Wag & Whistle: Privacy Policy

Last updated: 1 September 2026

We're a small, family-run business selling natural dog treats, and we'd rather explain this plainly than hide behind legal boilerplate. This policy sets out what personal information we collect, why we collect it, what we do with it, and what rights you have over it.

If anything here isn't clear, email hello@wagandwhistle.co.uk and a person will answer.

Who we are

Wag & Whistle is the data controller for the personal information described in this policy. That means we decide what's collected and why, and we're responsible for looking after it.

Our shop runs on Shopify, which hosts the site and processes orders on our behalf.

For anything to do with your personal information, contact us at hello@wagandwhistle.co.uk.

What we collect

Depending on how you use the site, we may hold:

• Contact details: name, email address, delivery and billing address, phone number
• Order information: what you bought, when, order value, delivery method, returns and refunds
• Account information: username and password, saved preferences, order history
• Payment information: we do not see or store your full card number. Payments are handled by Shopify Payments and other payment providers; we only receive confirmation that a payment succeeded, along with the last four digits and card type
• Messages you send us: emails, contact form submissions, reviews
• Subscription details: if you join Join the Pack, your plan, delivery frequency and billing dates
• Technical information: IP address, device and browser type, and how you move around the site
• Marketing preferences: whether you've opted in, and whether you open or click our emails
• Your dog's name, if you choose to tell us at checkout. Entirely optional, and only used to make your order and our messages a bit friendlier

Why we use it, and our legal basis

UK data protection law requires us to have a specific legal basis for each use. Here's ours.

What we do	Legal basis
Take and fulfil your order, arrange delivery, handle returns and refunds	Performance of a contract with you
Manage your account and Join the Pack subscription	Performance of a contract with you
Reply to your emails and questions	Legitimate interests: running a shop people can actually contact
Keep records of sales for tax and accounting	Legal obligation
Prevent and investigate fraud, and keep the site secure	Legitimate interests: protecting the business and our customers
Send you marketing emails	Consent, which you give when you sign up, and can withdraw at any time
Analytics and understanding how the site is used	Consent, through the cookie banner
Improve our products, ranges and website	Legitimate interests: running and improving the business

Where we rely on legitimate interests, we've considered whether it's fair to you, and you can object at any time (see Your rights below).

Marketing emails

We only send marketing emails to people who have asked for them, or who have bought from us and haven't opted out.

Every marketing email has an unsubscribe link. You can also email us and we'll take you off the list. It takes effect straight away, and we'll never ask you to justify it.

Unsubscribing doesn't stop essential messages about an order you've placed, such as order confirmations, dispatch notices and subscription reminders. Those are part of the service, not marketing.

We use Klaviyo to send these emails. Klaviyo can tell us whether an email was opened or a link clicked, which is how we judge whether what we're sending is any use.

Cookies and similar technologies

Cookies are small files stored on your device. We use them in three ways.

Essential cookies keep the site working: your basket, staying logged in, security. The site can't function without them, so they don't require consent.

Analytics cookies tell us which pages are visited and where people give up. Used to improve the site.

Marketing cookies measure whether our emails and any advertising actually work.

The last two only run if you agree via the cookie banner when you first visit. You can change your mind at any time through the cookie settings on the site, or by clearing cookies in your browser.

Cookies on our site are set by us, by Shopify, and by services embedded in our pages (currently our Instagram feed, Klaviyo, and our Trustpilot reviews).

Who we share it with

We don't sell your personal information. We share it only where it's needed to run the shop:

• Shopify: hosts the store, processes orders and payments
• Payment providers: to take payment securely
• Delivery partners, including Royal Mail: name and address, so your parcel arrives
• Klaviyo: email marketing, for subscribers only
• Trustpilot: if you're invited to leave a review
• Our accountant and HMRC: for tax and bookkeeping
• Professional advisers, or authorities, where we're legally required to

Each of these is bound to protect your information and use it only for the purpose we've given it to them.

If the business were ever sold or transferred, customer information would form part of that, and we'd tell you.

Where your information is held

Most is held within the UK and Europe. Some of our providers, including Shopify and Klaviyo, operate in the United States and elsewhere.

Where information leaves the UK, we rely on legally recognised safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, so it keeps a comparable level of protection.

How long we keep it

• Order and transaction records: six years after the end of the financial year they relate to, because tax law requires it
• Account information: while your account is open, and for two years after your last order, then deleted
• Marketing list: until you unsubscribe, plus a minimal record of the fact you opted out, so we don't email you again by accident
• Emails and support messages: two years
• Analytics data: usually up to 14 months, depending on the service

When we no longer need something, we delete it or strip out anything that identifies you.

Your rights

Under UK data protection law you can:

• Ask what we hold about you, and get a copy
• Have mistakes corrected
• Ask us to delete your information, where we're not legally required to keep it
• Ask us to restrict what we do with it while a concern is looked into
• Receive your information in a portable format, or have it sent to another provider
• Object to us using it where we rely on legitimate interests
• Withdraw consent at any time, where consent is what we relied on

Your right to object to direct marketing is absolute. If you tell us to stop, we stop. No conditions.

To exercise any of these, email hello@wagandwhistle.co.uk. We'll respond within one month. We may need to confirm who you are first, so that we're not handing your information to someone else. There's no charge.

Children

Our shop is meant for adults. We don't knowingly collect information about children, and children under 13 can't sign up to our services without a parent or guardian's permission.

If you believe a child has given us their details, email us and we'll delete them.

Complaints

If you're unhappy with how we've handled your information, please tell us first. We'd like the chance to put it right.

You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO) Helpline: 0303 123 1113 ico.org.uk

Changes to this policy

We'll update this policy when our practices change or the law requires it. The revised version goes on this page with a new "last updated" date. If a change materially affects you, we'll tell you directly.

Contact

hello@wagandwhistle.co.uk

Jess & Sam, Wag & Whistle