1. Data Controller Information
   
   www.sofastash.com (“we”, “us”, or “our”) operates as the data controller responsible for the personal data collected and processed through this website. We are committed to protecting customer privacy in strict compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and applicable European data protection legislation.

Data Controller Contact Details:

Brand: Sofastash

Address: Plas Aradur, Bryn Y Maen, Colwyn Bay, United Kingdom, LL28 5EW

Telephone: +44 1244 680501

Email: sofa@sofastash.com

2. Personal Data We Collect
   
   We collect and process personal data necessary for order fulfillment, customer support, and website operation:

Identity & Contact Data: Full name, billing address, shipping address, email address, and telephone number.

Transaction Data: Information regarding products purchased, order values, and fulfillment history.

Technical & Usage Data: IP address, browser information, time zone settings, operating system, and interaction records with our website pages.

3. Purpose and Legal Basis for Processing
   
   We process personal data under the following legal bases:

Performance of Contract: To process orders, manage deliveries of home organization accessories (such as armrest organizers, bedside hanging bags, remote control holders, and headboard caddies), and provide customer service.

Legal Obligation: To comply with statutory accounting, tax, and commercial reporting requirements.

Legitimate Interests: To maintain website operational integrity, protect against fraudulent activities, and improve standard service offerings.

4. Payment Processing
   
   Payment transactions conducted on www.sofastash.com are handled securely by our third-party payment service provider, Stripe.

When placing an order, payment card details, billing information, and transaction data are transmitted directly to Stripe for verification and processing. We do not store, capture, or retain full credit card numbers or security codes on our servers. Stripe processes this payment data in accordance with strict industry standards, including Payment Card Industry Data Security Standard (PCI-DSS) requirements and applicable data protection regulations.

5. Data Sharing and Third-Party Disclosures
   
   Personal data is shared only with standard service providers necessary for business operations:

Logistics Partners: Express couriers and freight carriers for physical order delivery.

Payment Processor: Stripe, for secure transaction authorization and fraud prevention.

IT Support & Infrastructure: Hosting and domain infrastructure providers ensuring system reliability.

We do not sell, rent, or trade personal data to third parties for marketing purposes.

6. Data Retention Period
   
   We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or to comply with statutory legal requirements:

Order & Transaction Records: Retained for up to six (6) years following the completion of a transaction, in compliance with UK tax, accounting, and commercial reporting laws.

Customer Inquiry Data: Retained for up to two (2) years from the date of last communication to resolve ongoing support requests or warranty claims.

Technical Logs: Retained for up to twelve (12) months for routine cybersecurity analysis and server monitoring.

Upon expiration of the applicable retention period, personal data is securely deleted or anonymized.

7. Data Subject Rights
   
   Under UK and European data protection laws, individuals maintain the following rights regarding their personal data:

Right of Access: Request a copy of the personal data held about you.

Right to Rectification: Request correction of inaccurate or incomplete data.

Right to Erasure: Request deletion of personal data where legal exceptions do not apply.

Right to Restriction: Request suspension of data processing under specific circumstances.

Right to Data Portability: Request transfer of personal data to another controller in a structured format.

Right to Object: Object to data processing based on legitimate interests.

To exercise any of these rights, please contact us at sofa@sofastash.com. You also hold the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) or your local European Supervisory Authority.

8. Data Security
   
   We implement physical, technical, and organizational measures to safeguard personal data against unauthorized access, loss, alteration, or disclosure. Access to personal data is restricted to authorized personnel and service providers operating under strict contractual confidentiality obligations.
   
9. International Data Transfers
   
   When data is transferred outside the United Kingdom or the European Economic Area (EEA), appropriate safeguards—such as Standard Contractual Clauses (SCCs) or UK International Data Transfer Agreements (IDTAs)—are implemented to ensure an equivalent level of protection.
   
10. Updates to This Privacy Policy
    
    We reserve the right to modify this Privacy Policy to reflect regulatory changes or operational updates. Any revised version will be posted on this page with an updated effective date.