Privacy policy

This Privacy Policy applies to wolfworthy.co.uk and wolfworthy.eu, and to any customer, subscriber, or visitor located in the United Kingdom or the European Union ("you"). It explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have over it.

It is written to meet the requirements of the UK General Data Protection Regulation and Data Protection Act 2018 ("UK GDPR"), and, where you are located in the European Union, Regulation (EU) 2016/679 ("EU GDPR"). Where this policy refers to "GDPR" without qualification, it means both regimes, which impose broadly equivalent obligations on us.

1. Who We Are

Wolfworthy ("we", "us", "our") is the data controller responsible for your personal information. We are a UK-based direct-to-consumer dry dog food subscription brand, trading at wolfworthy.co.uk and, for customers in the European Union, at wolfworthy.eu. Our contact details are set out in Section 15 below.

For customers and visitors in the European Union, our related entity, Wolfworthy Europe Limited, a company registered in Ireland, also forms part of the Wolfworthy group and acts as our EU Representative under Article 27 of the EU GDPR (see Section 15).

2. What Information We Collect

When you purchase something from us, or create an account or subscription, we collect the personal information you give us, such as your name, delivery and billing address, email address, telephone number, and information about your pet(s) where you choose to share it (e.g. for product recommendations).

When you browse our store, we automatically receive your device's IP address, along with information about your browser, operating system, and how you interact with our site, via cookies and similar technologies (see Section 8).

Email and SMS marketing (if applicable): with your permission, we may send you marketing communications about our store, new products, and other updates. You can withdraw this permission at any time (see Section 4).

This also applies if you join a waitlist, sign up for early access, or otherwise express interest in Wolfworthy products or availability in your country or region — including before those products are available to buy where you live. From the moment we collect your information for these purposes, it is handled in line with this Privacy Policy.

3. Our Legal Basis for Processing Your Information

Under UK and EU GDPR, we may only use your personal information where we have a lawful basis to do so. Depending on the purpose, we rely on one or more of the following:

• Contract — to process and fulfil your order or subscription.

• Consent — for marketing communications and non-essential cookies, which you can withdraw at any time.

• Legitimate interests — for example, to prevent fraud, improve our site and services, and understand how customers use our products, balanced against your rights and interests.

• Legal obligation — for example, to keep records required for tax, accounting, or consumer protection law.

4. Consent

How do you get my consent?

When you provide personal information to complete a transaction, verify your credit card, place an order, arrange delivery, or return a purchase, we treat this as consent to our collecting and using it for that specific reason only.

Where we ask for your personal information for a secondary reason, such as marketing, we will either ask for your express consent or give you a clear opportunity to say no.

How do I withdraw my consent?

If you change your mind after opting in, you may withdraw your consent to our continued collection, use, or disclosure of your information at any time by contacting us at privacy@wolfworthy.co.uk or by using the unsubscribe link in any marketing email.

5. Who We Share Your Information With

We do not sell your personal information. We share it only with the following categories of recipient, and only to the extent needed for them to provide their service to us or, for advertising partners, where you have given consent:

Service providers

• Shopify — our e-commerce and hosting platform (see Section 7).

• ShipBob — our order fulfilment and delivery partner, who receives the information needed to pack and ship your order.

• Klaviyo — our email and SMS marketing platform, who processes your contact details and marketing preferences on our behalf.

• Seal Subscriptions and our subscription/loyalty tooling — used to manage recurring orders, discounts, and account preferences.

• Payment processors — to securely process your payment (see Section 6).

This list reflects the providers we work with today. As our business grows, we may engage other third-party service providers to support these same core functions (such as fulfilment, marketing, payments, or subscription management), always under terms that require them to protect your information and use it only for the purposes we've instructed.

Marketing and advertising partners

With your consent, given via our cookie banner or a marketing opt-in, we use advertising platforms such as Meta (Facebook and Instagram) and TikTok to show you relevant ads, measure how our campaigns perform, and build "custom" or "lookalike" audiences based on visitors and customers who share similar interests to you.

To do this, we may share limited, typically hashed (irreversibly scrambled), contact details such as your email address or phone number with these platforms, alongside information about how you interact with our website and ads. These platforms — for example Meta Platforms Ireland Limited and TikTok Technology Limited — act as independent controllers for the ways they use this information for their own advertising purposes, and each maintains its own privacy policy, which we encourage you to review.

Where these partners are based outside the UK or EEA, any transfer of your information to them is protected by appropriate safeguards, such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses. You can withdraw consent for this kind of advertising sharing at any time via our cookie settings or the platform's own ad preference tools (see Section 4).

Legal and regulatory disclosures

We may also disclose your personal information if we are required to do so by law, to comply with a legal or regulatory obligation, to enforce our Terms of Service, or to protect our rights, property, or safety, or that of our customers.

6. Data Storage and Shopify

Our store is hosted on Shopify Inc., which provides the e-commerce platform that allows us to sell our products and services to you. Your data is stored through Shopify's data storage, databases, and the general Shopify application, on secure servers behind a firewall.

Payment

If you choose a direct payment gateway to complete your purchase, Shopify stores your payment card data, encrypted in line with the Payment Card Industry Data Security Standard (PCI-DSS). Your purchase transaction data is stored only as long as necessary to complete the transaction, after which it is deleted.

All direct payment gateways we use adhere to PCI-DSS standards, as managed by the PCI Security Standards Council, a joint effort of Visa, Mastercard, American Express, and Discover, among others.

For more information, you may wish to read Shopify's Terms of Service or Privacy Policy.

7. Third-Party Services and Links

Third-party providers we use will only collect, use, and disclose your information to the extent necessary to perform the services they provide to us (for example, payment processing, email marketing, and analytics).

Certain providers, such as payment gateways and transaction processors, maintain their own privacy policies covering how they handle the information we are required to share with them. We recommend reading these directly.

Some providers may be based in, or process data in, jurisdictions outside the UK or EU. Where this happens, your information may become subject to the laws of that jurisdiction. Once you leave our website or are redirected to a third-party website, you are no longer covered by this Privacy Policy.

Google Analytics: our store uses Google Analytics to help us understand who visits our site and which pages are viewed.

8. Cookies

Cookies are small files placed on your device that help our store, and services we rely on, function properly and understand how the site is used. Below is a list of the cookies we currently use, so you can choose whether to opt out of non-essential cookies via our cookie banner or your browser settings.

9. International Data Transfers

Where we or our service providers transfer your personal information outside the UK or the European Economic Area (EEA) — for example, to the United States — we ensure appropriate safeguards are in place, such as the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or an applicable adequacy decision, so that your information continues to receive an equivalent level of protection.

10. Data Retention

We keep your personal information only for as long as necessary to fulfil the purposes we collected it for, including to satisfy any legal, accounting, or reporting requirements. As a general rule, order and transaction records are retained for as long as required by UK and EU tax and consumer protection law, and marketing data is retained until you withdraw consent or unsubscribe. Where we no longer need your data, we securely delete or anonymise it.

11. Your Rights

Subject to certain exemptions, you have the following rights in relation to your personal information under UK and/or EU GDPR:

• Access — to request a copy of the personal information we hold about you.

• Rectification — to ask us to correct inaccurate or incomplete information.

• Erasure — to ask us to delete your personal information in certain circumstances.

• Restriction — to ask us to limit how we use your information.

• Portability — to receive certain information in a structured, machine-readable format.

• Objection — to object to processing based on legitimate interests or for direct marketing.

• Withdraw consent — at any time, where processing is based on consent, without affecting processing carried out before withdrawal.

We do not use your personal information for any automated decision-making, including profiling, that produces legal or similarly significant effects. To exercise any of the rights above, contact us using the details in Section 15.

12. Security

We take reasonable precautions and follow industry best practice to protect your personal information from being inappropriately lost, misused, accessed, disclosed, altered, or destroyed. Payment card information is encrypted using SSL/TLS in transit and AES-256 encryption at rest. While no method of transmission or storage is 100% secure, we follow all applicable PCI-DSS requirements and generally accepted industry standards.

13. Age of Consent

By using this site, you confirm that you are at least the age of majority in your country or region of residence, or that you have the consent of a parent or guardian to allow any of your minor dependents to use this site on your account.

14. Complaints and Supervisory Authorities

If you are unhappy with how we have handled your personal information, please contact us first using the details in Section 15 so we can try to resolve it. You also have the right to lodge a complaint with a supervisory authority:

• UK residents: the Information Commissioner's Office (ICO).

• EU residents: the data protection authority in your country of residence, or the authority for the EU member state in which our EU Representative is established.

15. Contact Information

UK — Data Controller

For access, correction, amendment, or deletion of any personal information we hold about you, to register a complaint, or for any other query about this policy, contact our Privacy Compliance Officer:

Wolfworthy
Email: privacy@wolfworthy.co.uk

EU Representative (Article 27, EU GDPR)

As we offer goods to customers in the European Union, we have appointed an EU Representative in accordance with Article 27 of the EU GDPR. You may contact our EU Representative on any matter relating to the processing of your personal information under EU GDPR, in addition to or instead of contacting us directly:

Wolfworthy Europe Limited
Work Hub, 77 Camden Street Lower, Dublin 2, Dublin, D02 XE80, Ireland
Email: privacy@wolfworthy.co.uk

16. Changes to This Privacy Policy

We may modify this Privacy Policy at any time, so please review it periodically. Changes take effect immediately upon posting to our website. If we make material changes, we will notify you here, or by other appropriate means, so you understand what information we collect, how we use it, and under what circumstances we disclose it.

If our business is acquired by or merged with another company, your information may be transferred to the new owners so that we can continue to provide our products and services to you.