commissioner’s Office (ICO); in the Netherlands, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens); or the data protection authority in the EU country where you live.

Changes

We may update this privacy policy, for example when our tools or the law change. The latest version is always available on morningsandtails.com. We will inform you of any significant changes.