Privacy Policy

1. Information collection and use

Introduction

This Privacy Policy explains what personal information DuffNall collects, how it is used and protected, and your choices. The published policy is intended to reflect principles in the GDPR, California Consumer Privacy Act and California Privacy Rights Act.

1.1 Types of information

• Identity and contact information, including name, email, phone number and residential address.
• Financial and transaction information, including payment-card or account details processed for a purchase.
• Technical information, including IP address, device identifier and browser configuration.
• Browsing and usage information, including visited pages, interactions, clicks and analytics engagement.
• Approximate or precise location inferred from IP address or supplied with consent.

1.2 Collection methods

Information can be supplied directly through account creation, checkout, forms, surveys, contact or an offline purchase or telephone order; collected automatically through cookies and analytics, including Google Analytics where configured; or processed through integrated payment and marketing services.

1.3 Purposes

Information may be used to fulfil Orders and process transactions, arrange delivery and billing, provide support, personalise content and recommendations, send permitted marketing, measure and improve Website operation, identify and prevent fraud, and meet legal or regulatory duties.

2. Your rights and choices

2.1 Access and correction

You may request access to personal information and correction of inaccuracies through available account controls or customer support.

2.2 Preferences

You may opt out of certain processing and promotional communications through email unsubscribe links, account preferences where available, or support.

2.3 Deletion

You may request deletion through account controls where available or customer support, subject to legal, security and transactional retention requirements.

2.4 Withdrawal of consent

Where consent is the legal basis, it can be withdrawn through available consent controls or by contacting support.

2.5 Download and portability

You may request a downloadable record of personal information maintained by DuffNall for retention or transfer where applicable.

2.6 Cookies

Cookies and similar technology support personalisation and performance measurement. Browser and Website controls may let you block all cookies, select accepted categories or receive a notice before storage. Restricting necessary cookies can affect functionality.

3. Data security

3.1 Technical safeguards described in the published policy

• Encryption for data at rest and in transit, including AES-256 where applicable.
• Access control, multi-factor authentication and password requirements limiting access to authorised personnel with a legitimate need.
• Vulnerability assessment, penetration testing and timely remediation.
• Firewalls, intrusion detection and prevention, and network segmentation.
• Secure, geographically separated backup and disaster-recovery arrangements.

3.2 Organisational measures

The policy describes privacy and security training, internal and external audits, and an incident-response process covering investigation, notification and remediation.

4. Sharing of information

4.1 Authorised recipients

Necessary information may be processed by payment providers, Website hosting and analytics providers, shipping and fulfilment partners, marketing and advertising partners, IT service providers, and law-enforcement or regulatory bodies where required.

4.2 Exceptions to consent

Information may be disclosed to meet a legal obligation, protect vital interests in an emergency, support due diligence during a merger, acquisition or other corporate transaction, protect public safety or prevent unlawful activity.

5. International transfers

5.1 Legal basis

International transfers are intended to rely on a recognised legal basis, including an adequacy decision, Standard Contractual Clauses for destinations without adequacy, or explicit consent where appropriate.

5.2 Security

Transfers are intended to use appropriate technical and organisational measures, including encryption, password protection and access control, regardless of destination.

5.3 Rights

Applicable data-protection rights continue after a transfer. You may request access, correction or deletion even when information is held in another country.

6. Changes and contact

Policy updates will be published here, with additional notice where a change significantly affects privacy rights. Review this page periodically. Questions, corrections, access requests, deletion requests and other privacy enquiries can be sent to support@duffnall.com or through the Contact page.