Privacy policy

This notice covers the Wolfies World website and Bad Wolf shop. The business name is The Boujie Wolf. The full data-controller identity, geographical address and privacy contact email are awaiting confirmation. These details, along with operational retention and supplier arrangements, must be finalised before this notice can be treated as complete for trading.

The Boujie Wolf appointments take place through Setmore. Shopify checkout and third-party sites provide their own privacy information for the processing they perform. This notice does not replace their notices or claim that the website controls every use they make of data.

Your shopping bag contains the chosen products, variant identifiers, quantities and prices, together with the Shopify cart identifier and checkout link. The site keeps these details in your browser's local storage so the bag can remain available between visits and sends cart requests to Shopify to manage it.

At checkout, the checkout service asks for the information needed to place and fulfil an order, such as your name, email, delivery and billing details, and payment information. What the seller receives and retains depends on the checkout and merchant arrangements. The storefront does not present its own card-entry form; we do not make an unverified claim about every payment field the merchant may access.

If you send an enquiry through Instagram or another contact channel, the information you choose to include may be used to respond and investigate an order issue. Do not send full payment card details or unnecessary sensitive information in messages.

Order and delivery information is generally needed to take steps at your request before a purchase and to perform the sales contract. Records required for tax, accounting or consumer-law obligations are processed to comply with legal obligations.

Responding to enquiries, addressing complaints and protecting a service against misuse may involve legitimate interests, subject to a proper assessment and your rights. The business must document the interests it actually relies on rather than use this notice as blanket permission.

Consent is required where applicable for optional marketing or non-essential storage. Buying an item is not unconditional permission to receive marketing. The current newsletter form is not active and this website does not operate a working newsletter signup service. If one is introduced, the notice and consent arrangements must be updated first.

Shopify provides the product catalogue, cart and checkout used for clothing purchases. Order fulfilment may require relevant details to be shared with payment and delivery providers used for your order. The final list of operational providers and their roles must be confirmed by the business.

Setmore is linked for salon bookings. Instagram is linked to the @boujiewolf account. Clicking those links takes you to services with their own data practices. The website also requests fonts from Google Fonts, which can expose connection information such as your IP address and browser request details to that provider.

Service providers may process information outside the UK. The business must verify the actual locations, roles and any required adequacy decisions or appropriate transfer safeguards for its arrangements. This notice does not assert that all data stays in the UK or that specific safeguards have already been verified.

The shopping bag remains in local storage until it is cleared or replaced by the website, or you remove the stored site data in your browser. The stored bag is not a substitute for the seller's order record. Clearing your browser does not cancel an order already placed.

Business records should be kept only as long as needed for their purpose, applicable legal recordkeeping and the establishment or defence of legal claims. Specific retention periods and deletion schedules have not yet been supplied; they must be defined for order, enquiry and booking records. This policy does not invent a single retention period for every data category.

Reasonable technical and organisational safeguards must be used to protect personal information. No online service can promise absolute security. Use a private device where possible and avoid including unnecessary personal information in public social comments.

Depending on the circumstances, you may request access to your personal data, correction, deletion, restriction of processing or a portable copy of eligible data. You may object to processing based on legitimate interests and to direct marketing. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.

These rights are not absolute. A seller may need to retain information for a legal obligation or valid legal claim even if deletion is requested. Requests are generally answered within one month; a lawful extension can apply for complex or numerous requests, and you must be told if it is used. Reasonable identity checks may be needed to prevent disclosure to someone else.

You may complain to the UK Information Commissioner's Office at ico.org.uk if you are concerned about how personal data is handled. You do not have to give up that right or contact the business first, although raising a concern may help resolve it.

This notice must be updated when the business confirms its controller contact details, operational suppliers, transfer safeguards and retention schedule, or adds new data processing. Significant changes should be made clear to affected customers. A policy update is not permission to use information for an incompatible purpose without an appropriate lawful basis.