Who we are
WUFFINGA is a clothing brand operated by McGill Digital Limited, a company registered in England and Wales. For the purpose of UK GDPR, the data controller is McGill Digital Limited.
Questions about this policy: privacy@wuffinga.com.
What we collect
- Order information — name, email, billing and shipping address, phone (for couriers), order contents and value.
- Payment information — processed entirely by Stripe. We never see or store card details.
- Account information — when accounts launch, an email and password hash. We use guest checkout at present and do not require an account.
- Marketing — email address if you opt in to our newsletter, plus interaction data (opens, clicks).
- Advertising measurement: only if you accept cookies, the Meta pixel records pages viewed, items added to cart and purchases, and on purchase we send Meta a hashed (scrambled) copy of your email, phone and postcode so it can tell us which adverts worked. Reject cookies and none of this happens.
- Technical — server logs (IP address, user agent, timestamps) retained 30 days for security and abuse prevention.
Lawful basis
- Contract — to fulfil your order, send order updates, and process returns.
- Legitimate interest — to operate the site, prevent fraud, and analyse aggregated usage.
- Consent — for marketing email and any non-essential cookies. You can withdraw consent at any time.
- Legal obligation — to retain records for tax, accounting, and consumer-rights compliance.
Who we share data with
We use a small set of trusted processors to run the business. Each is bound by a data processing agreement and operates under UK/EU-adequate safeguards.
- Stripe — payment processing.
- Postmark — transactional and marketing email delivery.
- Supabase — order and customer database (EU region).
- Vercel — site hosting and content delivery.
- Royal Mail: delivery and returns (name, address, email, phone).
- Meta Platforms Ireland: advertising measurement, only with your consent.
- HMRC and other regulators — where legally required.
We do not sell your personal data and never will.
How long we keep it
- Order records — 7 years for tax and consumer-law compliance.
- Marketing email — until you unsubscribe.
- Server logs — 30 days.
- Advertising measurement: held by Meta under its own retention rules, typically up to 2 years.
Your rights
Under UK GDPR you have the right to access, correct, delete, port, restrict, or object to our processing of your data. To exercise any of these, email privacy@wuffinga.com from the address on your account or order. We'll respond within one calendar month.
You can also complain to the Information Commissioner's Office (ico.org.uk) if you believe we have mishandled your data.
Cookies
We use one strictly necessary item of browser storage to remember your consent choice. If you accept, Meta's pixel sets its cookies (_fbp, and _fbc when you arrive from an advert) to measure our adverts. If you reject, nothing else is set. To change your mind, clear this site's data in your browser and the banner will ask again.
Changes to this policy
When we update this policy we'll update the date at the top. Material changes affecting your rights will be communicated by email where we hold one for you.