GDPR Privacy & Cookies Policy

Last updated: May 2026

Mariposa Children’s Boutique respects your privacy and is committed to protecting your personal data. This Privacy & Cookies Policy explains how we collect, use, store and protect your information when you visit or shop with us at www.mariposachildrensboutique.com.

This policy is written in line with the UK GDPR, EU GDPR, Data Protection Act 2018 and applicable privacy and electronic communications rules.

1. Who We Are

Data Controller: Mariposa Children’s Boutique

Email: mariposachildrensboutique@hotmail.co.uk

Telephone / WhatsApp: 07706 796618

VAT Number: 125 7203 38

2. Personal Data We Collect

We may collect and process the following personal data:

Identity Data: your name and customer account details.
Contact Data: billing address, delivery address, email address and telephone number.
Transaction Data: order details, products purchased, payment confirmation and refund information.
Technical Data: IP address, browser type, device type, operating system, website usage and cookie data.
Marketing & Communication Data: your preferences for receiving marketing emails, offers and updates.
Customer Service Data: messages, enquiries, returns requests and communication history.

Payment card details are processed securely by trusted third-party payment providers such as Shopify Payments, PayPal or Klarna. We do not store your full card details.

3. How We Use Your Personal Data

We use your personal data for the following purposes:

To process and fulfil your order.
To arrange delivery, returns, exchanges and refunds.
To respond to customer service enquiries.
To manage your customer account, where applicable.
To send order confirmations, dispatch updates and important service messages.
To send marketing emails, offers or updates where you have given consent.
To improve our website, products, customer experience, marketing and advertising performance.
To comply with legal, tax, accounting and fraud prevention obligations.

4. Our Lawful Basis for Processing

We only process your personal data where we have a lawful basis to do so. These may include:

Contract: to process and deliver your order.
Legal Obligation: to keep business, tax and accounting records.
Consent: where you choose to receive marketing emails or accept non-essential cookies.
Legitimate Interest: to improve our services, prevent fraud, manage customer enquiries and understand how customers use our website.

5. Marketing Communications

We will only send you marketing emails if you have subscribed, opted in, or where we are otherwise permitted by law to do so.

You can unsubscribe from marketing emails at any time by clicking the unsubscribe link in our emails or contacting us at mariposachildrensboutique@hotmail.co.uk.

6. Cookies & Similar Technologies

Our website uses cookies and similar technologies to help the website work correctly, improve your browsing experience, analyse website traffic and support advertising.

Cookies are small text files stored on your device when you visit a website.

Types of Cookies We Use

Essential Cookies: required for the website, shopping basket, checkout and security features to function.
Performance Cookies: help us understand how visitors use our website, such as through Google Analytics.
Functional Cookies: remember preferences such as location, currency or browsing settings.
Marketing Cookies: used by platforms such as Meta/Facebook, Google Ads and Pinterest to help show relevant adverts and measure advertising performance.

Essential cookies may be used without consent because they are required for the website to function. Non-essential cookies, including analytics and marketing cookies, are only used where required after you have given consent through our cookie banner or cookie settings.

You can manage or disable cookies through your browser settings. Please note that disabling some cookies may affect website features, including the shopping basket and checkout.

7. Who We Share Your Data With

We only share your personal data where necessary to operate our business, fulfil your order, provide services or comply with legal obligations.

We may share data with trusted third-party service providers, including:

Shopify: website and ecommerce platform.
Payment Providers: Shopify Payments, PayPal, Klarna and other secure payment processors.
Delivery Providers: Royal Mail, DPD, DHL or other courier services.
Marketing & Email Providers: Mailchimp, Klaviyo or similar platforms, where used.
Analytics & Advertising Providers: Google Analytics, Google Ads, Meta/Facebook Ads, Pinterest and similar platforms.
Professional Advisers: accountants, legal advisers or insurers where required.

We do not sell your personal data to third parties.

8. Third-Party Privacy Policies

Some third-party providers process your personal data in accordance with their own privacy policies. You can review their privacy information below:

9. International Data Transfers

Some of our third-party service providers may process personal data outside the UK or European Economic Area. Where this happens, appropriate safeguards are used to protect your personal data in line with GDPR requirements.

10. How Long We Keep Your Data

We keep personal data only for as long as necessary for the purpose it was collected, including to meet legal, tax, accounting, reporting or customer service requirements.

Order and transaction records: usually kept for up to 6 years for legal, tax and accounting purposes.
Marketing data: kept until you unsubscribe or withdraw consent.
Customer service messages: kept for as long as reasonably necessary to manage enquiries, disputes or service records.

We review the personal data we hold periodically and securely delete or anonymise data when it is no longer required.

11. Children’s Privacy

Although we sell children’s clothing, our website and checkout are intended for use by adults, parents, guardians and gift buyers.

We do not knowingly collect personal data directly from children. If you believe a child has provided personal data to us without appropriate consent, please contact us and we will take reasonable steps to delete it where required.

12. How We Protect Your Data

We take appropriate steps to protect your personal data, including secure website technology, SSL encryption, secure payment processing and restricted access to customer information.

While no online service can be guaranteed to be completely secure, we work with trusted platforms and providers to help keep your information safe.

13. Data Breaches

If a personal data breach occurs, we will assess the risk and take appropriate action. Where legally required, we will notify affected individuals and relevant authorities, including the Information Commissioner’s Office.

14. Your Privacy Rights

Under UK GDPR and applicable data protection laws, you may have the right to:

Access the personal data we hold about you.
Request correction of inaccurate personal data.
Request deletion of your personal data.
Object to certain types of processing.
Request restriction of processing.
Request data portability.
Withdraw consent at any time where processing is based on consent.
Object to direct marketing.
Opt out of certain targeted advertising activities, depending on your location.

To exercise your privacy rights, including access, correction, deletion, portability or objection to processing, please email us at mariposachildrensboutique@hotmail.co.uk with the subject line Privacy Request.

15. California & US Customers

If you are a resident of California or certain other US states, you may have additional privacy rights under applicable US privacy laws, including the California Consumer Privacy Act and California Privacy Rights Act.

These may include:

Right to Know: you may request details about the personal information we collect, use and disclose.
Right to Delete: you may request deletion of personal information we hold, subject to legal exceptions.
Right to Opt Out: you may opt out of the sale or sharing of personal information or certain targeted advertising activities. Mariposa Children’s Boutique does not sell personal data.
Right to Non-Discrimination: we will not discriminate against you for exercising your privacy rights.

To exercise US privacy rights, please email mariposachildrensboutique@hotmail.co.uk with the subject line Privacy Request – US.

16. Links to Other Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices, security or content of those websites. We recommend reviewing the privacy policy of any third-party website you visit.

17. Complaints

If you are unhappy with how we handle your personal data, please contact us first so we can try to resolve your concern.

You also have the right to lodge a complaint with the Information Commissioner’s Office, the UK data protection regulator.

Contact the ICO or make a complaint

18. Changes to This Policy

We may update this Privacy & Cookies Policy from time to time to reflect changes in our business, website, legal requirements or third-party providers.