Privacy Policy

1) Who we are
This website is operated by Heyyymumu (“we”, “us”, “our”).
Data controller: Mumbi Munyua
Email: heyyymumu@gmail.com
Location: United Kingdom

2) What personal data we collect
We collect the information needed to run our shop and provide customer support:
When you place an order

• Name, billing and delivery address

• Email address and phone number (if provided)

• Items purchased, order notes, and order history

When you contact us

• Your name, email address, and the content of your message

When you browse our site

• Technical/usage data such as IP address, device/browser type, pages visited, and interactions (collected via cookies and similar technologies)

Payments

• We do not store full payment card details. Payments are handled by third-party payment providers (e.g. PayPal). We receive confirmation of payment and limited transaction details (e.g. payment status, transaction reference).

​

3) How we use your data and our lawful bases
We use your personal data for the following purposes:
A) To process and deliver your order
Order confirmation, payment verification, packing and shipping, order updates, returns/refunds.
Lawful basis: Contract (to fulfil your purchase).
B) Customer support
Responding to queries and resolving issues.
Lawful basis: Legitimate interests and/or contract (depending on your request).
C) Running and improving our website
Website functionality, security, and understanding how visitors use the site (basic analytics via cookies/logs).
Lawful basis: Legitimate interests.
D) Email marketing (starting soon)
If you sign up, we’ll send emails like launches, restocks, and offers.
Lawful basis: Usually consent. In some cases, we may email existing customers under the UK “soft opt-in” rules (you’ll always have a clear opt-out).
E) Legal and accounting
Record-keeping and complying with legal obligations.
Lawful basis: Legal obligation.

4) Marketing choices (email)

• You can unsubscribe any time using the link in our emails or by contacting heyyymumu@gmail.com.

• If we rely on consent, you can withdraw it at any time.

• If we use the “soft opt-in” for existing customers, we’ll only send marketing about our own similar products and we’ll include an opt-out in every message.

​​

5) Who we share your data with
We only share personal data when needed to run the shop:

• Website platform and hosting providers (including Wix)

• Payment providers (e.g. PayPal) to process payments

• Delivery/shipping providers to deliver your order (e.g. postal/courier services)

• Email/marketing providers (once enabled) for sending newsletters or marketing emails

• Professional advisors (e.g. accountant/bookkeeper) where necessary

• Authorities/regulators where required by law

We do not sell your personal data.

6) International transfers
Some providers we use may process data outside the UK. Where this happens, appropriate safeguards are used to protect your data (such as contractual protections).

7) How long we keep your data
We keep personal data only as long as needed:

• Order and accounting records: kept for legal/accounting purposes (typically several years)

• Customer support messages: kept as long as necessary to resolve issues and keep reasonable records

• Marketing subscriptions: kept until you unsubscribe or withdraw consent

​​

8) How we protect your data
We take reasonable steps to protect your personal data. No method of transmission or storage is 100% secure, but we work to protect your information.

9) Your rights
Under UK data protection law, you may have rights to:

• access your data

• correct inaccurate data

• request deletion (in some cases)

• restrict or object to certain processing

• data portability (in some cases)

• withdraw consent (where we rely on consent)

To exercise your rights, contact heyyymumu@gmail.com.
You can also complain to the Information Commissioner's Office.

10) Cookies
We use cookies and similar technologies to make the site work, remember preferences, and understand basic site usage. You can control cookies via your browser settings and our cookie banner (where available).
Note: We are not currently using Google Analytics. If that changes, we will update this policy.

11) Changes to this policy
We may update this policy from time to time. The latest version will always be posted on this page with the updated date.