Privacy Policy

1. Who we are

SelloPop is run by Sello Commerce Services Ltd, registered in England and Wales (company number 17516181), 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We are the controller of the personal data described in this policy.

This policy explains how we handle personal data under the UK GDPR, the Data Protection Act 2018 and, for people in the EU and Norway, the EU GDPR.

2. The data we collect

Data you give us

• Account details: name, email address, password (stored only as a secure hash), and your profile picture if you sign in with Google.
• Order details: delivery and billing address, phone number, the items you buy, and your order history.
• Messages: what you send us when you contact support, report a problem or file a claim, including any photos.
• Reviews: ratings, text, photos, videos and fit information you choose to post.
• Preferences: your country, currency, language, saved addresses, wishlist and notification settings.

Data collected automatically

• Device and usage data: IP address, approximate location (country) from your IP address, browser and device type, pages viewed, searches, and items viewed or added to your cart.
• Cookies and similar technologies: see our Cookie Policy.
• App and push data: if you turn on notifications, a device token so we can send them.

Data from others

• Payment providers: confirmation that a payment succeeded, the payment method type, the last four digits and expiry of a card, and fraud-check results. We never receive your full card number.
• Carriers: tracking and delivery updates for your parcel.
• Google: your name, email address and profile picture if you choose to sign in with Google.

3. Why we use your data and our legal bases

Purpose	Data used	Legal basis
Taking and fulfilling your order, including buying items from suppliers, packing and shipping	Account, order and contact details	Performance of our contract with you
Taking payment and issuing refunds	Order and payment confirmation details	Performance of our contract with you
Sending order emails, tracking updates and service messages	Email, phone, order details, device token	Performance of our contract with you
Handling support requests, returns, claims and complaints	Messages, photos, order details	Performance of our contract with you, and our legitimate interest in resolving issues
Customs declarations, VAT records (including IOSS and VOEC) and accounting	Name, address, items, prices, payment records	Legal obligation
Preventing fraud and keeping SelloPop secure	Device and usage data, order and payment details	Our legitimate interest in preventing fraud and abuse, and legal obligation
Showing prices, VAT and delivery times for your country	Country from your IP address or your choice, currency	Our legitimate interest in showing you correct prices
Publishing your reviews and paying review rewards	Reviews, display name, account	Performance of our contract with you
Improving the site with analytics	Usage data, analytics cookies	Your consent
Marketing emails and push notifications about offers	Email, device token, purchase history	Your consent, or for existing customers our legitimate interest in telling you about similar products (you can opt out at any time)
Product safety notices and recalls	Email, order details	Legal obligation and our legitimate interest in keeping you safe

Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details of that balance.

You don’t have to give us your data, but we can’t deliver an order without a name, address and contact details.

4. Automated decisions

Payments are screened automatically by our payment providers’ fraud tools. A payment that looks fraudulent may be declined automatically. If you think this was wrong, contact us and a person will review it.

5. Who we share your data with

We share only what each partner needs. We never sell your personal data.

Recipient	Why	Where
Our payment provider (cards, Apple Pay, Google Pay and other methods shown at checkout)	To take payments and refunds and prevent fraud. The provider may also act as an independent controller for some purposes, as described in its own privacy policy.	EU, UK, US
WP Engine (hosting) and its content delivery and security providers	To host the site, send order and service emails, and protect the site from attacks	EU (Belgium), US
Our warehouse and logistics partner in China	To receive, pack and label your parcel. They receive the items in your order and the name, address, phone number and email on the shipping label.	China
Carriers and postal services in transit and in your country	To transport and deliver your parcel, show tracking updates and send delivery notifications	China, transit countries, your country
Customs and tax authorities	For customs declarations and VAT reporting, as the law requires	Your country, UK, EU, Norway
Professional advisers, and police or regulators	Where needed for legal advice, to comply with the law, or to prevent fraud	As needed

The suppliers we buy your items from do not receive your personal data. Items are delivered to our warehouse partner, not to you directly.

If our business is sold or reorganised, your data may pass to the new owner, who must respect this policy.

6. International transfers

Because your items are packed and shipped from China, and some of our providers are based outside the UK and EU, your data is transferred internationally. We protect it as follows:

• EU and EEA to the UK: the UK is covered by an EU adequacy decision.
• To the United States: we use providers certified under the EU-US Data Privacy Framework and its UK Extension where available, and otherwise standard contractual clauses.
• To China and other countries without an adequacy decision: we use the UK International Data Transfer Agreement or the EU standard contractual clauses with the UK Addendum, together with extra measures such as sending only the minimum data needed for the shipping label. Some transfers to carriers are also necessary to perform our contract with you.

Data held in China is subject to Chinese law, which may allow access by public authorities. We limit what we send there to what is needed to pack and ship your parcel. You can ask us for a copy of the safeguards we use.

7. How long we keep your data

Data	How long
Account details	While your account is open. If your account is inactive for 3 years, we may close it after warning you by email.
Orders, invoices, VAT and customs records	As long as tax and company law require: 6 years after the end of the financial year in the UK, and up to 10 years for EU (IOSS) and Norwegian (VOEC) sales records.
Support messages, claims and photos	3 years after the case is closed
Reviews	While published, or until you ask us to remove them
Marketing preferences	Until you unsubscribe. We keep a short record of your opt-out so we don’t contact you again.
Security and fraud logs	Up to 12 months, unless needed for an investigation
Cookies	See our Cookie Policy

8. How we keep your data safe

We use encrypted connections (HTTPS), restricted staff access, secure password storage and reputable providers. We never store full card numbers. No system is perfectly secure, so if we become aware of a breach that puts you at risk, we will tell you and the regulator as the law requires.

9. Your rights

You have the right to:

• access the personal data we hold about you and get a copy;
• correct data that is wrong or incomplete;
• delete your data, unless we must keep it, for example for tax records;
• restrict how we use your data in some cases;
• port data you gave us to another service in a common format;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, without affecting what we did before;
• ask for a human review of an automated decision.

To use any of these rights, email support@sellopop.com with “Privacy request” in the subject. We may ask you to confirm your identity. We reply within one month. You can unsubscribe from marketing emails using the link in every email, and turn off notifications in your account or device settings.

10. Complaints

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to a data protection authority:

• in the UK, the Information Commissioner’s Office (ico.org.uk, telephone 0303 123 1113);
• in the EU, the data protection authority in the country where you live or work;
• in Norway, Datatilsynet.

11. If you live in the United States

We do not sell your personal information or share it for cross-context behavioural advertising. Depending on your state, you may have rights to know, access, correct and delete your personal information. Email us to use them. We will not treat you differently for using your rights.

12. Children

SelloPop is not intended for children. You must be 18 or over to place an order, and we do not knowingly collect data from children under 16.

13. Changes to this policy

We may update this policy. We will show the date of the latest version below and tell you by email about important changes if you have an account.

14. Contact

Sello Commerce Services Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Email: support@sellopop.com.