Privacy policy

Who we are

Matthew Garnett, trading as Giddy Pets (“we”, “us”, “our”) operates this website and is the data controller for the personal data described here. We're a UK sole trader at 3 South Street, Ramsbottom, Bury BL0 0AJ, United Kingdom. You can reach us about anything in this policy at hello@giddypets.co.uk.

ICO data-protection registration: [[CONFIRM: ICO registration number, or confirm the business is exempt]].

What we collect

• • Order details — your name, email, delivery address and what you bought, so we can fulfil and support your order.
• • Payment information — handled directly by our payment processor. We never see or store your full card details.
• • Account information — if you choose to create an account, your email and saved details.
• • Email sign-ups — the email address you give us for pet-care tips and offers, until you unsubscribe.
• • Usage and device data — pages viewed, what you clicked, where you arrived from, plus your IP address, browser and device type. Collected by our analytics and advertising tools, named below.
• • Advertising identifiers — if you accept cookies, Google and Meta set identifiers that let us measure which ads and guides lead to orders, and let Meta show you our ads elsewhere. If you accepted and then complete an order, we also send Meta and Google a server-side record of that purchase, in which your email, name and phone number are hashed (irreversibly scrambled) before they leave us, so the sale can be matched to the click that caused it without handing over your contact details in readable form.

Why we use it (our lawful bases)

• • To process and deliver your orders and provide support — this is necessary to perform our contract with you.
• • To send marketing emails — only with your consent, which you can withdraw at any time.
• • To run and improve the website, prevent fraud and keep our records — our legitimate interests, balanced against your rights.
• • To measure our analytics and advertising — only with your consent, given through the cookie banner and withdrawable at any time. Nothing in this category runs until you say yes.
• • To meet legal obligations, such as keeping tax and transaction records.

Who we share it with

We don't sell your data. These are the companies that process it on our behalf, what each one gets, and why:

• • Stripe (payments) — your name, email, billing details and order value, to take payment and handle refunds and fraud checks. Your full card number goes straight to Stripe and never reaches us. Lawful basis: performance of our contract with you.
• • Our suppliers, who ship your order directly — CJ Dropshipping, Simply2Pets and Sherwood Paws. They receive your name, delivery address and the items ordered, and nothing else. Lawful basis: performance of our contract with you.
• • Resend and Google Workspace (email) — your email address and the contents of order updates, replies and, if you've opted in, our newsletter. Lawful basis: contract for order emails; consent for marketing.
• • Supabase (database) — your account, order and enquiry records are stored here. Lawful basis: contract, and our legitimate interest in keeping proper records.
• • Vercel (hosting, plus Vercel Analytics) — every page request passes through Vercel, and Vercel Analytics records anonymous page-level traffic without cookies. Lawful basis: our legitimate interest in running and improving a working website.
• • Cloudflare (security and content delivery) — sits in front of the site and sees the IP address and request details of every visitor, in order to block bots and attacks. Lawful basis: our legitimate interest in keeping the site up and secure.
• • images.weserv.nl (image delivery) — product images are resized and served through this CDN, so it receives your IP address when an image loads. Lawful basis: our legitimate interest in serving a fast, low-bandwidth site.
• • Google (Google Analytics 4) — pages viewed, referrer, approximate location, device, and a cookie-based visitor identifier. Analytics stays switched off until you accept cookies. Lawful basis: your consent.
• • Meta (Facebook/Instagram — the Meta Pixel and our Conversions API gateway at tracking.giddypets.co.uk) — pages and products viewed, baskets, purchases and the identifiers Meta sets, used to measure our advertising and to show you our ads on Meta's platforms. Nothing is loaded and no request is made to Meta until you accept cookies. Lawful basis: your consent.
• • Trustpilot — our delivery-confirmation email is blind-copied to Trustpilot so they can invite you to review your order. They receive your email address and order reference. Lawful basis: our legitimate interest in collecting honest feedback from customers who have actually bought from us; you can opt out with Trustpilot at any time.
• • Google (Google Customer Reviews) — when you place an order we offer you the chance to opt in to a review survey. They receive your email address, order reference, delivery country and estimated delivery date, and email you around the time your order arrives to ask how it went. Lawful basis: your consent — the survey is opt-in and nothing is sent unless you accept it on the confirmation page.

We may also disclose data where the law requires it, or to professional advisers such as our accountant.

Several of these providers are based in, or process data in, the United States. Where that happens we rely on the UK's approved transfer mechanisms — the UK Extension to the EU–US Data Privacy Framework, or the International Data Transfer Addendum to the EU standard contractual clauses.

How long we keep it

We keep order and transaction records for as long as the law requires (generally six years for tax purposes). Marketing data is kept until you unsubscribe. Account data is kept until you ask us to close your account.

Your rights

Under UK GDPR you can ask to access, correct, delete or port your data, object to or restrict certain processing, and withdraw consent at any time. Email hello@giddypets.co.uk and we'll respond within one month. You also have the right to complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk.

Cookies & similar technologies

“Cookies” here also covers the things stored in your browser that aren't strictly cookies, such as local storage. Four kinds are used on this site:

• • Strictly necessary — your basket, your signed-in session, and the record of your cookie choice itself. These are set by us, can't be switched off, and don't need your consent.
• • Attribution — a small first-party gp_attr cookie recording how you arrived (for example “Google, organic”) so we can attach it to an order and know which of our own pages are worth writing. It stays on our servers and isn't shared.
• • Analytics — Google Analytics 4 (_ga, _ga_*). Set only if you accept. We also count page views in a way that stores nothing at all on your device and can't identify you, which is why our own traffic figures don't depend on your answer.
• • Advertising — Meta Pixel and our Conversions API gateway (_fbp, _fbc), and Google advertising cookies. Set only if you accept. Until then, your browser makes no request to Meta or to our tracking gateway at all.

Changing your mind

Your choice is stored in your browser's local storage under the key nsc_consent_v1 — not in a cookie, and never sent to us. Withdrawing is meant to be exactly as easy as agreeing was:

Change your cookie preferences

That clears your saved choice, tells Google and Meta to stop, deletes their cookies from this browser, and shows you the banner again so you can answer afresh. The same Cookie preferences link sits in the footer of every page. You can also block or delete cookies in your browser settings, though some of the strictly necessary ones are what make the basket work.