1. Who we are
This policy applies to Ryden (the "shop", "we", "us", "our"), operated by Ryden Store Ltd, based in Pakistan.
For data protection purposes, Ryden Store Ltd is the data controller for personal information collected through ryden.store. Privacy requests — contact@ryden.store.
We have not yet appointed an EU or UK representative. Until we do, contact us directly at contact@ryden.store; the representative's details will be published here once appointed.
2. What we collect
We collect personal data in three ways:
2.1 Data you give us
- Account details — name, email, password (hashed, never stored in plaintext).
- Order details — shipping address, billing address, phone number (for couriers).
- Communications — anything you write to us via email, contact forms, or WhatsApp.
- Marketing preferences — whether you've opted into newsletters and which lists.
2.2 Data we collect automatically
- Device & browser — IP address, user agent, screen size, referring URL.
- Usage — pages visited, items added to cart, time on page and, only if you accept analytics cookies, clicks, scrolling and session recordings through Microsoft Clarity.
- Cookies — see section 4 below.
2.3 Data from third parties
- Banks — when you pay by bank transfer, the banks involved pass on the payer name, amount, and transfer reference so we can match the payment to your order.
- Couriers — delivery confirmations and exceptions (failed delivery, redelivery requests).
- Social login (if enabled) — name and email from the provider, only if you choose to sign in this way.
What we do NOT collect: payment details through the site (we don't take payment online), your social security / national insurance number, biometric data, or precise GPS location.
3. How we use your data
Under GDPR / UK GDPR, every use of personal data must have a lawful basis. Here are ours:
| What we do | Why | Lawful basis |
|---|---|---|
| Process your order, quote shipping, match your bank transfer, arrange delivery | Without this, the shop can't function | Contract (Art. 6(1)(b)) |
| Send order emails (order received, order confirmed), shipping updates, delivery notifications | You need to know where your stuff is | Contract (Art. 6(1)(b)) |
| Reply to contact form messages, WhatsApp messages, and quote or wholesale enquiries | You asked us to | Steps taken at your request before entering a contract (Art. 6(1)(b)) |
| Handle returns, complaints, and warranty claims on your order | Customer support | Contract (Art. 6(1)(b)) |
| Detect and prevent fraud and abuse | Protect the shop and other customers | Legitimate interest (Art. 6(1)(f)) |
| Comply with tax, accounting, consumer-law obligations | We have to keep certain records | Legal obligation (Art. 6(1)(c)) |
| Send marketing emails about products and sales | You signed up | Consent (Art. 6(1)(a)) |
| Analyse how visitors use the site with Microsoft Clarity | Make the site better, faster, less broken | Consent (Art. 6(1)(a)) |
We do not use your personal data to make solely automated decisions with legal or similarly significant effects (e.g. credit scoring). Every order is reviewed by a member of our team before it is confirmed.
6. International transfers
Ryden is based in Pakistan, and some of our service providers process data in other countries (notably the US). When personal data from the UK or EEA is transferred to a country without an adequacy decision, we rely on:
- Standard Contractual Clauses (SCCs) approved by the European Commission, and the UK Addendum, as included in our service providers' data processing terms;
- Additional safeguards such as HTTPS/TLS encryption in transit.
You can request a copy of the SCCs we rely on by emailing contact@ryden.store.
7. How long we keep your data
- Account data — for as long as your account is open, plus 12 months after closure.
- Order, invoice, and payment records — for as long as tax and accounting law requires (up to 6 years).
- Marketing consent — until you unsubscribe, then we keep a suppression record indefinitely to honour your unsubscribe.
- Support tickets — 2 years after resolution.
- Server and access logs (including IP addresses) — kept for a limited period set by our hosting providers for security, then deleted.
8. Security
We take reasonable technical and organisational measures, including:
- HTTPS/TLS encryption for data in transit.
- Access to personal data limited to authorised team members.
- A password-protected admin area.
- The physical and infrastructure security of our hosting (Hostinger) and database (Supabase) providers.
No system is unbreakable. If we suffer a personal-data breach, we will notify the relevant supervisory authority within 72 hours where required by law, and tell you without undue delay where the breach is likely to result in a high risk to your rights and freedoms (GDPR Articles 33–34).
9. Your rights
Subject to local law, you have the right to:
- Access — get a copy of the personal data we hold on you.
- Rectification — correct anything inaccurate.
- Erasure ("right to be forgotten") — ask us to delete your data, subject to legal retention requirements.
- Restriction — ask us to stop processing your data in certain situations.
- Portability — get your data in a machine-readable format.
- Object — to processing based on legitimate interests, including direct marketing.
- Withdraw consent — at any time, for any processing based on consent (this doesn't affect prior lawful processing).
To exercise any of these, email contact@ryden.store. We'll respond within 30 days (one month under GDPR), free of charge. We may ask you to verify your identity first.
If you're in California (CCPA/CPRA): you also have the right to know what categories of personal information we collect, to delete it, to correct it, to opt out of "sale" or "sharing" (we don't do either), and to non-discrimination for exercising any right. To make a request, email contact@ryden.store with the subject "California Privacy Request".
If you're in the EU or UK: if you think we've mishandled your data, you have the right to complain to your local supervisory authority (e.g. the UK ICO at ico.org.uk). Ryden has no establishment in the EU/EEA, so no lead supervisory authority applies; you may complain to the supervisory authority in your member state. We'd prefer you come to us first, but you don't have to.
10. Children's privacy
Ryden is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we'll delete it.
11. Changes to this policy
We may update this policy when our practices change, when we add new tools, or when the law requires it. The "Last updated" date at the top of this page always reflects the current version. Material changes will be announced via email if you have an account, or via a banner on the site.
12. Contact us
For any privacy question, request, or complaint:
- Privacy requests: contact@ryden.store
- Data controller: Ryden Store Ltd (trading as Ryden), based in Pakistan
For general support, see our contact page.