Privacy policy

This Privacy Notice explains how Composty Ltd (“Composty”, “we”, “us”) collects, uses, and shares your personal information when you visit or purchase from composty.earth and related pages (the “Services”). If there is a conflict between this Notice and our Terms of Service, this Notice controls for the collection, use, and disclosure of personal information.

Controller: Composty Ltd, 48 Kingsley Road, Kingswinford, ENG, DY6 9RX, United Kingdom
Contact: info@composty.earth

By using the Services, you acknowledge this Notice.

1. Personal information we collect
   We may collect the following categories of personal information:
   a) Contact details such as name, email, phone, billing and shipping addresses.
   b) Account and preferences such as username, password, settings.
   c) Order and transaction data such as items viewed, added, purchased, returned, order history, and payment status. Card details are processed by our payment providers and we do not store full card numbers.
   d) Device and usage data such as IP address, browser or device identifiers, time zone, pages viewed, clicks, and referring pages. This may be collected via cookies, pixels, and similar technologies.
   e) Communications such as messages, support emails, and attachments including photos for returns.
   We may draw inferences from the data above, for example likely preferences, to tailor your experience.
   Sources of data include you directly, your device, our service providers acting on our instructions, advertising and analytics partners subject to your consent, and Shopify as described in Section 5.
   
   

2. How we use your information and legal bases (UK and EU GDPR)
   a) Provide and improve the Services, including operating the site, processing orders and payments, delivery, returns, account management, recommendations, troubleshooting, and fraud prevention. Legal basis: contract and legitimate interests to operate and secure our services.
   b) Customer support and service communications. Legal basis: contract and legitimate interests.
   c) Marketing and advertising, including emails or SMS where opted in, and on-site and off-site ads and personalisation where cookies are enabled. Legal basis: consent and compliance with PECR for UK electronic marketing to consumers. You can withdraw consent at any time.
   d) Compliance and legal obligations, including tax, accounting, responding to legal requests, and enforcing our terms. Legal basis: legal obligation and legitimate interests.
   Where we rely on legitimate interests, we balance our interests against your rights and will stop on objection where required.
   
   

3. Sharing your information
   We share personal data with service providers acting on our instructions. These include Shopify for store platform, hosting, checkout, and fraud prevention; payment processors and banks for payments and refunds; logistics partners for shipping and returns; and IT, email, analytics, and advertising partners such as Google Analytics and Meta or Google or Bing Ads, subject to your cookie choices. We may disclose data to comply with law, protect rights, or in connection with a corporate transaction.
   Shopify Audiences and ads. With appropriate consent in the UK or EEA, we may use Shopify Audiences to help show relevant ads. This can involve sharing hashed identifiers such as your email, purchase data, and site interactions with Shopify for audience creation. You can opt out at any time as explained in Section 8.
   
   

4. International transfers
   Your data may be transferred outside the UK or EEA, for example to Canada or the United States. We rely on adequacy decisions where available, Standard Contractual Clauses, and where applicable the EU-US and UK-US Data Privacy Framework.
   
   

5. Relationship with Shopify
   Our Services are hosted by Shopify, which processes personal information to operate and improve the platform and certain features used by many merchants such as anti-fraud, analytics, and audiences. For those platform-level purposes, Shopify is responsible for its processing and for handling related rights requests.
   Shopify Consumer Privacy Policy: https://www.shopify.com/legal/privacy
   Shopify Privacy Portal for rights requests to Shopify: https://privacy.shopify.com/en
   
   

6. Cookies and similar technologies
   We use necessary, performance, and advertising cookies. On your first visit we ask for your consent for non-essential cookies. You can change preferences at any time via our cookie banner or your browser settings. Blocking cookies may affect site functionality.
   Cookie settings to manage or withdraw consent: available via the cookie banner on our site
   Shopify cookies overview: https://www.shopify.com/legal/cookies
   Global Privacy Control. Where required, we honour GPC signals for opting out of sale, sharing, or targeted advertising for the browser or device that sends the signal and, where technically possible, for a linked account.
   Do Not Track. There is no industry standard for DNT signals, so we do not respond to DNT.
   
   

7. Retention
   We keep data only as long as needed for the purposes in this Notice, including to comply with law and defend claims. Orders and invoices are retained for six years to meet UK legal requirements. Customer service communications are retained for up to three years after last contact. Marketing data is retained until you withdraw consent or after twenty-four months of inactivity. Cookie and analytics data are retained per the cookie’s lifetime as shown in your preferences.
   
   

8. Your rights
   Depending on where you live, you may have rights to access, correct, erase, restrict, object, and port your data, and to withdraw consent at any time. To exercise rights, contact info@composty.earth.
   UK and EU complaints. You may complain to the Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/
   US state rights where applicable. Residents of certain US states such as California, Colorado, Connecticut, and Virginia may have rights to know or access, correct, delete, and opt out of sale, sharing, or targeted advertising.
   Opt-out page for Do Not Sell or Share or Targeted Ads: available via the cookie banner on our site
   We treat Global Privacy Control signals as opt-outs for the sending browser or device and, where technically possible, for a linked account. We may need to verify your identity and may deny a request where permitted by law. You may designate an authorised agent as allowed by local law.
   
   

9. Children
   Our Services are not intended for children under 13. We do not knowingly collect data from children. If you believe a child has provided data, contact us so we can remove it.
   
   

10. Security
    We use appropriate technical and organisational measures to protect personal data. No system is perfectly secure and transmissions over the internet cannot be guaranteed.
    
    

11. Automated decision making
    We do not make decisions that have legal or similarly significant effects solely by automated means. Shopify applies limited automated checks to prevent fraud, for example temporary IP or card blacklists.
    
    

12. Changes to this Notice
    We may update this Notice to reflect operational, legal, or regulatory changes. We will post updates here with a new Last updated date and notify you where required.
    
    

13. Contact
    Questions, requests, or complaints can be sent to info@composty.earth or by post to Composty Ltd, 48 Kingsley Road, Kingswinford, ENG, DY6 9RX, United Kingdom.