01About this policy
The Ghoulish Garb (“we,” “us,” or “our”) operates the online store at theghoulishgarb.com. This policy describes personal information handled when you browse the store, place an order, contact us, or subscribe to store communications. It covers the website and store services.
For a question or privacy request, use Contact Us and select “Privacy request.” Include the email associated with your order or account, but do not send passwords or full payment card details.
02Information we handle
Orders and accounts: your name, email, billing and delivery addresses, phone number where supplied, items purchased, payment status, and order history. Account details are also used if you create an account.
Messages: information you provide when requesting help, a return, an exchange, or information about the collection. Please send only what is needed to handle your request.
Website activity: device and browser details, IP address, pages viewed, cart activity, and cookie or similar identifiers may be processed by the store and its enabled services.
Payments: payment providers handle the payment credentials entered at checkout. The store receives information needed to manage the transaction, such as its status and payment-method details. Do not submit payment credentials through the contact form.
03How information is used
We use relevant information to process purchases, supply physical products and digital downloads, communicate about delivery, respond to support requests, and administer returns or refunds. Information is also used to protect the store, investigate suspected fraud, maintain transaction records, and meet legal obligations.
Where marketing or measurement services are enabled, information may also be used to understand store activity and communicate about products, subject to applicable choices and consent requirements. Providing information needed for checkout is necessary to fulfil an order; optional marketing participation is separate.
04Shopify and other recipients
Our store is hosted on Shopify. Shopify processes information to provide its commerce platform and may also act for its own purposes in connection with services you use. Its own practices are explained in the Shopify Consumer Privacy Policy.
Relevant information can be shared with payment processors, shipping and fulfilment providers, and providers supporting store operation and customer service. Professional advisers or authorities may receive information when necessary for a legal obligation or dispute. If our business changes ownership, information may be transferred with appropriate protections and notice where required.
If you choose Buy with Prime at checkout, we share the information needed to process and fulfil that order with Amazon. We only share your personal information with Amazon when you use Buy with Prime.
Other sites and independently operated services have their own privacy notices. Visiting a linked service does not make this policy its privacy policy.
05Cookies, analytics and advertising
Cookies and similar technologies can keep the cart working, maintain a session, protect checkout, and remember preferences. Optional tools can measure visits or support advertising when enabled. Your browser settings let you restrict or delete cookies, although blocking essential storage may affect checkout or other features.
Use any consent or privacy controls presented on the store to manage the choices they cover. For questions about the tools used, or to request an available opt-out from sale, sharing, or targeted advertising, contact us. Those legal terms can cover some advertising-related data disclosures even when no money is exchanged.
For Shopify’s separate uses of information, consult its privacy notice and privacy portal. Shopify’s controls do not replace requests you may need to make directly to us.
06Marketing choices
You can unsubscribe from marketing emails using the unsubscribe link in the message, or contact us for help. This does not stop necessary order, account, or support communications. Where processing depends on consent, you can withdraw that consent for future processing without changing the lawfulness of earlier processing.
07Retention and security
Information is retained for the time needed for its purpose, considering outstanding orders, customer-service needs, accounting and legal obligations, disputes, and security. Different records may have different retention periods. A deletion request may not require removal of records that must be kept for a lawful reason.
Reasonable safeguards are used to protect personal information, but no website or transmission method can guarantee absolute security. Protect your account credentials and contact us if you suspect unauthorized use.
08Your privacy rights
Depending on your location and applicable law, you may be entitled to access or receive a copy of your information, correct it, request deletion, restrict certain uses, object to processing, or receive portable data. Some jurisdictions provide opt-out rights for sale, sharing, or targeted advertising, and rights to appeal a denied request.
Contact us to make a request or appeal. We may need proportionate information to verify your identity or an authorized agent’s authority. Requests are handled subject to applicable deadlines and lawful exceptions, without unlawful discrimination for exercising your rights.
Where a right to object applies, you may object to processing based on legitimate interests; you may also object to direct marketing. You can raise a concern with your local privacy regulator. UK residents can contact the Information Commissioner’s Office.
09International processing and lawful bases
Our business is based in the United States, and service providers may process information in other countries. Where transfer protections are required, the applicable arrangements must support those transfers. Contact us for information about the arrangements relevant to your data.
Where EEA or UK data-protection rules apply, the bases for processing are performance of an order or related request, compliance with law, legitimate interests in secure store operation and customer service where those interests are not overridden, and consent for activities that require it. The applicable basis depends on the specific use.
10Children and policy changes
The store is intended for a general audience and is not directed to children under 13. If you believe a child has provided personal information without appropriate permission, contact us so the matter can be reviewed.
We may update this policy as the store, services, or legal requirements change. Additional notice or consent will be provided where required.