Privacy Policy

SECRETBADDIE

Privacy Policy

Last updated: March 13, 2026

At SecretBaddie ('we', 'us', 'our'), your privacy is not just a legal obligation — it is a core value. This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit secretbaddie.com or make a purchase from our store. By using our website, you agree to the practices described in this Policy.

This Policy is compliant with the General Data Protection Regulation (GDPR), the UK GDPR, and other applicable data protection laws. If you have any questions, please contact us at privacy@secretbaddie.com.

1. Who We Are (Data Controller)

SecretBaddie is the data controller responsible for your personal information. For the purposes of the GDPR, we are registered as an online retailer specialising in lingerie and intimate apparel.

Contact details:

• Business name: SecretBaddie
• Email: privacy@secretbaddie.com
• Website: secretbaddie.com

2. What Personal Data We Collect

We collect only the data necessary to provide you with our services. This includes:

2.1 Data you provide directly

• Full name
• Email address
• Delivery and billing address
• Phone number (optional, for delivery notifications)
• Payment information (processed securely via Shopify Payments / Stripe — we do not store card details)
• Account login credentials (if you create an account)
• Any messages you send us via email or contact forms

2.2 Data collected automatically

• IP address and approximate location
• Browser type, device type, and operating system
• Pages visited, time spent on site, and referring URL
• Cookie identifiers and session data
• Purchase history and browsing behaviour on our site

2.3 Data from third parties

We may receive limited data from payment processors, shipping carriers, and analytics providers in connection with your orders or interactions with our site.

3. Why We Collect Your Data (Legal Basis)

Under the GDPR, we must have a lawful basis for processing your personal data. We rely on the following:

Contractual necessity (Art. 6(1)(b) GDPR)

We process your name, address, payment, and contact details to fulfil your orders, process returns, and provide customer support.

Legitimate interests (Art. 6(1)(f) GDPR)

We use browsing data and purchase history to improve our website, prevent fraud, and send you relevant product recommendations. We have balanced these interests against your rights and concluded they do not override them.

Consent (Art. 6(1)(a) GDPR)

If you opt in to marketing emails or enable non-essential cookies, we process your data on the basis of your consent. You may withdraw consent at any time.

Legal obligation (Art. 6(1)(c) GDPR)

We retain certain financial and transactional records to comply with tax, accounting, and consumer protection laws.

4. How We Use Your Data

• To process and fulfil your orders, including sending confirmation and shipping notifications
• To manage your account (if created)
• To respond to your queries, complaints, or return requests
• To send marketing emails if you have opted in (you can unsubscribe at any time)
• To personalise your shopping experience and show you relevant products
• To detect and prevent fraud, chargebacks, and abuse
• To improve our website based on analytics data
• To comply with our legal and regulatory obligations

5. Cookies and Tracking Technologies

We use cookies and similar technologies on our website. Cookies are small text files stored on your device that help us operate the site, remember your preferences, and understand how visitors use our store.

Types of cookies we use:

• Essential cookies — required for the website to function (shopping cart, checkout, login sessions)
• Analytics cookies — help us understand traffic and user behaviour (e.g. Google Analytics)
• Marketing/advertising cookies — used for personalised advertising and retargeting (e.g. Meta Pixel, Google Ads)
• Preference cookies — remember your language, currency, and settings

You can manage or withdraw your cookie consent at any time via our Cookie Settings banner or your browser settings. Blocking essential cookies may affect your ability to use the site.

6. Sharing Your Data with Third Parties

We do not sell your personal data. We share it only with trusted third parties who help us operate our business, under strict data processing agreements:

Service providers we use may include:

• Shopify Inc. — our e-commerce platform and hosting provider (Shopify is GDPR-compliant and certified under ISO 27001)
• Stripe / PayPal / Klarna — secure payment processing (PCI-DSS Level 1 compliant)
• DHL / Royal Mail / DPD / other carriers — for order delivery
• Mailchimp / Klaviyo — email marketing (only if you have opted in)
• Google Analytics / Meta Pixel — website analytics and advertising (anonymised where possible)
• Accounting and legal advisors — for compliance purposes, under confidentiality agreements

All third parties are required to handle your data in accordance with applicable data protection laws. We do not permit them to use your data for their own marketing purposes.

7. International Data Transfers

Some of our service providers may process your data outside the European Economic Area (EEA) or United Kingdom. In such cases, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Transfers to countries recognised by the European Commission as providing adequate protection
• Certification under recognised frameworks (e.g. EU-US Data Privacy Framework where applicable)

You may request further information about international data transfers by contacting privacy@secretbaddie.com.

8. How Long We Keep Your Data

We retain your personal data only for as long as necessary for the purposes described in this Policy:

• Order and transaction data: 7 years (required by UK/EU tax law)
• Account data: until you close your account, plus 12 months
• Marketing preferences: until you unsubscribe or withdraw consent
• Analytics data: typically 14–26 months depending on the platform
• Customer support communications: 3 years from last contact

When data is no longer needed, we delete or anonymise it securely.

9. Your Rights Under GDPR

If you are located in the EU or UK, you have the following rights regarding your personal data:

• Right of access — you may request a copy of the personal data we hold about you
• Right to rectification — you may ask us to correct inaccurate or incomplete data
• Right to erasure ('right to be forgotten') — you may request deletion of your data, subject to certain legal obligations
• Right to restrict processing — you may ask us to limit how we use your data
• Right to data portability — you may request your data in a structured, machine-readable format
• Right to object — you may object to processing based on legitimate interests or for direct marketing
• Rights related to automated decision-making — we do not make fully automated decisions that significantly affect you
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing

To exercise any of these rights, please contact us at privacy@secretbaddie.com. We will respond within 30 days. We may need to verify your identity before processing your request. You also have the right to lodge a complaint with your national data protection authority (e.g. the ICO in the UK, or your local supervisory authority in the EU).

10. Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures, including:

• SSL/TLS encryption on all pages (HTTPS)
• PCI-DSS compliant payment processing — we never store your full card details
• Access controls limiting who within our team can access personal data
• Regular review of our data handling practices and security measures
• Shopify's enterprise-grade security infrastructure

No data transmission over the internet can be guaranteed 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by law (within 72 hours where feasible).

11. Children's Privacy

Our website and products are intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us immediately at privacy@secretbaddie.com and we will delete it promptly.

12. Marketing Communications

We will only send you marketing emails if you have given us your explicit consent (e.g. by ticking an opt-in box at checkout or on our website). Each marketing email will include an unsubscribe link. You can also opt out at any time by:

• Clicking 'Unsubscribe' in any of our emails
• Contacting us at privacy@secretbaddie.com
• Updating your preferences in your account settings

Opting out of marketing will not affect transactional communications related to your orders.

13. Links to Third-Party Websites

Our website may contain links to third-party websites, including social media platforms (Instagram, TikTok, Pinterest). We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before providing any personal data.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make significant changes, we will:

• Update the 'Last updated' date at the top of this page
• Display a notice on our website or send you an email notification (if the changes materially affect your rights)

We encourage you to review this Policy periodically. Your continued use of our website after changes are posted constitutes your acceptance of the updated Policy.

15. How to Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we handle your data, please contact us:

• Email: privacy@secretbaddie.com
• Website: secretbaddie.com/pages/contact

We aim to respond to all enquiries within 5 business days.

© 2026 SecretBaddie. All rights reserved.