Privacy Policy

Last Updated: 1 March 2026

1. Introduction

MAMOU Home Decor Ltd ("we", "us", "our") operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the "Services"). Our Services are hosted by Shopify. This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase or other transaction using the Services or otherwise communicate with us.

For the purpose of applicable data protection laws (UK GDPR, EU GDPR, and the Data Protection Act 2018), we are the data controller of your personal information.

If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described herein.

2. Data Protection Officer

We have not appointed a Data Protection Officer as our processing activities do not require one under UK GDPR Article 37. For all privacy enquiries, including exercising your data subject rights, please contact:

3. Personal Information We Collect

When we use the term "personal information," we are referring to information that identifies or can reasonably be linked to you. We may collect the following categories depending on how you interact with the Services:

• Contact details: Name, address, billing address, shipping address, phone number, and email address.
• Financial information: Payment card details are collected and processed directly by our payment processor (Stripe). We receive only a payment reference and confirmation — we do not store your full card number, CVV, or bank details.
• Account information: Username, password (stored as a cryptographic hash), security questions, preferences and settings.
• Transaction information: Items you view, add to your cart or wishlist, purchase, return, exchange or cancel, and your past transactions.
• Communications: Information you include in messages to us, for example customer support enquiries.
• Device information: Information about your device, browser, or network connection, your IP address, and other unique identifiers.
• Usage information: How and when you interact with or navigate the Services, including pages viewed and actions taken.
• Review data: Name, email, review text, and rating when you voluntarily submit a product review.

4. Personal Information Sources

We may collect personal information from the following sources:

• Directly from you: When you create an account, place an order, submit a review, communicate with us, or otherwise provide your personal information.
• Automatically: Through your device when you use the Services, via cookies and similar technologies (see Section 12).
• From our service providers: When they collect or process your personal information on our behalf.
• From our partners: Including Shopify and marketing partners.

5. How We Use Your Personal Information

We process your personal information for the following purposes and under the following legal bases:

Purpose	Legal Basis (UK GDPR)
Order processing, payment, and fulfilment	Art. 6(1)(b) — Performance of contract
Tax and accounting records (HMRC)	Art. 6(1)(c) — Legal obligation
Marketing emails	Art. 6(1)(a) — Consent (opt-in only)
Fraud prevention and order validation (see Section 9)	Art. 6(1)(f) — Legitimate interest (security)
Analytics and service improvement	Art. 6(1)(f) — Legitimate interest
Customer support and communication	Art. 6(1)(b) — Performance of contract
Product reviews	Art. 6(1)(a) — Consent (voluntary submission)
Legal compliance and dispute resolution	Art. 6(1)(c) — Legal obligation

6. How We Disclose Personal Information

We share your personal information with the following categories of recipients:

• With Shopify, who hosts our store and processes personal information to provide the Services (see Section 7).
• With our third-party processors listed in Section 8.
• With business and marketing partners, with your consent, to provide marketing services.
• When you direct or consent to disclosure, such as through social media integrations.
• With our affiliates or within our corporate group.
• In connection with a business transaction (merger, acquisition), to comply with legal obligations, or to protect the Services and the rights of users.

7. Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services. Information you submit to the Services will be transmitted to and shared with Shopify as well as third parties in countries other than where you reside.

Shopify may use personal information collected from your interactions with our store, along with other merchants and Shopify, to provide and improve its services. In these circumstances, Shopify is responsible for the processing of your personal information.

To learn more about how Shopify uses your personal information, visit the Shopify Consumer Privacy Policy. You may also exercise rights at the Shopify Privacy Portal.

8. Third-Party Processors

We use the following third-party processors who process your personal information on our behalf:

Processor	Purpose	Data Shared	Location	Safeguards
Stripe	Payment processing	Payment card details, billing address, order amount	United States	Standard Contractual Clauses (SCCs)
NextSmartShip	Order fulfilment and shipping	Name, email, phone, shipping address, order items	China	SCCs (pending completion — see Section 11)
Sentry	Error monitoring and application stability	Anonymised error data, device/browser info	United States	Standard Contractual Clauses (SCCs), DPA in place
Shopify	E-commerce platform and hosting	All data submitted through the store	Canada / United States	Adequacy decision (Canada), SCCs (US)
DigitalOcean	API hosting and infrastructure	Order data, analytics (server-side)	United States / Europe	Standard Contractual Clauses (SCCs)
SMTP Provider	Transactional and marketing emails	Name, email address, order details	United States	Standard Contractual Clauses (SCCs)

9. Automated Decision-Making and Fraud Prevention

We use automated order validation to help prevent fraud and protect our customers. When you place an order, our system automatically checks:

• Whether the shipping address matches known patterns of fraudulent orders
• Whether the email address or contact details show indicators of potential fraud
• Overall order risk scoring based on multiple factors

Based on this automated assessment, your order may be:

• Approved — processed normally.
• Flagged for manual review — held for review by our team before processing.
• Declined — rejected if the fraud risk score exceeds our threshold.

This processing is carried out under UK GDPR Article 6(1)(f) (legitimate interest in fraud prevention). As it may produce legal effects (preventing contract performance), you have the following rights under Article 22:

• Right to human review: You may request that a member of our team manually reviews any automated decision affecting your order.
• Right to contest: You may challenge the automated decision and provide additional information.
• Right to an explanation: You may request an explanation of the factors that influenced the decision.

To exercise any of these rights, contact us at privacy@mamouhomedecor.com.

10. Data Retention

We retain your personal information only for as long as necessary for the purposes set out in this policy, or as required by law. The specific retention periods are:

Data Category	Retention Period	Reason
Order financial data	7 years	HMRC legal obligation
Personal identifiers (name, email, address)	Until erasure requested, or 7 years	Contract performance / HMRC
Marketing data	1 year (or until consent withdrawn)	Consent-based
Consent records	7 years	Audit trail / legal obligation
Customer reviews	2 years	Consent-based (voluntary submission)
Analytics data	Session only (in-memory)	Not stored persistently
Tag audit logs	90 days (IP anonymised after 30 days)	Security / legitimate interest
Authentication data	Session lifetime	Security / legitimate interest

When personal data is no longer required, we securely delete or anonymise it. Automated retention enforcement runs periodically to remove expired data.

11. International Transfers

Your personal information may be transferred to, stored, and processed in countries outside the United Kingdom, including:

• United States — Stripe (payments), Sentry (error monitoring), DigitalOcean (hosting), Shopify (platform), SMTP provider (email).
• Canada — Shopify (platform hosting).
• China — NextSmartShip (order fulfilment). Your name, email, phone number, shipping address, and order items are transferred to NextSmartShip in China for the purpose of fulfilling your order.

China is not recognised as providing an adequate level of data protection. Where we transfer your personal information outside the UK to a country without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) approved by the UK Secretary of State, or equivalent safeguards.

Current status: Standard Contractual Clauses with NextSmartShip are pending completion. Until SCCs are fully executed, transfers are made on the basis of explicit informed consent at checkout and contractual necessity (UK GDPR Art. 49(1)(b)).

12. Cookies and Similar Technologies

Our Services use cookies and similar technologies. Cookies are small text files placed on your device that help us provide and improve the Services.

Essential Cookies

These cookies are strictly necessary for the operation of the Services (e.g., session management, shopping cart, checkout). They do not require your consent under the Privacy and Electronic Communications Regulations 2003 (PECR).

Analytics Cookies

We use analytics tools to understand how visitors use the Services. Analytics data is processed in-memory during your session and is not stored persistently. Analytics tracking requires your consent and is only activated if you opt in via our analytics consent mechanism.

Marketing Cookies

Marketing and advertising cookies are only placed with your explicit consent and are used to show relevant advertisements. You can withdraw consent at any time.

Managing Cookies

You can manage your cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of the Services. You can also manage analytics consent through your account settings or by contacting us.

13. Third-Party Websites and Links

The Services may link to websites or platforms operated by third parties. We are not responsible for the privacy practices of these sites. Please review their privacy policies before providing personal information.

14. Children's Data

The Services are not intended for use by children, and we do not knowingly collect personal information from anyone under the age of 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete it.

15. Security

We implement appropriate technical and organisational measures to protect your personal information, including encryption in transit (TLS/SSL), secure password hashing, and access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

16. Your Rights

Under the UK GDPR and Data Protection Act 2018, you have the following rights in relation to your personal information:

Your Data Subject Rights

• Right of Access (Art. 15): Request a copy of all personal data we hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate personal data.
• Right to Erasure (Art. 17): Request erasure of your personal data (see below for how this works in practice).
• Right to Restrict Processing (Art. 18): Request that we stop or restrict processing of your data.
• Right to Data Portability (Art. 20): Receive your data in a machine-readable format (JSON).
• Right to Object (Art. 21): Object to processing based on legitimate interest.
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time without affecting prior processing.
• Rights relating to Automated Decisions (Art. 22): Request human review of automated decisions (see Section 9).

How Erasure Works

When you exercise your right to erasure, we anonymise your personal identifiers (name, email, address) rather than fully deleting your record. This is because we are legally required to retain financial transaction records for 7 years under HMRC regulations (UK GDPR Art. 17(3)(b) — legal obligation). Specifically:

• Your name is replaced with "REDACTED"
• Your email is replaced with a non-functional address
• Your address is cleared
• Order financial records (amounts, dates, transaction references) are retained for HMRC compliance

This ensures we comply with both your erasure right and our tax record obligations.

Exercising Your Rights

You may exercise any of these rights by:

• Emailing us at privacy@mamouhomedecor.com
• Using our self-service data subject rights API (available to account holders)

We will respond within 30 days of receiving your request (UK GDPR Art. 12(3)). We may need to verify your identity before processing your request. We will not discriminate against you for exercising any of these rights.

Managing communication preferences: You may opt out of marketing emails at any time by using the unsubscribe link in our emails. We may still send you non-promotional emails related to your orders.

17. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach (UK GDPR Art. 33).
• Notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms (UK GDPR Art. 34).

We maintain a breach notification register in accordance with Art. 33(5) to document all breaches and our response actions.

18. ICO Registration

We are in the process of completing our registration with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. Our registration number will be published here once confirmed.

19. Complaints

If you have complaints about how we process your personal information, please contact us at privacy@mamouhomedecor.com.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

For the EEA, you can find a list of supervisory authorities at: edpb.europa.eu.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for legal or regulatory reasons. We will post the revised Privacy Policy on this page and update the "Last Updated" date. Material changes will be notified via email where possible.

21. Contact Us

For any privacy enquiries, data subject rights requests, or questions about this policy, please contact us:

This privacy policy complies with UK Data Protection Act 2018, UK GDPR, EU GDPR, and the Privacy and Electronic Communications Regulations 2003 (PECR). We are committed to protecting your privacy and handling your personal data in accordance with applicable data protection laws.