Privacy policy
1. Introduction
WristWorks ("WristWorks," "we," "us," or "our") operates this online store and website (the "Site") and provides related products, content, features, and services (collectively, the "Services").
This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you visit the Site, make a purchase, or otherwise communicate with us. It also describes the rights and choices available to you.
Our Site is hosted and powered by Shopify Inc. ("Shopify"), which processes personal information on our behalf in order to provide the Services.
By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Services.
If there is any conflict between our Terms of Service and this Privacy Policy, this Privacy Policy governs with respect to the collection, processing, and disclosure of personal information.
2. Data Controller
The data controller responsible for your personal information is:
Trading as WristWorks
Email: contactwristworks@gmail.com
3. Personal Information We Collect
"Personal information" means information that identifies, relates to, describes, or can reasonably be linked to you. It does not include anonymised or de-identified data.
Depending on how you interact with the Services, we may collect or process the following categories:
Contact details: name, billing address, shipping address, email address, telephone number.
Order and transaction information: items viewed, added to cart or wishlist, purchased, returned, exchanged, or cancelled; order history; order value; delivery status.
Payment information: payment method, partial card details, transaction confirmation, and billing details. We do not store or have access to your full payment card number. Payment card data is collected and processed directly by our payment providers under their own security standards.
Account information: where you create an account: username, password (stored in encrypted form), preferences, and saved settings.
Communications: the content of emails, contact form submissions, customer service enquiries, product reviews, and any information you choose to provide, including photographs or videos submitted in support of a return or warranty claim.
Device and technical information: IP address, browser type and version, operating system, device identifiers, language settings, referring URL, and time zone.
Usage information: pages visited, time spent, links clicked, search terms entered on the Site, and general interaction patterns.
Marketing preferences: your consent status and subscription choices for email or other marketing communications.
We do not intentionally collect special categories of personal data (such as health data, biometric data, or information revealing racial or ethnic origin, political opinions, religious beliefs, or sexual orientation). Please do not include such information in communications with us. If you voluntarily provide health-related information when describing your use of a product, we will process it only as necessary to respond to your enquiry.
4. Sources of Personal Information
We collect personal information:
- Directly from you: when you place an order, create an account, subscribe to marketing, contact us, submit a review, or otherwise interact with the Services;
- Automatically: through cookies and similar technologies when you browse the Site (see Section 9);
- From service providers: including Shopify, payment processors, shipping carriers, and analytics providers, who collect or process information on our behalf;
- From partners and third parties: including advertising and marketing partners, and fraud prevention services.
5. How We Use Your Personal Information
We process personal information for the following purposes:
To provide the Services and fulfil your order — processing payments, arranging shipping and delivery, communicating order status, managing returns, exchanges, and warranty claims, and maintaining your account.
Legal basis (EEA/UK): performance of a contract.
To communicate with you — responding to enquiries, providing customer support, sending service and transactional messages.
Legal basis: performance of a contract; legitimate interests.
Marketing and advertising — sending promotional emails, showing you relevant advertising on the Site and on third-party platforms, and measuring campaign performance. You may opt out at any time.
Legal basis: consent, or legitimate interests where permitted by law.
Security and fraud prevention — authenticating accounts, detecting and investigating fraudulent, unlawful, or malicious activity, preventing chargeback abuse, and protecting the Services and our customers.
Legal basis: legitimate interests; legal obligation.
Improving the Services — analysing usage, understanding customer preferences, developing new products and features, and improving Site performance.
Legal basis: legitimate interests; consent for non-essential analytics cookies.
Product safety — investigating reports of product faults, injury, or malfunction, and complying with product safety and recall obligations.
Legal basis: legal obligation; legitimate interests.
Legal and compliance — complying with tax, accounting, consumer protection, and other legal obligations; responding to lawful requests from authorities; establishing, exercising, or defending legal claims.
Legal basis: legal obligation; legitimate interests.
We do not use your personal information to make decisions producing legal or similarly significant effects about you based solely on automated processing.
6. How We Disclose Personal Information
We do not sell your personal information for money. We may disclose personal information in the following circumstances:
Service providers and processors — including Shopify (e-commerce platform and hosting), payment processors, shipping and fulfilment carriers, email and marketing platforms, analytics providers, cloud storage providers, and customer support tools. These parties process personal information on our instructions and are contractually bound to protect it.
Advertising and analytics partners — we may share limited information, including online identifiers and browsing activity, with advertising partners to deliver and measure personalised advertising. Under certain US state privacy laws, this activity may be considered a "sale" or "sharing" of personal information for targeted advertising purposes. You may opt out as described in Section 11.
At your direction or with your consent — for example, where you use a social media integration or ask us to share information with a third party.
Legal and regulatory — where required to comply with applicable law, respond to valid legal process (including subpoenas and court orders), cooperate with law enforcement or regulatory authorities, enforce our Terms of Service, protect against fraud, or establish, exercise, or defend legal claims.
Business transfers — in connection with a merger, acquisition, restructuring, financing, insolvency, or sale of assets, in which case personal information may be transferred as part of the transaction.
7. Relationship with Shopify
The Services are hosted by Shopify, which collects and processes personal information relating to your access to and use of the Services in order to provide and improve the platform.
Information you submit through the Services is transmitted to and shared with Shopify, and may be processed in countries other than the one in which you reside. We also use certain Shopify enhanced features that incorporate data from your interactions with our store, with other merchants, and with Shopify. For those features, Shopify acts as the party responsible for the processing, including in responding to requests to exercise your rights.
To learn more about Shopify's handling of personal information, see the Shopify Consumer Privacy Policy at https://www.shopify.com/legal/consumer-privacy-policy and the Shopify Privacy Portal at https://privacy.shopify.com.
8. International Transfers
We are based in Spain and serve customers worldwide. Your personal information may be transferred to, stored in, and processed in countries other than your own, including the United States, which may have data protection laws different from those in your jurisdiction.
Where we transfer personal information out of the European Economic Area or the United Kingdom, we rely on an appropriate safeguard, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or a transfer to a country recognised as providing an adequate level of protection.
You may request further information about the safeguards applied by contacting us at contactwristworks@gmail.com.
9. Cookies and Similar Technologies
We and our service providers use cookies, pixels, tags, and similar technologies to operate the Site, remember your preferences, keep your cart, analyse traffic, and deliver relevant advertising.
Strictly necessary cookies are required for the Site to function and cannot be disabled.
Functional cookies remember your choices and preferences.
Analytics cookies help us understand how the Site is used.
Advertising cookies are used to show you relevant advertisements and measure their effectiveness.
Where required by law, we request your consent before placing non-essential cookies, and you may change your preferences at any time through the cookie banner or settings link on the Site. You may also configure your browser to refuse or delete cookies, though this may affect Site functionality.
Global Privacy Control: where the law requires it, we treat a Global Privacy Control (GPC) signal received from your browser as a valid request to opt out of the sale or sharing of personal information for the device and browser concerned. We do not currently respond to other "Do Not Track" signals.
10. Retention
We retain personal information only for as long as necessary for the purposes described in this Policy, including:
- Order and transaction records — for the period required by tax, accounting, and commercial law (in Spain, generally up to six years, and longer where required for VAT or customs purposes);
- Account information — for as long as your account remains active, and for a reasonable period afterwards;
- Marketing data — until you withdraw consent or object, and for a short period afterwards to record your opt-out;
- Customer service and warranty records — for the duration of the applicable warranty and limitation periods;
- Fraud and security records — for as long as necessary to protect against recurrence.
When personal information is no longer required, we delete it or irreversibly anonymise it.
11. Your Rights and Choices
Depending on where you live, you may have some or all of the following rights. These rights are not absolute and may be subject to conditions and exceptions under applicable law.
Right of access — to obtain confirmation of whether we process your personal information and to receive a copy of it.
Right to rectification — to have inaccurate or incomplete information corrected.
Right to erasure — to request deletion of your personal information in certain circumstances.
Right to restriction — to request that we limit our processing in certain circumstances.
Right to data portability — to receive your personal information in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible.
Right to object — to object to processing based on legitimate interests, and to object at any time to processing for direct marketing purposes.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand.
Right to non-discrimination — we will not discriminate against you for exercising your privacy rights.
Additional rights for United States residents
If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, or another state with applicable privacy legislation, you may also have:
- The right to know the categories and specific pieces of personal information collected, the sources, the purposes, and the categories of third parties to whom it is disclosed;
- The right to opt out of the sale or sharing of personal information, and of processing for targeted advertising;
- The right to limit the use and disclosure of sensitive personal information;
- The right to appeal a refusal of your request.
To opt out of the sale or sharing of your personal information for targeted advertising, use the "Do Not Sell or Share My Personal Information" link on the Site, enable Global Privacy Control in your browser, or email contactwristworks@gmail.com.
You may use an authorised agent to submit a request on your behalf. We will require written proof of the agent's authority and may require you to verify your identity directly with us.
How to exercise your rights
Email contactwristworks@gmail.com stating the right you wish to exercise. We may need to verify your identity before acting on a request, and we may decline a request where permitted or required by law. We will respond within the timeframe required by applicable law.
Marketing communications
You may unsubscribe from promotional emails at any time using the link in any such email, or by emailing us. You will continue to receive transactional and service messages relating to your orders.
12. Security
We implement appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration, or disclosure. These include encryption in transit, access controls, and reliance on established platform and payment providers.
However, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us promptly of any suspected unauthorised use. We recommend that you do not transmit sensitive or confidential information to us through unsecured channels.
13. Children's Privacy
The Services are not directed to children, and we do not knowingly collect personal information from anyone under the age of 16, or under the age of majority in your jurisdiction where that age is higher.
We do not knowingly sell or share the personal information of individuals under 16 years of age.
If you are a parent or guardian and believe a child has provided us with personal information, please contact contactwristworks@gmail.com and we will take steps to delete it.
14. Third-Party Websites and Links
The Services may contain links to websites or platforms operated by third parties. We do not control those sites and are not responsible for their privacy practices, content, security, or accuracy. We recommend that you review the privacy policy of any third-party site you visit.
Information you post in public or semi-public areas, including reviews or third-party social platforms, may be visible to others and may be used by them.
15. Complaints
If you have a concern about how we handle your personal information, please contact us first at contactwristworks@gmail.com so that we can address it.
If you are not satisfied with our response and you are located in the EEA or the UK, you have the right to lodge a complaint with your local data protection supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (www.aepd.es). A list of EEA supervisory authorities is available at https://edpb.europa.eu/about-edpb/board/members_en. In the UK, this is the Information Commissioner's Office (www.ico.org.uk).
Residents of certain US states may have the right to appeal a decision on a privacy request. To appeal, reply to our decision at contactwristworks@gmail.com with the word "Appeal" in the subject line.
16. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will post the revised version on this page and update the "Last updated" date. Where required by law, we will provide additional notice or seek your consent.
17. Contact
For any question about this Privacy Policy or to exercise your rights: