Privacy Policy

Last updated

1. Introduction

This Privacy Policy explains how The Shopify Workshop (“we”, “us”, “our”, or the “Company”) collects, uses, stores and protects your personal information when you visit our website at theshopifyworkshop.com (the “Website”), contact us, or work with us. We handle personal data openly and only for clear purposes, in line with the data protection laws that apply to it — including the UK GDPR and Data Protection Act 2018, the EU GDPR, and India’s Digital Personal Data Protection Act 2023 (the “DPDP Act”).

Please read this Policy together with our Terms & Conditions. If anything here is unclear, contact us using the details at the end.

2. Who We Are

For the personal data described in this Policy, The Shopify Workshop is the “data controller” (a “data fiduciary” under the DPDP Act): we decide why and how it is used.

When we build or support a client’s store, website or app, we may also handle personal data on that client’s behalf. In that case the client is responsible for it and we act as their processor — see section 14.

3. Information We Collect

We only collect what we need to answer your enquiry and deliver our services:

  • Enquiry details: what you enter in our enquiry and proposal forms — your name, email address, phone number and message, and, if you choose to give them, your company, the services you are interested in, your budget and your timeline.
  • Communications: emails, WhatsApp messages, calls and meeting notes exchanged with us.
  • Technical data: your IP address, which our forms record to help detect spam and abuse, and the page you sent the form from.
  • Usage data: anonymous statistics about how our Website is used — see section 8.
  • Project information: information a client shares with us to deliver a project, which may include business details and access to platforms such as Shopify (always handled confidentially).

We do not ask for sensitive personal data (such as health or financial account details), and we ask that you do not send it through our forms.

4. How We Use Your Information

We use personal information to:

  • Reply to your enquiries, quote requests and messages.
  • Prepare proposals and deliver, manage and improve our services.
  • Send project updates and service-related communications.
  • Keep a record of enquiries so we can follow them up.
  • Protect our Website against spam, fraud and abuse.
  • Meet our legal, tax and accounting obligations.

We do not sell your personal data, and we only send marketing emails to people who have opted in to receive them.

5. Legal Bases for Processing

Under the UK and EU GDPR we rely on these legal bases:

  • Contract: when you ask us for a proposal or quote (steps before a contract), and when we deliver services you have engaged us for.
  • Legitimate interests: to answer general enquiries, keep records of our conversations, run, secure and improve our Website (including spam protection and anonymous usage statistics) and improve our services — always in ways that do not override your rights.
  • Consent: for optional marketing emails and any non-essential cookies we might introduce. You can withdraw consent at any time.
  • Legal obligation: where the law requires us to keep or disclose information, such as tax and accounting records.

Under the DPDP Act, we process the personal data you give us voluntarily for the purpose you gave it for (for example, replying to your enquiry), or with your consent. Where we rely on consent, you can withdraw it as easily as you gave it.

6. Forms and Enquiries

When you submit a form on our Website, we collect the details you provide together with your IP address and the page you sent it from, to help us respond and to detect spam. Submissions are stored securely as enquiry records in our website’s content management system, where only our team can see them, and may also be emailed to our team so we can reply. To reduce spam, our forms use automated checks (a hidden field and a timing check) and limit how many messages can be sent in a short time; we do not use third-party CAPTCHA services.

7. Cookies and Tracking Technologies

Our Website uses the cookies it needs to work — for example, to keep our own team signed in to our content management system — and, only if you accept them, Google Analytics cookies that help us understand how the Website is used (see section 8). When you first visit, a notice lets you accept or decline them; until you accept, no analytics cookies are set. You can change your choice at any time with the “Cookie settings” link at the bottom of every page. We do not use advertising cookies.

You can control or delete cookies at any time in your browser settings.

8. Analytics

To understand how our Website is used, we run our own privacy-friendly analytics on our own servers, which uses no cookies and does not follow you around the web.

When a page loads, we record the page address, the website or campaign link that brought you (if any), your device type, browser and operating system, and — where our hosting provider supplies it — your country. To count unique visitors without identifying anyone, your IP address and browser details are combined with a secret value that changes every day into a one-way code; the IP address itself is never stored, and the code cannot be linked from one day to the next or back to you. Visits by our team while signed in to our content management system are not counted.

These statistics are anonymous and kept for up to 13 months, then deleted automatically. They are never sold or shared.

We also use Google Analytics 4, a service provided by Google, to measure visits and how pages perform. It sets cookies only if you accept them. Until then, or if you decline, it receives only limited signals without cookies (Google Consent Mode), which Google uses to estimate overall usage. Google handles this data under its own privacy policy (policies.google.com/privacy). We do not use Google Analytics for advertising.

9. Third-Party Services

We rely on trusted providers to run our Website and deliver our work, including:

  • Hosting, database and email providers: to host the Website, store enquiry records and send notifications.
  • Analytics: Google Analytics, to measure how the Website is used (with cookies only if you accept them).
  • Communication tools: such as WhatsApp, if you choose to contact us that way.
  • Project platforms: such as Shopify and the tools a client asks us to use on their project.

These providers handle data under their own terms and privacy policies. We share only what each one needs, and we never sell your data.

10. How We Share Your Data

We do not sell, rent or trade personal information. We share it only:

  • With the providers described above, who help us run the Website and our services.
  • With trusted subcontractors working on a project with us, who are bound by confidentiality.
  • Where required by law, a court order or a lawful request from an authority.
  • To protect our rights, property or safety, or those of others.
  • If our business is reorganised or sold, with the new owner, who must continue to protect it as this Policy describes.

11. How Long We Keep Your Data

We keep personal data only for as long as we need it:

  • Enquiries that do not become a project: up to 24 months from our last contact, so we can pick up the conversation if you come back to us.
  • Client and project records: for as long as we work together, then for as long as tax, accounting and other legal obligations require — usually up to 8 years.
  • Marketing preferences: until you unsubscribe or withdraw consent; we keep a note of the opt-out so we respect it.

When we no longer need data, we delete it securely or anonymise it.

12. How We Protect Your Data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or disclosure — including encrypted connections, limiting access to the people in our team who need it, and removing access to client systems when a project ends. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security, but we will tell you and the relevant authority about a breach where the law requires it.

13. International Data Transfers

We work with clients and providers around the world, so your information may be processed in a country other than your own, including India, where our team is based. When personal data leaves the UK or the European Economic Area, we protect it with safeguards the law recognises — such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses — or rely on an adequacy decision where one exists.

14. When We Work With Our Clients’ Data

While building or supporting a client’s store, website or app, we may be able to see personal data about that client’s own customers — for example, orders in a Shopify admin. That client is responsible for the data and we act as their processor: we use it only to deliver the agreed work and on their instructions, keep it confidential, and return or delete it when the work ends. We are happy to sign a data processing agreement. If you are one of our client’s customers, please contact that business about your data.

15. Your Rights

Depending on where you live, you may have the right to:

  • Access: ask for a copy of the personal data we hold about you.
  • Correction: ask us to correct inaccurate or incomplete data.
  • Erasure: ask us to delete your data, unless we must keep it by law.
  • Restriction: ask us to limit how we use your data.
  • Objection: object to processing based on our legitimate interests, and to marketing at any time.
  • Portability: receive your data in a portable format.
  • Withdraw consent: where we rely on consent.
  • Nomination (India): nominate someone to exercise your rights if you are unable to.

To exercise any of these rights, email us using the details below. We may need to confirm your identity first. We reply within one month (or sooner where the law requires), and there is normally no fee.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to your data protection authority — in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, the authority in your country; in India, the Data Protection Board of India, once you have raised the matter with us.

16. Automated Decisions

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you.

17. Children’s Privacy

Our Website and services are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, please contact us and we will delete it.

18. Links to Other Websites

Our Website may link to other websites. We are not responsible for their content or privacy practices, so please read their privacy policies before sharing any personal information with them.

19. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or the law. The latest version will always be on this page with its “Last updated” date, and we will tell you directly about significant changes where we have a way to do so.

20. Contact Us

For any question, request or complaint about your personal data, contact us (please put “Privacy” in the subject line):

The Shopify Workshop