Privacy policy

Last updated: 15 October 2026

At Whisker & Wildcard, we take your privacy seriously. Whether you're browsing our Pokémon collection, placing an order or getting in touch, we want you to understand how your personal information is used and protected.

This Privacy Policy explains what information we collect, why we collect it, who we share it with and the rights you have under UK data protection law.

1. Who we are

This website is operated by:

Whisker & Wildcard Ltd
Trading as Whisker & Wildcard

Company registration number: 17361781
Registered in: England and Wales
Email: ollie@whiskerandwildcard.com

Whisker & Wildcard Ltd is the data controller for personal information we process when operating our store, except where another organisation acts as an independent controller.

Our website is powered by Shopify, which provides ecommerce technology, hosting and associated services.

2. Information we collect

Depending on how you interact with our website, we may collect:

  • Contact information: Your name, email address, telephone number and billing or delivery address.

  • Order information: Products purchased, order history, payment confirmation, returns and refunds.

  • Payment information: Payment method, transaction details and payment status. Payment card information is handled through our payment service providers.

  • Account information: Account details and preferences where customer accounts are used.

  • Communications: Information you provide when contacting us about products, orders or other enquiries.

  • Technical information: IP address, device and browser information, and website activity.

  • Marketing preferences: Your choices about receiving promotional communications and, where applicable, cookie consent.

We only seek information reasonably necessary for the purposes described in this policy.

3. How we collect information

We may receive personal information:

  • Directly from you when you place an order, create an account, subscribe to marketing or contact us.

  • Automatically when you browse our website, including through cookies and similar technologies.

  • From Shopify, payment processors, delivery providers and other service providers involved in operating our store.

  • From third-party integrations where these are enabled and permitted by law.

4. How and why we use your information

Under UK GDPR, we must have a lawful basis for processing personal data.

The lawful bases we rely on depend on the purpose.

Purpose Lawful basis
Processing purchases, arranging delivery and handling contractual returns Performance of a contract
Responding to pre-purchase enquiries and customer support requests Contractual necessity or legitimate interests, depending on the enquiry
Maintaining tax, accounting and other legally required records Legal obligation
Detecting fraud, securing our website and protecting our business Legitimate interests or legal obligation, as applicable
Improving our website and understanding customer experience Legitimate interests where lawful, or consent where required
Sending promotional emails Consent or another lawful basis permitted under UK electronic marketing rules
Using non-essential advertising or analytics cookies Consent where required by applicable law

Where we rely on legitimate interests, these include operating a secure, reliable business, preventing fraud, responding to enquiries and improving our services. We consider these interests against the rights and freedoms of affected individuals.

We do not rely on consent where another lawful basis is more appropriate, and we do not treat acceptance of this policy as consent to optional marketing or tracking.

5. Payments

Payments are processed using payment services available through Shopify.

Our payment providers process relevant payment information to authorise transactions, prevent fraud and complete purchases.

We receive information such as transaction status and payment confirmation to manage orders.

We do not need access to your full payment card number to fulfil an order.

Payment providers may act as independent data controllers for certain activities and may have their own privacy notices.

6. Sharing your information

We may share personal information with trusted third parties where necessary to operate our business.

These can include:

  • Shopify: Website hosting, checkout, order management and related ecommerce services.

  • Payment providers: Payment authorisation, transaction processing and fraud prevention.

  • Royal Mail and other delivery providers: Information needed to deliver orders and provide tracking.

  • IT and security providers: Website administration, technical support and fraud prevention.

  • Marketing and analytics providers: Where those services are enabled and data sharing is permitted.

  • Professional advisers: Such as accountants or legal advisers where necessary.

  • Public authorities: Where disclosure is required by law or a valid legal process.

We do not sell customer contact lists to third parties.

Where a third party processes personal information on our behalf, we seek to ensure appropriate contractual and security protections are in place.

Some organisations, including Shopify and payment providers, may process particular information as independent controllers under their own privacy policies.

7. Shopify and its services

Our online store uses Shopify to provide its ecommerce infrastructure.

Shopify processes certain personal information to operate the store, provide checkout functionality, support transactions and deliver related services.

Some Shopify features may also involve processing information for security, service improvements, personalisation or other purposes explained in Shopify's privacy documentation.

Depending on the particular processing activity, Shopify may act as our processor or as an independent controller.

You can learn more here:

Shopify Consumer Privacy Policy:
https://www.shopify.com/legal/privacy/app-users

Shopify Privacy Portal:
https://privacy.shopify.com/en

8. Cookies and similar technologies

Our website uses cookies and similar technologies.

These may include:

  • Essential cookies: Needed for functions such as shopping baskets, checkout, security and remembering essential preferences.

  • Analytics cookies: Used to understand website usage and help improve the shopping experience.

  • Advertising cookies: Used for advertising measurement or relevant marketing where such features are enabled.

Strictly necessary cookies may operate without consent where a legal exemption applies.

Where consent is required for non-essential cookies or similar technologies, we will seek it before using them.

You can manage available cookie preferences through our website's privacy controls, where provided.

You may also manage cookies through your browser settings, although disabling essential cookies may affect website functionality.

We review our use of cookies and third-party technologies as the services installed on our store change.

9. Marketing communications

We may send you promotional emails about products, new arrivals or offers where you have agreed to receive them or where another permitted basis under UK electronic marketing law applies.

You can opt out of promotional emails at any time using the unsubscribe link in the message or by contacting us.

Unsubscribing from marketing does not prevent us from sending essential communications about your orders, payments, deliveries or customer support enquiries.

10. How long we keep information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including applicable legal and regulatory obligations.

Retention depends on the type of information:

  • Order and financial records: Retained for the period required for relevant accounting, tax and legal obligations.

  • Customer support communications: Retained while necessary to resolve enquiries, handle disputes and meet relevant obligations.

  • Customer accounts: Retained while accounts remain active and for any additional period reasonably necessary for legitimate business or legal purposes.

  • Marketing information: Retained until consent is withdrawn, an unsubscribe request is received or continued retention is no longer justified.

  • Website and security information: Retained according to the relevant operational, security and legal requirements.

We periodically review retained information and delete or anonymise it when it is no longer required, unless continued retention is legally justified.

11. International data transfers

Although Whisker & Wildcard operates from the United Kingdom, Shopify and other service providers may process or store personal information outside the UK.

Where personal information is transferred internationally, we seek to ensure appropriate safeguards are in place, such as UK adequacy regulations, approved contractual arrangements or other mechanisms permitted under applicable data protection law.

12. Keeping your information secure

We take reasonable organisational and technical measures to protect personal information against unauthorised access, loss, misuse or disclosure.

Our ecommerce platform and payment providers also implement security measures relevant to their services.

No online service can guarantee absolute security, but we aim to use reputable providers and review our practices as the business develops.

13. Your rights

Under UK data protection law, you may have the right to:

  • Request access to personal information we hold about you.

  • Ask us to correct inaccurate or incomplete information.

  • Request deletion of personal information in certain circumstances.

  • Request restrictions on how your information is processed.

  • Object to certain processing activities.

  • Request transfer of eligible information to another provider.

  • Withdraw consent where processing relies on consent.

  • Challenge certain decisions made solely through automated processing that have legal or similarly significant effects.

These rights are subject to applicable legal conditions and exceptions.

To exercise your rights, contact ollie@whiskerandwildcard.com.

We may need to verify your identity before completing a request.

We will respond within the time required by applicable law, normally within 1 month, subject to permitted extensions.

14. Children's privacy

Our website is a general retail store and is not intended for children to make purchases independently.

We do not knowingly seek to collect personal information from children who cannot lawfully provide the relevant information or consent.

If you believe a child has provided personal information inappropriately, please contact us so that we can review the situation.

15. Third-party websites

Our website may contain links to third-party websites or services.

We are not responsible for the privacy practices of websites operated independently from Whisker & Wildcard.

We recommend reviewing their privacy policies before sharing personal information.

16. Complaints

If you have concerns about how we handle personal information, please contact us first so we can investigate.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).

Information Commissioner's Office
Website: https://ico.org.uk
Telephone: 0303 123 1113

17. Changes to this policy

We may update this Privacy Policy to reflect changes in our business, technology, services or legal requirements.

When changes are made, we will update the date at the top of this policy and provide additional notice where required by law.

18. Contact us

For privacy-related questions or requests:

Email: ollie@whiskerandwildcard.com

Company number: 17361781