Privacy policy
Privacy Policy
1. Introduction
This Privacy Policy describes how Dear Martina, operating the brand Dear Martina ("we", "us", "our"), collects, uses, and shares your personal information when you visit or make a purchase from our website (the "Site").
We are committed to protecting your personal data in compliance with the General Data Protection Regulation (GDPR), UK GDPR, and all other applicable data protection laws in the countries we operate in.
2. Personal Information We Collect
2.1 Device Information
When you visit our Site, we automatically collect certain information, including:
- Web browser type and version
- IP address and time zone
- Cookie data
- Pages and products viewed
- Search terms used to reach the Site
- How you interact with the Site
2.2 Order Information
When you make or attempt to make a purchase, we collect:
- Full name
- Billing and shipping address
- Payment information (processed securely, we do not store full card details)
- Email address
- Phone number
2.3 Marketing Information
If you opt in to marketing communications, we collect:
- Email address (via Klaviyo)
- Phone number for SMS/text notifications (if opted in)
2.4 Behavioural Data
We use Microsoft Clarity to collect:
- Heatmaps and click tracking
- Session recordings
- Scroll behaviour and mouse movements
This data is used solely to improve the design and usability of our Site.
2.5 Conversion and Advertising Data
We use WeTracked to measure the performance of our advertising. WeTracked collects information about your visit and your order, including page views, cart activity, checkout activity, and purchase details, and transmits this information from our server to Meta so that we can measure which advertisements lead to sales.
The information transmitted may include your email address, name, address, and IP address in hashed (encrypted) form.
This processing takes place only where you have given consent via our Cookie Banner.
2.6 Information You Provide Voluntarily
If you choose to answer an optional question in a pop-up or a post-purchase survey, for example about which everyday activities matter most to you, we collect the answer you select. These answers are optional and are used to make our communications more relevant to you.
Where such an answer relates to your health or physical wellbeing, we treat it as a special category of personal data and process it only on the basis of your explicit consent (Art. 9(2)(a) GDPR). You may withdraw this consent at any time by contacting us.
3. How We Use Your Personal Information
We use your personal information to:
- Process and fulfil orders (payment, shipping, invoices, confirmations)
- Share the information necessary for delivery with our fulfilment partner
- Communicate with you about your order or account
- Manage recurring subscription orders (via Loop Subscriptions)
- Screen for potential fraud and security risks
- Send marketing emails and SMS where you have opted in (via Klaviyo)
- Deliver targeted advertising on Facebook and Instagram (via Meta Pixel)
- Measure advertising performance, including server-side conversion tracking (via WeTracked)
- Analyse Site behaviour to improve user experience (via Microsoft Clarity)
- Collect optional feedback through post-purchase surveys (via Zigpoll)
- Comply with our legal obligations
4. Legal Basis for Processing (GDPR)
We process your personal data on the following legal grounds:
| Purpose | Legal Basis |
|---|---|
| Order fulfilment | Contract performance, Art. 6(1)(b) GDPR |
| Subscription management | Contract performance, Art. 6(1)(b) GDPR |
| Sharing data with our fulfilment partner | Contract performance, Art. 6(1)(b) GDPR |
| Fraud prevention and security | Legitimate interest, Art. 6(1)(f) GDPR |
| Email marketing | Consent, Art. 6(1)(a) GDPR |
| SMS marketing | Consent, Art. 6(1)(a) GDPR |
| Meta Pixel and targeted advertising | Consent, Art. 6(1)(a) GDPR |
| Server-side conversion tracking (WeTracked) | Consent, Art. 6(1)(a) GDPR |
| Microsoft Clarity (session recording) | Consent, Art. 6(1)(a) GDPR |
| Optional survey answers relating to health | Explicit consent, Art. 9(2)(a) GDPR |
| Legal and accounting obligations | Legal obligation, Art. 6(1)(c) GDPR |
You may withdraw consent at any time without affecting the lawfulness of any processing carried out before withdrawal.
5. Third-Party Service Providers
We share your personal data only with trusted third-party service providers necessary to operate our business:
| Provider | Purpose | Privacy Policy |
|---|---|---|
| Shopify | E-commerce platform and order management | https://www.shopify.com/legal/privacy |
| Shopify Payments | Payment processing, including Klarna | https://www.shopify.com/legal/privacy |
| PayPal | Payment processing | https://www.paypal.com/uk/legalhub/privacy-full |
| Loop Subscriptions | Subscription management and recurring billing | https://www.loopwork.co/legal/privacy |
| [FULFILMENT PARTNER: insert legal name] | Order fulfilment and shipping | [insert link] |
| Meta (Facebook / Instagram) | Advertising and remarketing | https://www.facebook.com/privacy/policy/ |
| WeTracked | Server-side conversion tracking and advertising measurement | https://www.wetracked.io/privacy-policy |
| Klaviyo | Email and SMS marketing automation | https://www.klaviyo.com/legal/privacy-notice |
| Microsoft Clarity | Behavioural analytics and session recording | https://privacy.microsoft.com/en-us/privacystatement |
| Zigpoll | Post-purchase surveys | [insert link] |
We do not sell, rent, or share your personal data with third parties for their own marketing purposes. Text messaging opt-in data and consent will not be shared with any third parties, excluding our messaging service provider (Klaviyo).
6. International Data Transfers
Some of our service providers are located outside the European Economic Area and the United Kingdom. In particular, the information necessary to deliver your order, including your name, delivery address, email address, and phone number, is shared with our fulfilment partner, who may be located outside the EEA and the UK.
Where personal data is transferred outside the EEA or the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission or the UK International Data Transfer Agreement, or an applicable adequacy decision.
You may request further information about these safeguards by contacting us at info@dearmartina.com.
7. Cookies
We use the following types of cookies on our Site:
- Essential cookies. Required for the Site to function (cart, checkout, sessions).
- Marketing cookies. Meta Pixel and WeTracked, used for advertising, retargeting, and measuring which advertisements lead to sales.
- Analytics cookies. Microsoft Clarity, used for heatmaps and session behaviour.
- Email and SMS cookies. Klaviyo, used for abandoned cart reminders and email personalisation.
You can manage or disable non-essential cookies through our Cookie Banner on your first visit, or at any time via your browser settings. For more information, visit www.allaboutcookies.org.
8. Behavioural Advertising and Conversion Measurement
We use the Meta Pixel to deliver targeted advertising on Facebook and Instagram. This means ads for Dear Martina products may be shown to you on these platforms after visiting our Site.
In addition, we use WeTracked to transmit conversion information from our server directly to Meta. This is known as server-side tracking or the Conversions API. It allows us to measure which advertisements lead to purchases even where browser-based tracking is blocked. The information transmitted may include your email address, name, address, and IP address in hashed form, together with details of your visit and your order.
Both the Meta Pixel and server-side conversion tracking are activated only after you have given consent via our Cookie Banner.
You can opt out of targeted advertising at any time:
- Facebook / Instagram: https://www.facebook.com/settings/?tab=ads
- General opt-out portal: http://optout.aboutads.info/
9. Microsoft Clarity
We use Microsoft Clarity to record and analyse visitor behaviour on our Site, including heatmaps, session recordings, and interaction tracking. This data helps us identify usability issues and improve your experience.
Clarity may process data on servers outside the EU/EEA. This is subject to Microsoft's Standard Contractual Clauses and appropriate safeguards. Session recording is only activated after you have given consent via our Cookie Banner. For full details, review the Microsoft Privacy Statement at https://privacy.microsoft.com/en-us/privacystatement.
10. UK GDPR
If you are located in the United Kingdom, your personal data is processed in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. You hold the same rights as EU residents as outlined in Section 11 of this policy.
Where your personal data is transferred outside of the UK, we ensure appropriate safeguards are in place (such as the International Data Transfer Agreement or an adequacy decision).
To raise a concern regarding our handling of your data, you may contact the Information Commissioner's Office (ICO): https://ico.org.uk
11. Your Rights
Depending on your location, you have the following rights regarding your personal data:
European Union (GDPR)
- Access. Request a copy of the personal data we hold about you.
- Rectification. Request correction of inaccurate data.
- Erasure. Request deletion of your personal data (right to be forgotten).
- Restriction. Request that we limit how we process your data.
- Portability. Receive your data in a structured, machine-readable format.
- Objection. Object to processing based on legitimate interest.
- Complaint. Lodge a complaint with a supervisory authority.
United Kingdom (UK GDPR)
All rights above apply. Contact the ICO: https://ico.org.uk
Australia (Privacy Act 1988)
- Right to access and correct your personal information
- Right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC): https://www.oaic.gov.au
New Zealand (Privacy Act 2020)
- Right to access and correct your personal information
- Right to lodge a complaint with the Office of the Privacy Commissioner: https://www.privacy.org.nz
Canada (PIPEDA)
- Right to access and correct personal information held about you
- Right to withdraw consent for non-essential processing
- Right to lodge a complaint with the Office of the Privacy Commissioner of Canada: https://www.priv.gc.ca
To exercise any of these rights, please contact us at: info@dearmartina.com
We will respond to all requests within 30 days, or as required by applicable law.
12. Data Retention
We retain your personal data only as long as necessary for the purposes described in this policy:
| Data Type | Retention Period |
|---|---|
| Order records | Up to 10 years (German tax law requirement, §147 AO) |
| Subscription records | For the duration of your subscription, then with order records |
| Email marketing data | Until you unsubscribe or request deletion |
| SMS marketing data | Until you opt out or request deletion |
| Behavioural data (Clarity) | Per Microsoft's data retention policy |
| Conversion data (WeTracked) | Per WeTracked's data retention policy |
| Survey answers | Until you request deletion |
13. SMS / Text Marketing
By entering your phone number and opting in to SMS communications, you agree that Dear Martina (operated by Dear Martina) may send you text notifications and promotional messages, including order updates, abandoned cart reminders, and offers.
Consent to receive SMS is not a condition of purchase.
To unsubscribe, reply STOP to any message. For help, reply HELP. Message and data rates may apply. Message frequency varies.
Text messaging opt-in data and consent will not be shared with any third parties, excluding our SMS service provider (Klaviyo).
14. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, or disclosure. All payment data is processed via PCI DSS-compliant providers (Shopify Payments, PayPal). We do not store full card details on our systems.
Please note that no method of data transmission over the internet is 100% secure, and we cannot guarantee absolute security.
15. Children's Privacy
Our Site is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal information, please contact us immediately at info@dearmartina.com so we can delete it.
16. Business Transfers
If Dear Martina or substantially all of its assets are acquired or transferred, your personal information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Site before your data becomes subject to a different privacy policy.
17. Do Not Track
We do not alter our data collection or processing practices in response to Do Not Track signals from your browser.
18. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will update the "Last updated" date at the top of this page. For significant changes, we will notify you by email where possible.