GDPR Privacy & Cookies Policy

Last updated: 15 July 2026

Mariposa Children’s Boutique respects your privacy and is committed to protecting your personal information. This Privacy & Cookies Policy explains how we collect, use, store, share and protect personal information when you visit, browse or shop at mariposachildrensboutique.com, contact us, create an account, subscribe to marketing or otherwise interact with our business.

This policy is intended to comply with the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and, where applicable, the EU General Data Protection Regulation and relevant international privacy laws.

For the purposes of UK data protection law, Mariposa Children’s Boutique is the data controller responsible for the personal information described in this policy, except where another organisation acts as an independent controller for its own services.

1. Who We Are

Data controller: Mariposa Children’s Boutique

Website: www.mariposachildrensboutique.com

Email: mariposachildrensboutique@hotmail.co.uk

Telephone/WhatsApp: 07706 796618

VAT number: 125 7203 38

If you have a question about this policy or how we use your personal information, please contact us using the details above.

2. Personal Information We Collect

The personal information we collect depends on how you use our website and interact with us. It may include the following categories.

Identity Information

Your name.
Customer account username or account details.
Date of birth or age confirmation where required by a payment provider.
Information used to verify your identity.

Contact Information

Billing address.
Delivery address.
Email address.
Telephone or mobile number.

Order and Transaction Information

Products viewed, ordered, returned or exchanged.
Order numbers and order history.
Purchase value, discounts and promotional codes.
Delivery, collection, return and refund information.
Payment method and payment confirmation.
Fraud-prevention and transaction-verification information.

Full payment-card details are processed securely by our authorised payment providers. Mariposa Children’s Boutique does not ordinarily receive or store your complete card number or card security code.

Technical and Usage Information

Internet Protocol address.
Browser type and version.
Device type and device identifiers.
Operating system.
Time zone and approximate location.
Pages viewed and links selected.
Products viewed or added to your basket.
Referral source and advertising campaign information.
Session information, website interactions and browsing behaviour.
Cookie, pixel, tag and similar technology data.

Marketing and Communication Information

Your preferences for receiving marketing communications.
Your cookie and advertising-consent choices.
Email subscription and unsubscribe records.
Whether marketing emails were delivered, opened or selected.
Your responses to promotions, surveys or competitions.

Customer-Service Information

Messages, emails and WhatsApp communications.
Telephone enquiries.
Returns, complaints and sizing enquiries.
Photographs or other information you voluntarily send to us.
Records of how we handled your enquiry or complaint.

Information from Third Parties

We may receive personal information from organisations that help us operate our website and provide our services, including:

Shopify and Shopify Payments.
PayPal.
Klarna.
Clearpay.
Partial.ly.
Delivery and courier providers.
Google.
Meta, including Facebook and Instagram.
Pinterest.
Omnisend.
Fraud-prevention, analytics and security providers.

We may also receive information when you interact with one of our advertisements, social-media profiles or marketing emails.

3. How We Collect Personal Information

We may collect personal information:

Directly from you when you place an order, create an account, join our mailing list, contact us or submit a return.
Automatically when you browse our website or interact with our emails and advertisements.
From payment providers when they confirm or update a transaction.
From delivery providers when they provide tracking or delivery information.
From advertising, analytics, social-media and marketing platforms.
From publicly available sources where permitted by law.

4. How We Use Your Personal Information

We may use personal information to:

Process, confirm and fulfil your order.
Take and verify payment.
Arrange delivery and provide tracking information.
Process cancellations, returns, exchanges and refunds.
Manage pre-orders, made-to-order items and payment plans.
Create and manage your customer account.
Provide customer service and sizing assistance.
Respond to enquiries, complaints and disputes.
Send order confirmations, dispatch updates and other service messages.
Detect, investigate and prevent fraud, misuse and security incidents.
Protect our website, customers and business.
Comply with legal, regulatory, tax, accounting and reporting obligations.
Maintain appropriate business and transaction records.
Understand how customers use our website.
Improve our website, products, services and customer experience.
Measure website performance and advertising effectiveness.
Attribute sales and other actions to advertising campaigns.
Create statistical reports and aggregated business insights.
Send marketing communications where permitted by law.
Create or use advertising audiences where you have provided any required consent.
Show more relevant advertising on Google, Facebook, Instagram, Pinterest and other platforms.
Suppress existing customers or people who have opted out from certain advertising campaigns where technically available.

5. Our Lawful Bases for Processing

We only process personal information where we have a lawful basis under applicable data protection law.

Contract

We process personal information when it is necessary to enter into or perform a contract with you. This includes processing your order, taking payment, arranging delivery and managing returns or refunds.

Legal Obligation

We process personal information where necessary to meet legal, tax, accounting, consumer-protection, fraud-prevention or regulatory obligations.

Consent

We rely on consent where required, including for certain marketing communications and non-essential cookies, pixels, tags and similar tracking technologies.

You may withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Legitimate Interests

We may process personal information where it is necessary for our legitimate business interests or those of a third party, provided those interests are not overridden by your rights and freedoms.

Our legitimate interests may include:

Operating and improving our business and website.
Providing customer support.
Maintaining accurate business records.
Understanding customer demand and website performance.
Preventing fraud and securing our services.
Protecting and enforcing our legal rights.
Sending limited marketing to existing customers where permitted by electronic-marketing law.

Where consent is legally required for a cookie, advertising technology or marketing communication, we do not rely on legitimate interests instead of obtaining that consent.

6. Marketing Communications

We may send you marketing emails about new collections, pre-orders, special offers, product launches and other Mariposa Children’s Boutique news where:

You have actively subscribed or otherwise consented; or
You previously purchased from us and we are permitted to send marketing about similar products under applicable electronic-marketing rules.

You can unsubscribe at any time by:

Selecting the unsubscribe link in one of our marketing emails.
Changing your preferences where that facility is available.
Emailing mariposachildrensboutique@hotmail.co.uk.

We may retain a limited suppression record after you unsubscribe so that we can respect your preference and avoid sending further marketing. You may still receive essential service messages relating to an order, payment, delivery, return or account.

Our email marketing is currently managed using Omnisend. Omnisend may process contact details, subscription preferences, order information and email-engagement information on our behalf.

7. Advertising, Customer Audiences and Measurement

Subject to your cookie and privacy choices, we may use services provided by Google, Meta and Pinterest to:

Measure visits, purchases and other website actions.
Understand which advertisements led to visits or sales.
Create audiences based on website activity.
Show advertisements to people who have previously visited our website.
Find audiences who may have interests similar to our customers.
Limit or suppress advertising to particular audiences.
Improve and measure the performance of our advertising campaigns.

Where permitted and subject to any required consent, we may securely provide limited customer information, such as an email address or telephone number, to an advertising provider to create a matched audience. The information is generally converted into a coded or hashed format before or during transmission.

Advertising providers may compare the information with details associated with their users. We do not receive access to the identities of additional people included in a provider’s audience.

You can change your cookie choices through our cookie banner or privacy settings and can also adjust advertising preferences directly within your Google, Facebook, Instagram or Pinterest account.

8. Automated Processing and Profiling

We and our service providers may use limited automated processing to:

Detect possible fraud or suspicious transactions.
Personalise website content or product recommendations.
Group website users into advertising or analytical audiences.
Measure the likelihood that an advertisement contributed to a purchase.

Mariposa Children’s Boutique does not ordinarily make solely automated decisions using personal information that produce legal or similarly significant effects on you.

Klarna, Clearpay, PayPal, Shopify Payments, Partial.ly or another payment provider may independently use automated checks to assess identity, fraud risk, affordability, creditworthiness or eligibility. Those providers are responsible for explaining their own processing and decision-making in their privacy notices.

9. Cookies and Similar Technologies

Our website uses cookies and similar storage or access technologies, including pixels, tags, scripts, local storage and software development tools.

A cookie is a small file placed on your device when you visit a website. Similar technologies can store information on your device or access information that is already stored there.

Strictly Necessary Cookies

These technologies are required for services you request or for the secure operation of our website. They may support:

Shopping-basket functionality.
Checkout and payment processing.
Account login and authentication.
Security and fraud prevention.
Remembering privacy and cookie choices.
Website load balancing and essential technical functions.

Strictly necessary technologies do not generally require consent, although we still provide information about their use.

Analytics and Performance Cookies

These technologies help us understand how visitors use our website, which pages are popular, how customers move through the website and whether technical errors occur.

They may be provided by Shopify, Google Analytics or other analytics services. Where legally required, they are only activated after you have provided consent.

Functional Cookies

These technologies allow the website to remember choices such as your country, language, currency, login details or other preferences. Disabling them may prevent some enhanced website features from working properly.

Advertising and Marketing Cookies

These technologies may be used by Google Ads, Meta, Pinterest and other advertising partners to:

Measure advertising conversions.
Attribute orders and visits to advertising campaigns.
Build advertising audiences.
Limit how often an advertisement is shown.
Show advertisements that may be more relevant to your interests.

Advertising and marketing cookies, pixels and similar technologies are only used where we have obtained any consent required by law.

Email Tracking Technologies

Our marketing emails may contain tracking pixels or coded links that help us understand whether an email was delivered, opened or selected. Where required, these technologies are used in accordance with your marketing and privacy choices.

10. Managing Your Cookie Choices

When you first visit our website, you may be shown a cookie banner that allows you to accept, reject or manage non-essential technologies.

You can change your choices through the cookie or privacy settings available on our website. Withdrawing consent does not affect processing carried out before your preferences were changed.

You can also delete or block cookies through your browser settings. Please be aware that blocking strictly necessary cookies may prevent the shopping basket, checkout, account or other website functions from operating correctly.

Browser controls do not always prevent every form of tracking. You may also need to use the privacy settings provided by Google, Meta, Pinterest or another service.

11. Who We Share Personal Information With

We may share personal information with trusted organisations where necessary to operate our website, fulfil orders, provide services, protect our business or comply with the law.

Shopify

Our website is hosted and operated using Shopify. Shopify processes information when you visit our store, create an account, use the checkout or place an order. Depending on the Shopify services and privacy settings enabled, Shopify may act as our service provider or process certain information for its own stated purposes.

Payment and Finance Providers

We may share transaction and order information with payment providers including:

Shopify Payments.
PayPal.
Klarna.
Clearpay.
Partial.ly.
Card networks, banks and fraud-prevention providers.

Payment and finance providers may act as independent data controllers and carry out their own identity, fraud, creditworthiness, affordability or eligibility checks.

Delivery Providers

We may provide your name, delivery address, contact information and order details to Royal Mail, DPD, DHL or another delivery provider used to fulfil your order.

Marketing and Communication Providers

We may share relevant information with Omnisend and other communication providers that help us send and manage emails, marketing preferences and customer communications.

Analytics, Advertising and Social-Media Providers

Subject to your privacy choices, we may share or collect information through:

Google Analytics.
Google Ads.
Google Merchant Center.
Meta, including Facebook and Instagram.
Pinterest.
Other analytics or advertising services that we may use.

Product Feed and Ecommerce Applications

We use Simprosys to help manage and submit product-feed information to services such as Google Merchant Center. Simprosys may process product, store and limited order or conversion information where required to provide its services.

Professional and Legal Recipients

We may disclose personal information to:

Accountants, bookkeepers, legal advisers and insurers.
IT, website, security and technical-support providers.
Government departments, regulators, courts, law-enforcement bodies or tax authorities where required.
A prospective purchaser, successor or adviser in connection with the sale, restructuring or transfer of all or part of our business.

We require service providers acting on our behalf to process personal information only for authorised purposes and to apply appropriate security measures.

12. Sale and Sharing of Personal Information

We do not sell personal information to third parties in exchange for money.

Some privacy laws use broader definitions of “sale”, “sharing” or “targeted advertising” that may include certain disclosures to advertising and analytics providers. Where those laws apply, you may have the right to opt out through our cookie banner, privacy settings or data-sharing opt-out page.

13. Third-Party Privacy Information

Some organisations process personal information under their own terms and privacy policies. We recommend reviewing the relevant provider’s current privacy information:

Third-party websites and services may update their policies independently. Mariposa Children’s Boutique is not responsible for the content or operation of an external provider’s website.

14. International Transfers

Some of our service providers operate internationally or use systems located outside the United Kingdom. As a result, personal information may be accessed from or transferred to countries outside the UK.

Where a restricted international transfer takes place, we or the relevant provider will use an appropriate lawful safeguard where required. Depending on the destination and circumstances, this may include:

A UK adequacy regulation.
The UK International Data Transfer Agreement.
The UK Addendum to the European Commission’s Standard Contractual Clauses.
Another legally recognised transfer mechanism.

Additional technical and organisational measures may also be used where appropriate.

You may contact us if you would like further information about the safeguards relevant to personal information we control.

15. How Long We Keep Personal Information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, regulatory, tax, accounting, fraud-prevention and customer-service requirements.

Typical retention periods include:

Order and transaction records: generally up to 6 years after the end of the relevant accounting period or customer relationship, where required for tax, accounting or legal purposes.
Customer account information: while the account remains active and for a reasonable period afterwards.
Marketing information: until you unsubscribe, withdraw consent or the information is no longer required, subject to retaining a limited suppression record.
Cookie and consent records: for as long as reasonably necessary to demonstrate and respect your choices.
Customer-service communications: for as long as reasonably necessary to respond to enquiries and manage complaints, returns or disputes.
Fraud and security information: for as long as reasonably required to investigate incidents and protect our website and business.

Retention periods may be extended where information is required for an ongoing complaint, legal claim, regulatory enquiry or fraud investigation.

When personal information is no longer required, we will take reasonable steps to delete or anonymise it securely.

16. Children’s Privacy

Although we sell babies’ and children’s clothing, our website, checkout, payment services and marketing subscriptions are intended for adults, parents, guardians and gift buyers.

We do not knowingly collect personal information directly from children. Customers must be aged 18 or over to place an order or use credit and payment-plan services offered through our website.

If you believe that a child has provided personal information to us without appropriate authority or consent, please contact us. We will review the matter and take reasonable steps to delete the information where required.

17. How We Protect Personal Information

We use reasonable and appropriate technical and organisational measures designed to protect personal information against accidental loss, misuse, unauthorised access, disclosure, alteration or destruction.

These measures may include:

SSL and encrypted website connections.
Secure payment processing.
Password-protected accounts.
Access controls and restricted access to customer information.
Security and fraud-prevention tools.
Use of established ecommerce and technology providers.
Reasonable data minimisation and retention practices.

No internet-based service can guarantee absolute security. You are responsible for keeping account passwords and device-access details confidential.

18. Personal Data Breaches

If a personal-data breach occurs, we will assess its nature, scope and potential impact and take appropriate steps to contain and investigate it.

Where required by law, we will notify the Information Commissioner’s Office and affected individuals within the applicable time limits.

19. Your Privacy Rights

Depending on your location and the circumstances, you may have the right to:

Access: request a copy of personal information we hold about you.
Correction: ask us to correct inaccurate or incomplete information.
Erasure: ask us to delete personal information in certain circumstances.
Restriction: ask us to restrict how we process personal information.
Objection: object to processing based on legitimate interests.
Direct-marketing objection: object to direct marketing at any time.
Data portability: receive certain information in a structured, commonly used and machine-readable format.
Withdraw consent: withdraw consent where consent is our lawful basis.
Automated decisions: request safeguards in relation to qualifying solely automated decisions.
Complain: complain to the Information Commissioner’s Office or another relevant regulator.

These rights are not absolute. We may need to retain or continue processing certain information to meet a legal obligation, establish or defend a legal claim, prevent fraud or complete a contract.

20. How to Make a Privacy Request

To exercise a privacy right, email:

mariposachildrensboutique@hotmail.co.uk

Please use the subject line Privacy Request and explain which right you wish to exercise.

We may ask for information reasonably necessary to confirm your identity and locate the relevant records. We will not request more information than is necessary for this purpose.

We normally respond to valid requests within one month. The response period may be extended where a request is particularly complex or numerous, in accordance with applicable law.

We do not normally charge a fee. A reasonable fee may be charged, or a request may be refused, where legally permitted because it is manifestly unfounded or excessive.

21. European Economic Area Customers

If the EU GDPR applies to our processing of your personal information, you may have rights equivalent or similar to those described above.

You may also have the right to complain to the data-protection authority in the European Economic Area country where you live, work or believe an infringement occurred.

22. United States Privacy Rights

Residents of certain US states may have additional rights under applicable state privacy laws. These rights only apply where the relevant law applies to Mariposa Children’s Boutique and to the particular processing activity.

Depending on the applicable law, qualifying residents may have the right to:

Request information about personal information collected, used or disclosed.
Request access to or correction of personal information.
Request deletion of personal information, subject to legal exceptions.
Request a portable copy of certain personal information.
Opt out of qualifying sales, sharing or targeted advertising.
Limit certain uses of sensitive personal information where applicable.
Appeal a decision relating to a privacy request where applicable.
Exercise privacy rights without unlawful discrimination.

We do not knowingly sell or share the personal information of children under 16.

To submit a qualifying US privacy request, email mariposachildrensboutique@hotmail.co.uk using the subject line Privacy Request – US.

You may also use any data-sharing opt-out or privacy-preference facility displayed on our website.

23. Links to Other Websites

Our website may contain links to third-party websites, social-media platforms and services. We do not control and are not responsible for their privacy practices, content or security.

We recommend reviewing the privacy notice of every third-party website or service you use.

24. Complaints

If you are concerned about how we have used your personal information, please contact us first so that we have an opportunity to investigate and resolve your concern.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Make a data-protection complaint to the ICO

You may also contact another appropriate supervisory authority where the law of another country applies.

25. Changes to This Policy

We may update this Privacy & Cookies Policy from time to time to reflect changes to our website, services, payment methods, advertising practices, technology providers or legal obligations.

The latest version will be published on this page with an updated revision date. Material changes may also be communicated through the website or by another appropriate method.