Glimnix · Legal
Privacy Policy
We are committed to protecting your personal information and being transparent about how we use it. This policy explains what data we collect when you visit glimnix.com, place an order, or contact us — and what rights you have under UK data protection law.
1. Who We Are
The data controller for glimnix.com is Glimnix, a UK-based online store operating at glimnix.com.
As data controller, we determine the purposes and means of processing your personal information. We are responsible for ensuring that your data is handled lawfully, fairly, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
If you have any questions about this policy or how we handle your personal information, you can contact us at the details provided in Section 10.
2. Information We Collect
We collect personal information in the following ways:
| Category | Examples | Source |
|---|---|---|
| Order & account information | Name, email address, delivery address, billing address, order history, order value | You, when placing an order |
| Payment information | Card type, last four digits, payment confirmation reference | Our payment processor, Oceanpayment |
| Device & browsing data | IP address, browser type, operating system, pages visited, time on site, referral source | Automatically, when you browse glimnix.com |
| Communications | Messages, questions, or enquiries sent to us by email or WhatsApp | You, when you contact us |
| Cookie and tracking data | Cookie identifiers, advertising event data, session information | Automatically, subject to your cookie preferences |
We collect only the information we need for the purposes described in this policy. We do not collect sensitive personal data (such as health, religious, or political information) through the operation of glimnix.com.
3. How We Use Your Information
UK GDPR requires us to have a lawful basis for each purpose for which we process your personal information. The table below sets out our purposes and the legal basis for each.
| Purpose | Lawful Basis (UK GDPR) |
|---|---|
| Processing and fulfilling your order — including confirming your order, arranging delivery, and communicating with you about it | Performance of a contract (Article 6(1)(b)) |
| Processing payment — verifying and completing your transaction via Oceanpayment | Performance of a contract (Article 6(1)(b)) |
| Customer support — responding to enquiries, complaints, or requests you send us | Performance of a contract / Legitimate interests (Article 6(1)(b) / 6(1)(f)) |
| Fraud prevention and security — detecting and preventing fraudulent transactions and protecting customers and our business | Legitimate interests (Article 6(1)(f)) |
| Analytics and store improvement — understanding how visitors use glimnix.com to improve the customer experience (Google Analytics 4) | Consent (Article 6(1)(a)) / Legitimate interests (Article 6(1)(f)) — subject to cookie preferences |
| Advertising measurement — measuring the effectiveness of our marketing using Meta Pixel and Meta Conversions API | Consent (Article 6(1)(a)) — subject to your cookie preferences |
| Legal and regulatory obligations — maintaining records for tax, VAT, and accounting purposes | Legal obligation (Article 6(1)(c)) |
Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms and are satisfied that our processing is proportionate and does not override your privacy interests. You have the right to object to processing carried out on this basis — see Section 9.
Where we rely on consent (primarily for cookies and advertising technologies), you can withdraw your consent at any time by adjusting your cookie preferences. This will not affect the lawfulness of any processing carried out before you withdrew consent.
4. Sharing Your Information
We do not sell your personal information. We share it only with the third parties necessary to operate our store, fulfil your order, and comply with our legal obligations.
| Recipient | Role | Data Shared |
|---|---|---|
| Shopify Inc. | E-commerce platform and data processor. Shopify hosts and operates glimnix.com. | All order, account, and browsing data processed through the store |
| Oceanpayment | Payment processor. Handles payment transactions on our behalf. | Payment and billing information; order reference; name |
| mutualdropship | Fulfilment partner. Ships the Glimnix Neck Reset directly to you. | Name and delivery address (for dispatch and shipping only) |
| Google (Google Analytics 4) | Analytics provider. Helps us understand how visitors use our store. | Anonymised/pseudonymised browsing and device data — subject to cookie consent |
| Meta (Meta Pixel & Conversions API) | Advertising measurement. Helps us measure the performance of Meta ads. | Event data (page views, purchases) — subject to cookie consent |
| Legal or regulatory authorities | Compliance. Where required by law, court order, or regulatory authority. | Information relevant to the specific legal obligation |
Where we share personal information with third-party processors (such as Shopify and Oceanpayment), those parties are required by contract to process your data only on our instructions and to implement appropriate security measures. They are not permitted to use your personal information for their own purposes.
5. Payment Processing
Payments on glimnix.com are processed by Oceanpayment. We accept Visa, Mastercard, Apple Pay, and Google Pay.
When you complete a purchase, your payment details are submitted directly to Oceanpayment's secure payment environment. Glimnix does not collect or store your full card number, CVV, or other sensitive payment credentials. Oceanpayment operates in accordance with the Payment Card Industry Data Security Standard (PCI DSS).
Oceanpayment processes your payment data as a data processor on our behalf and, to the extent required under applicable law, as an independent data controller for the purposes of fraud screening, payment authorisation, and financial regulatory compliance.
For information about how Oceanpayment handles personal data, please refer to Oceanpayment's own privacy documentation.
6. Cookies and Tracking Technologies
glimnix.com uses cookies and similar technologies to operate the store, analyse how it is used, and (where you have consented) support advertising measurement.
| Cookie Type | Purpose | Basis |
|---|---|---|
| Essential / Strictly Necessary | Required for the store to function — shopping cart, secure checkout, session management | No consent required (necessary for the service) |
| Analytics | Google Analytics 4 — collects pseudonymised data to help us understand traffic and usage patterns | Consent (PECR) |
| Advertising / Marketing | Meta Pixel and Meta Conversions API — measures the effectiveness of advertising campaigns on Meta platforms | Consent (PECR) |
| Preferences / Functional | Remembers your cookie preferences and optional store settings | Consent (PECR) |
You can review and manage your cookie preferences at any time using our Cookie Settings page. Withdrawing consent for non-essential cookies will not affect your ability to browse or purchase from glimnix.com.
Cookies are set in accordance with the Privacy and Electronic Communications Regulations 2003 (PECR) and UK GDPR.
7. Data Retention
We retain your personal information for as long as necessary to fulfil the purposes described in this policy, including to comply with our legal, tax, and accounting obligations.
- Order records: We retain order and transaction records for a minimum of six years to comply with UK tax and accounting requirements (consistent with HMRC guidance).
- Customer support communications: Retained for as long as reasonably necessary to resolve your enquiry, and for a period thereafter in case of follow-up questions or disputes.
- Analytics and cookie data: Retained in accordance with the retention settings of Google Analytics 4. Pseudonymised analytics data is typically retained for up to 14 months by default.
- Advertising event data: Meta Pixel and Conversions API event data is governed by Meta's own data retention policies.
When personal information is no longer needed and no legal retention obligation applies, we take reasonable steps to securely delete or anonymise it.
8. International Data Transfers
Some of the third parties we use may be based or process data outside the United Kingdom. Where your personal information is transferred internationally, we ensure that appropriate safeguards are in place in accordance with UK GDPR requirements.
- Shopify operates globally. Shopify's data transfers are covered by Standard Contractual Clauses (SCCs) and, where applicable, adequacy decisions. Shopify's data processing arrangements are described in Shopify's Privacy Policy and Data Processing Addendum.
- Google (Google Analytics 4) may transfer data to servers outside the UK. Google's international transfers rely on SCCs and related transfer mechanisms.
- Meta may process data outside the UK. Meta's international data transfers are governed by SCCs and Meta's data processing terms.
- Oceanpayment is an international payment processor. Payment data transfers are subject to PCI DSS controls and applicable data transfer safeguards.
If you would like more information about the safeguards governing any specific international transfer, please contact us using the details in Section 10.
9. Your Rights Under UK GDPR
Under UK data protection law, you have the following rights in relation to your personal information:
You may request a copy of the personal information we hold about you (a Subject Access Request).
You may ask us to correct inaccurate or incomplete personal information.
You may request deletion of your personal information in certain circumstances (the "right to be forgotten").
You may ask us to restrict the processing of your personal information in certain situations.
You may request your personal information in a structured, machine-readable format where processing is based on consent or contract.
You may object to processing based on legitimate interests, including profiling for direct marketing purposes.
You have rights in relation to solely automated decision-making that produces legal or similarly significant effects on you.
Where processing is based on consent (e.g. cookies), you may withdraw consent at any time without affecting prior lawful processing.
To exercise any of these rights, please contact us using the details in Section 10. We will respond within one calendar month of receiving your request. We may need to verify your identity before fulfilling certain requests.
10. Data Security
We take the security of your personal information seriously. glimnix.com is hosted on Shopify's platform, which implements technical and organisational measures to protect data — including SSL/TLS encryption for all data transmitted between your browser and our store.
Payment transactions are processed by Oceanpayment using PCI DSS-compliant infrastructure. Glimnix does not hold or transmit full payment card data.
While we and our processors take reasonable steps to protect your personal information, no internet transmission or electronic storage method is completely secure. We cannot guarantee the absolute security of data transmitted to or from our store.
If you have any concerns about the security of your personal information, please contact us at the details below.
11. Privacy Enquiries & Contact
If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have a concern about how we handle your personal information, please get in touch:
Get in Touch
For privacy enquiries, Subject Access Requests, or data protection questions, you can reach us by email or WhatsApp.
We aim to respond to all privacy-related enquiries and data subject rights requests within one calendar month of receipt. We may ask you to verify your identity before we process certain requests.
These contact channels are for customer and privacy enquiries. Glimnix has not appointed a formal Data Protection Officer.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the services we use. When we make material changes, we will update the effective date at the top of this page.
We encourage you to review this policy periodically. Continued use of glimnix.com after changes have been posted constitutes your acknowledgement of the updated policy.
If you have any questions about a change to this policy, please contact us at hello@glimnix.com.