Privacy policy

Last Updated: July 22, 2026

At Hezipop (“Hezipop,” “we,” “our,” or “us”), we respect your privacy and are committed to handling personal information responsibly and transparently.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you:

• Visit or browse our website;
• Create or use a customer account;
• Place or pay for an order;
• Request a return, exchange, or refund;
• Subscribe to marketing communications;
• Contact Customer Support; or
• Otherwise interact with Hezipop.

By using our website, you acknowledge that you have received this Privacy Policy. Where consent is legally required, such as for certain cookies or marketing communications, we will request that consent separately.

1. Scope of This Privacy Policy

This Privacy Policy applies to personal information processed through www.hezipop.com and related customer-service, order, payment, shipping, return, and marketing activities.

It does not apply to third-party websites or services that operate under their own privacy policies.

2. Data Controller

Hezipop is an independently operated online retailer based in the United Kingdom. For the processing activities described in this Privacy Policy, Hezipop acts as the data controller unless another party is identified as independently responsible for a particular service.

3. Personal Information We Collect

The personal information we collect depends on how you interact with us. It may include the following categories.

Identity and Contact Information

• Full name;
• Email address;
• Telephone number;
• Billing address;
• Shipping address; and
• Account contact information.

Order and Transaction Information

• Products ordered;
• Size, color, and quantity selections;
• Order number and order date;
• Order value, discounts, and applicable taxes;
• Payment method and transaction status;
• Shipping, tracking, delivery, return, exchange, and refund details; and
• Fraud-prevention and transaction verification results.

Payment-Related Information

Payments are processed by Shopify and supported payment providers. We may receive limited payment-related information, such as:

• The payment method used;
• Payment authorization or transaction status;
• A payment token or transaction reference;
• Limited card information, such as card type or last digits; and
• Billing verification results.

Hezipop does not store your complete credit or debit card number on its own website or business systems.

Account and Customer-Service Information

• Account login and preference information;
• Customer-service emails and messages;
• Return and refund requests;
• Product reviews or feedback;
• Photos or videos submitted in connection with a product issue; and
• Records of complaints and their resolution.

Device and Usage Information

• IP address;
• Browser type and version;
• Device type and device identifiers;
• Operating system;
• Approximate location derived from an IP address;
• Pages viewed and links selected;
• Referring website or advertising source;
• Checkout and website interactions;
• Date and time of visits; and
• Cookie, pixel, tag, and similar technology data.

Marketing and Preference Information

• Marketing subscription status;
• Email engagement information;
• Cookie and privacy preferences;
• Product interests and website interactions; and
• Advertising attribution information where permitted.

We do not intentionally request special-category or highly sensitive personal information unless it is genuinely necessary and permitted by applicable law.

4. How We Obtain Personal Information

We may obtain personal information:

• Directly from you, such as when you place an order, create an account, contact us, or submit a return request.
• Automatically from your device, through cookies, pixels, logs, and similar technologies.
• From payment providers, such as payment authorization and transaction status information.
• From shipping and fulfillment providers, such as tracking and delivery updates.
• From Shopify, which provides our online store, checkout, account, and related e-commerce services.
• From analytics or advertising partners, where those services are enabled and permitted by applicable law.
• From fraud-prevention and security providers, to help identify suspicious or unauthorized transactions.

5. How and Why We Use Personal Information

Where we rely on legitimate interests, those interests may include operating and protecting our business, preventing fraud, improving our services, resolving customer concerns, and maintaining accurate records. We consider the potential effect on customers before relying on this basis.

6. Information Required to Complete a Purchase

Certain information—including your name, contact details, shipping address, billing information, and payment authorization—is necessary to enter into and perform a purchase contract.

If this required information is not provided, we may be unable to accept, process, deliver, or provide support for an order.

7. Payment Processing

Payment transactions are processed through Shopify and supported payment providers, which may include:

• Shopify Payments;
• Shop Pay and Shop Pay Installments;
• Card networks and issuing banks;
• Apple Pay and Google Pay;
• PayPal; and
• Applicable payment, lending, or fraud-prevention partners.

These providers may process personal information under their own privacy notices and legal responsibilities. The payment methods actually available for a transaction are those displayed during checkout.

8. Cookies and Similar Technologies

Hezipop and its service providers may use cookies, pixels, tags, software development kits, and similar technologies.

These technologies may be used to:

• Operate essential website and checkout functions;
• Remember customer and privacy preferences;
• Maintain account and shopping-cart sessions;
• Protect the website and prevent fraud;
• Measure website traffic and performance;
• Understand how visitors use the website;
• Measure advertising effectiveness; and
• Support personalized or targeted advertising where permitted.

Where required by UK, European, or other applicable law, non-essential analytics and advertising technologies will be used only after the required consent has been obtained.

You may manage available choices through our cookie banner or Cookie Preferences tool, where displayed. You may also manage cookies through your browser settings, although blocking essential technologies may affect website functionality.

Depending on the tools currently enabled, our analytics and advertising services may include Google Analytics, Google Ads, Pinterest Ads, Pinterest Tag, and Shopify-supported analytics or network services.

If a named service is not enabled on our website, it does not collect information from the website on our behalf.

9. How We Disclose Personal Information

We may disclose personal information to service providers and other recipients when reasonably necessary for the purposes described in this policy.

Recipients may include:

• Shopify, which provides our online store, checkout, hosting, accounts, and e-commerce infrastructure.
• Payment providers, card networks, banks, wallet providers, and installment providers.
• Shipping, delivery, and fulfillment providers, which require order and contact information to deliver purchases.
• Customer-service and communications providers, which help us respond to customer requests and send order notifications.
• Technology, hosting, security, and fraud-prevention providers.
• Analytics and advertising partners, where enabled and permitted by your preferences and applicable law.
• Professional advisers, such as legal, tax, accounting, insurance, and compliance advisers.
• Government authorities, regulators, courts, or law-enforcement bodies, where disclosure is legally required or necessary to protect legal rights.
• Business transaction participants, if Hezipop undergoes a sale, transfer, restructuring, or similar transaction, subject to appropriate confidentiality and legal protections.

Service providers receive only the information reasonably necessary to perform their services and must handle it according to their contractual and legal responsibilities.

10. Sale, Sharing, and Targeted Advertising

Hezipop does not sell personal information in exchange for monetary compensation.

However, certain disclosures of cookie, device, browsing, or advertising information to analytics and advertising partners may be treated as a “sale,” “sharing,” or use for targeted advertising under some United States privacy laws.

Eligible residents may request to opt out by:

• Using the privacy or cookie preference controls displayed on our website;
• Reviewing our Do Not Sell or Share My Personal Information page;
• Sending an email to hello@hezipop.com with the subject “Do Not Sell or Share My Personal Information”; or
• Using a legally recognized browser-based opt-out signal, such as Global Privacy Control, where applicable and technically detected.

We will not discriminate against a customer for exercising an applicable privacy right.

11. International Data Transfers

Hezipop is based in the United Kingdom and serves customers in multiple countries. Our service providers may process personal information in the United Kingdom, European Economic Area, United States, Canada, or other countries where they operate.

Some countries may not provide the same level of data protection as the country where the information was originally collected.

Where required, we use recognized transfer mechanisms or safeguards, which may include:

• UK or European adequacy regulations and decisions;
• European Commission Standard Contractual Clauses;
• The UK International Data Transfer Agreement;
• The UK Addendum to the European Commission Standard Contractual Clauses;
• Contractual and security safeguards; or
• Another lawful transfer mechanism permitted by applicable law.

You may contact us to request available information about safeguards used for a particular international transfer.

12. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected.

When determining retention periods, we consider:

• The duration of our customer relationship;
• The time needed to fulfil orders and provide support;
• Return, refund, chargeback, and dispute periods;
• Tax, accounting, consumer-protection, and record-keeping obligations;
• Applicable limitation periods;
• Fraud-prevention and security requirements; and
• Whether continued retention is necessary to establish or defend legal claims.

Order and transaction records may generally be retained for up to six years after the relevant transaction or business relationship, or longer where required by law, an unresolved dispute, or another legitimate legal requirement.

Marketing information is retained until you unsubscribe, withdraw consent, or the information is no longer required. We may retain limited suppression information to ensure that an opt-out request continues to be respected.

When personal information is no longer required, it will be deleted, anonymized, or securely retained where deletion is not yet legally permitted.

13. Data Security

We use reasonable technical and organizational measures designed to protect personal information against:

• Unauthorized access;
• Accidental loss;
• Misuse or unlawful disclosure;
• Unauthorized alteration; and
• Destruction.

These measures may include access controls, account security, restricted permissions, secure payment processing, service-provider reviews, and other safeguards appropriate to the nature of the information.

No Internet transmission or electronic storage system can be guaranteed to be completely secure. Customers should protect their account credentials and contact us if they suspect unauthorized account or order activity.

14. Your Privacy Rights

Depending on your location and applicable law, you may have rights to:

• Request access to personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Request deletion of personal information;
• Request restriction of certain processing;
• Object to processing based on legitimate interests;
• Object to direct marketing;
• Request portability of eligible personal information;
• Withdraw consent at any time where processing is based on consent;
• Request information about automated decision-making or profiling where applicable;
• Opt out of the sale, sharing, or use of personal information for targeted advertising where applicable;
• Use an authorized agent where applicable;
• Appeal the denial of a request where applicable law provides that right; and
• Lodge a complaint with an applicable data protection authority.

These rights are not absolute and may depend on the purpose and legal basis for processing. We may retain information where required by law or where a lawful exception applies.

15. How to Exercise Your Privacy Rights

To submit a privacy request, email hello@hezipop.com.

Please include:

• Your name;
• The email address associated with your account or order;
• Your order number, if relevant; and
• A clear description of the right you wish to exercise.

We may request additional information when reasonably necessary to verify your identity and protect personal information from unauthorized access. We will not request more verification information than is reasonably required.

For requests governed by UK data protection law, we will respond without undue delay and normally within one calendar month after receiving the request and any information reasonably required to verify it.

For complex or multiple requests, the response period may be extended where permitted by law. If an extension applies, we will notify you and explain the reason.

Requests are generally handled without charge. A reasonable fee or refusal may apply where legally permitted for requests that are manifestly unfounded, excessive, or repetitive.

16. Marketing Communications

Where permitted, Hezipop may send information about:

• New products and collections;
• Promotions and special offers;
• Store news; and
• Related marketing updates.

You may unsubscribe from marketing emails at any time by using the unsubscribe link in the email or contacting us.

Withdrawing marketing consent does not affect the lawfulness of processing that occurred before withdrawal.

Even if you unsubscribe from marketing, we may continue to send non-promotional messages necessary for orders, payments, shipping, security, returns, refunds, or customer-service requests.

17. Automated Tools and Profiling

We and our service providers may use automated tools to:

• Identify potentially fraudulent transactions;
• Protect accounts and checkout activity;
• Analyze website performance;
• Measure advertising effectiveness; and
• Provide relevant content or advertising where permitted.

Automated fraud tools may flag an order for review, delay, or additional verification.

If we use solely automated decision-making that produces legal or similarly significant effects, we will provide the information and safeguards required by applicable law, which may include the right to request human review.

18. Children’s Privacy

Our website is not directed to children under 13 years old, and we do not knowingly collect personal information from children under 13.

Where local law requires a higher minimum age or parental authorization, the applicable requirement will apply.

If you believe a child has submitted personal information without the required authorization, please contact us so we can investigate and take appropriate action.

19. Third-Party Websites and Services

Our website may contain links to third-party websites, applications, or services. These third parties operate under their own privacy notices and security practices.

Hezipop is not responsible for the privacy, security, or content of an external service. We recommend reviewing its privacy policy before providing personal information.

20. Data Protection Complaints

If you are concerned about how Hezipop has collected, used, disclosed, or protected your personal information, you may submit a data protection complaint to:

hello@hezipop.com with the subject line “Data Protection Complaint.”

When handling a data protection complaint, we will:

• Provide a clear method for submitting the complaint;
• Acknowledge the complaint within 30 days of receipt;
• Take appropriate steps to investigate it without undue delay;
• Keep the complainant appropriately informed; and
• Communicate the outcome of the complaint.

UK residents also have the right to complain to the UK Information Commissioner’s Office .

EEA residents may lodge a complaint with the data protection authority in the country where they live, work, or believe an infringement occurred.

21. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in:

• Our business operations;
• Website features or service providers;
• Data-processing practices;
• Privacy or security requirements; or
• Applicable laws and regulations.

The updated policy will be posted on this page with a revised “Last Updated” date. Where legally required, we will provide additional notice or request renewed consent.

22. Related Privacy Pages

For additional information, please review:

• GDPR and UK GDPR Compliance
• Do Not Sell or Share My Personal Information
• Our Cookie Preferences tool, where displayed;
• Our Payment Policy; and
• Our Terms of Service.

23. Contact Us

For privacy questions, requests, objections, withdrawals of consent, or data protection complaints, please contact us:

General customer inquiries are normally answered within 24–48 business hours. Privacy rights requests and data protection complaints are handled according to the applicable legal timeframes described above.