Privacy Policy

Two things, both in local storage rather than cookies, and both essential to the site working:

• Your basket contents, so it survives a page reload.
• Your cookie choice, so we do not ask again on every page.

No analytics or session-recording script is currently installed on this site. If we add one, it will be named in this clause before it runs, and it will only load after you accept analytics cookies — the consent gate is a real gate, not a banner that logs a preference.

Under UK GDPR we rely on:

• Contract — to process and deliver your order.
• Legal obligation — to keep transaction records for tax purposes.
• Consent — for marketing email and for any analytics cookies. You can withdraw it at any time.
• Legitimate interests — to prevent fraud and to secure the site.

Only the processors needed to get an order to you: our payment provider, our delivery carrier, and our email provider for order confirmations. Each processes data on our instructions under a contract.

We do not sell personal data, and we do not share it with advertisers.

Order records for six years, because HMRC requires it. Marketing consent until you withdraw it. Support correspondence for two years. Anything else is deleted when it is no longer needed for the purpose it was collected for.

Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, object to or restrict processing, or ask for it in a portable format. Email us and we will respond within one month.

If you are not satisfied, you can complain to the Information Commissioner's Office at ico.org.uk.

We aim to keep processing within the UK and the European Economic Area. Where a supplier processes data outside those areas — a payment provider or an email host, for example — we rely on the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, together with a transfer risk assessment.

We will name each processor and its location in this policy as it is engaged. We will not list a provider here before it is actually in use, and we will not omit one that is.

Contact us first at hello@zombiepouches.com — most things are quicker to fix directly. If you are not satisfied, you have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at ico.org.uk or on 0303 123 1113. Complaining to the ICO does not cost anything and does not affect any other rights you have.

We do not carry out automated decision-making or profiling that has legal or similarly significant effects on you.

Our products are sold to over-18s only and this site is not directed at children. We do not knowingly collect personal data from anyone under 18; if you believe we hold any, tell us and we will delete it.

The site is served over HTTPS. Access to order data is limited to the people who need it to fulfil orders and handle support.

If this policy changes materially we will say so on this page and update the date at the top.