Privacy policy

Last updated: 27 July 2026

1. Who we are

Zima Store is operated by Matheus Zimmermann, a sole trader trading as Zima Store (“Zima Store”, “we”, “us” or “our”).

For the purposes of applicable data-protection law, including the UK General Data Protection Regulation and the Data Protection Act 2018, Matheus Zimmermann is the data controller responsible for the personal data described in this Privacy Policy.

Our contact details are:

Trading name: Zima Store
Operator: Matheus Zimmermann, trading as Zima Store
Website: zimastore.co.uk
Email: zimastoreadmin@gmail.com
Telephone: +44 7575 254079
Address: 7 Holymead, Reading, RG31 7BP, United Kingdom

2. About this policy

This Privacy Policy explains how we collect, use, disclose, store and protect personal data when you:

• Visit or browse zimastore.co.uk;
• Purchase or return a product;
• Create or use a customer account;
• Contact us;
• Subscribe to marketing;
• Interact with our advertisements;
• Use any other feature or service made available through our store.

Our store is hosted by Shopify, which provides the ecommerce platform through which we offer and sell our products.

This Privacy Policy should be read together with our Terms of Service, Shipping Policy and Return and Refund Policy.

3. Personal data we collect

The personal data we collect depends on how you interact with our store.

Contact and identity information

We may collect:

• Your name;
• Email address;
• Telephone number;
• Billing address;
• Delivery address;
• Any other contact details you provide.

Order and transaction information

We may collect:

• Products, sizes and colours ordered;
• Order numbers;
• Purchase date and value;
• Delivery method;
• Payment status and payment confirmation;
• Returns, refunds, cancellations and replacements;
• Previous purchases and customer-service history.

Payment information

Payments are processed through Shopify and the payment providers available at checkout.

We may receive limited payment-related information, such as the payment method, payment status, billing details and transaction reference. We do not normally receive or store your complete payment-card number or card security code.

Payment providers process payment information under their own privacy notices and security procedures.

Customer account information

If you create a customer account, we may collect:

• Your account login information;
• Saved contact and delivery details;
• Order history;
• Account preferences;
• Communication and marketing preferences.

You are responsible for keeping your account credentials confidential.

Communications

We collect information you provide when you:

• Email or telephone us;
• Submit a contact form;
• Request a return or refund;
• Report a damaged or incorrect item;
• Leave a review;
• Communicate with us through social media.

This may include the content of your message, photographs of products or packaging, and documents reasonably required to investigate an order problem.

Device, usage and technical information

When you use our website, we and our technology partners may automatically collect:

• Internet Protocol address;
• Browser type and version;
• Device type and operating system;
• Approximate location derived from your IP address;
• Referring website or advertisement;
• Pages and products viewed;
• Dates and times of visits;
• Items added to a basket;
• Checkout and purchase events;
• Cookie identifiers and similar online identifiers;
• Information about how you navigate and interact with the website.

Marketing and advertising information

Where permitted, we may collect:

• Whether you subscribed to marketing;
• Your marketing preferences;
• Whether you opened or interacted with a marketing communication;
• Your interaction with Zima Store advertisements;
• Advertising identifiers;
• Information used to measure advertising performance and attribute purchases to advertisements.

Personalisation information

If we offer personalised products in the future, we may collect the wording, image, photograph or other content you provide for the purpose of producing that product.

Please do not include sensitive or unnecessary personal information in custom content.

Information we do not intentionally request

We do not intentionally request special-category personal data, such as information concerning your health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation or biometric information.

Please avoid sending this type of information unless it is genuinely necessary for a specific request.

4. How we collect personal data

We may obtain personal data:

• Directly from you when you browse, purchase, register, contact us or subscribe;
• Automatically through cookies, pixels and similar technologies;
• From Shopify and Shopify services;
• From payment providers;
• From Printify, print providers and delivery couriers;
• From advertising and social-media platforms, such as TikTok, where you interact with our advertisements;
• From fraud-prevention, security or identity-verification providers;
• From publicly available sources where lawful;
• From another person who places an order to be delivered to you.

Where another person provides your information as the recipient of a gift or delivery, they are responsible for ensuring they are permitted to provide it.

5. Why we use personal data and our lawful bases

We process personal data only where we have a lawful basis for doing so.

Our legitimate interests include operating and improving our business, providing effective customer service, protecting our store, preventing fraud, understanding business performance, maintaining accurate records and establishing or defending legal claims.

Where we rely on legitimate interests, we consider whether our interests are reasonably necessary and whether your rights override those interests.

Where we rely on consent, you may withdraw it at any time.

6. Information required to fulfil an order

Certain information is necessary to enter into and perform our contract with you.

For example, we require your name, delivery address, contact details and payment information to accept payment, manufacture your product, arrange delivery and contact you about the order.

You are not legally required to provide this information, but we may be unable to accept or fulfil your order without it.

7. How we disclose personal data

We disclose personal data only where reasonably necessary for the purposes described in this policy.

Shopify

Our store is hosted by Shopify. Shopify processes information about your access to and use of the store so that it can provide hosting, checkout, payment, security, analytics, account and ecommerce services.

Information submitted through our store may be transmitted to Shopify and its service providers.

Where Shopify Network Intelligence or other Shopify enhanced services are enabled, Shopify may also process information about your interactions with our store and other Shopify merchants to provide services such as fraud prevention, analytics, personalisation and advertising.

Shopify may act as our processor for some activities and as an independent controller for certain Shopify services.

You may learn more about Shopify’s processing through the Shopify Consumer Privacy Policy and manage certain Shopify-specific choices through the Shopify Privacy Portal.

Printify and print providers

We use Printify to manufacture and fulfil products.

We may provide Printify, the selected print provider and their service providers with information required to produce and deliver your order, including:

• Your name;
• Delivery address;
• Telephone number or email address where required for delivery;
• Products and variants ordered;
• Personalisation content, where applicable;
• Order and delivery information.

Printify acts as a processor or service provider when processing end-customer information on our behalf. The selected print provider physically produces the product and may use additional production or logistics providers.

Delivery companies

We share delivery details with postal operators, couriers and logistics providers so they can:

• Deliver your order;
• Provide tracking;
• Contact you about delivery;
• Investigate missing or delayed parcels;
• Process undeliverable or returned parcels.

Payment providers

Payment and fraud-prevention information may be disclosed to Shopify Payments, PayPal, banks, card networks and other payment providers selected at checkout.

These providers may carry out payment authorisation, authentication, fraud prevention, chargeback handling and regulatory checks.

Advertising and analytics partners

Where enabled and subject to your cookie and consent choices, we may disclose device, usage and transaction-event information to advertising and analytics partners.

This may include TikTok through tools such as:

• TikTok Pixel;
• TikTok Events API;
• Advertising attribution;
• Audience measurement;
• Advanced Matching, where enabled.

Depending on the data-sharing setting selected, TikTok may receive browsing events and, where enabled and lawfully permitted, identifiers such as an email address or telephone number in a protected or hashed format.

We use these tools to measure advertising performance, understand whether an advertisement resulted in a visit or purchase, improve campaigns and show relevant advertising.

We do not intentionally send complete payment-card details or sensitive personal data to advertising platforms.

Professional advisers

We may disclose information to accountants, insurers, legal advisers, tax advisers and other professional advisers where reasonably necessary.

Public authorities and legal disclosures

We may disclose information where necessary to:

• Comply with a legal obligation;
• Respond to a valid court order or lawful request;
• Prevent or investigate fraud or criminal activity;
• Protect our rights, property or safety;
• Protect the rights, property or safety of customers or others;
• Establish, exercise or defend legal claims.

Business transfers

If Zima Store is sold, reorganised or transferred, personal data may be disclosed to potential purchasers, advisers or successors where permitted by law and subject to appropriate confidentiality protections.

8. Cookies and similar technologies

Our website uses cookies and similar technologies.

Cookies are small files stored on your device. They may be used to operate the website, remember preferences, maintain a shopping basket, provide security, analyse traffic and measure advertising.

Necessary cookies

Necessary cookies support functions such as:

• Website security;
• Customer authentication;
• Shopping-basket functionality;
• Checkout;
• Payment processing;
• Fraud prevention;
• Remembering privacy choices.

These cookies are required for the store to operate and do not generally require consent where they are strictly necessary.

Optional cookies

With your consent, we may use optional cookies and similar technologies for:

• Analytics;
• Advertising measurement;
• Personalisation;
• Retargeting;
• Understanding website performance;
• Creating advertising audiences.

You can accept, reject or manage optional cookies through the cookie banner or Cookie Preferences link available on our website.

Withdrawing consent does not affect processing that occurred before withdrawal.

Browser settings may also allow you to block or delete cookies. Blocking necessary cookies may prevent parts of the website or checkout from functioning correctly.

9. Marketing communications

We may send marketing emails or electronic messages where:

• You have given consent; or
• We are otherwise permitted to contact an existing customer about similar products and have provided an opportunity to opt out.

You can unsubscribe at any time by:

• Selecting the unsubscribe link in a marketing email;
• Changing your communication preferences, where available;
• Contacting us at zimastoreadmin@gmail.com.

We may retain limited information on a suppression list so that we continue to respect your opt-out request.

Opting out of marketing will not prevent us from sending necessary non-marketing communications about an order, payment, return, refund, security issue or customer-service request.

10. Advertising and profiling

We and our advertising partners may use information about website activity to:

• Measure advertising effectiveness;
• Attribute visits or purchases to advertisements;
• Create advertising audiences;
• Limit repeated advertisements;
• Show advertisements that may be more relevant;
• Analyse campaign performance.

We will use optional advertising cookies or technologies only where we have obtained any consent required by law.

You may object to direct marketing and withdraw consent to personalised advertising through our cookie preferences, unsubscribe mechanisms or by contacting us.

11. Automated decision-making and fraud prevention

Shopify, payment providers and fraud-prevention services may use automated systems to identify unusual or potentially fraudulent transactions.

These systems may consider information such as:

• Device details;
• IP address;
• Delivery and billing information;
• Transaction history;
• Payment behaviour;
• Fraud indicators.

An order may be delayed, reviewed, rejected or cancelled where fraud or security risks are identified.

We do not ordinarily make decisions based solely on automated processing that produce legal or similarly significant effects without appropriate safeguards. You may contact us if you believe an automated process has incorrectly affected your order.

12. International transfers

Some of our service providers, including Shopify, Printify, payment providers, advertising partners and technology providers, operate internationally.

Your personal data may therefore be transferred to, stored in or accessed from countries outside the United Kingdom.

Where required, we use or rely on recognised safeguards, which may include:

• UK adequacy regulations;
• The UK International Data Transfer Agreement;
• The UK Addendum to approved standard contractual clauses;
• Contractual commitments and security measures;
• Other transfer mechanisms permitted by applicable law.

You may contact us for further information about the safeguards relevant to your personal data.

13. How long we retain personal data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, tax, security and dispute-resolution requirements.

Our usual retention approach is:

• Orders, payments, returns and accounting records: generally retained for up to six years after the relevant accounting period;
• Customer-service and complaint records: generally retained for up to two years after the matter is resolved, or longer where connected to a transaction, dispute or legal claim;
• Customer accounts: retained while the account remains active and for a reasonable period following closure;
• Marketing records: retained until you unsubscribe or withdraw consent, with limited suppression information retained afterwards;
• Cookie and advertising identifiers: retained according to the duration stated in our cookie settings and the policies of the relevant provider;
• Fraud and security records: retained for as long as reasonably necessary to identify, investigate and prevent fraud;
• Personalisation files: retained only for as long as reasonably necessary to manufacture the order, resolve production issues and meet legal obligations.

We may retain information for longer where:

• Required by law;
• Necessary to resolve a complaint or dispute;
• Necessary to establish or defend a legal claim;
• Required because of suspected fraud or unlawful activity.

When information is no longer required, we will delete, anonymise or securely dispose of it where reasonably possible.

14. Security

We use reasonable organisational and technical measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction.

These measures may include:

• Access controls;
• Password protection;
• Secure Shopify checkout technology;
• Payment-provider security systems;
• Fraud monitoring;
• Limiting access to information to those who require it;
• Keeping devices, software and accounts appropriately secured.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, particularly for information sent through ordinary email or other unsecured communication channels.

Please do not send complete payment-card details, passwords or other highly sensitive information by email.

15. Children and young people

Our products and website may be of interest to people under the age of 18.

We seek to collect only the personal data reasonably necessary to provide the store and fulfil purchases. We do not knowingly request unnecessary personal information from children.

We do not knowingly use the personal data of anyone we know to be under 18 for behavioural profiling or personalised advertising.

If you are under 18, you should ask a parent or guardian before placing an order or providing personal data.

A parent or guardian who believes a child has provided personal data inappropriately may contact us at zimastoreadmin@gmail.com. We will investigate the matter and take appropriate action, including deletion where required.

16. Your data-protection rights

Depending on the circumstances and applicable law, you may have the right to:

Access

Request confirmation that we process your personal data and receive a copy of it.

Correction

Ask us to correct inaccurate or incomplete personal data.

Erasure

Ask us to delete personal data where there is no continuing lawful reason for us to retain it.

Restriction

Ask us to restrict how we use personal data in certain circumstances.

Portability

Receive certain personal data in a structured, commonly used and machine-readable format, or ask us to transfer it to another controller where applicable.

Objection

Object to processing based on legitimate interests in certain circumstances.

You have the right to object at any time to the use of your personal data for direct marketing.

Withdrawal of consent

Withdraw consent at any time where we rely on consent.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Complaints

Raise a complaint about our handling of your personal data.

These rights are not absolute and may be subject to legal exceptions. For example, we may need to retain information to comply with tax law, prevent fraud or establish or defend legal claims.

17. Exercising your rights

To exercise a data-protection right, contact:

Email: zimastoreadmin@gmail.com
Telephone: +44 7575 254079
Post: Zima Store, 7 Holymead, Reading, RG31 7BP, United Kingdom

Please explain which right you wish to exercise and provide enough information for us to identify the relevant records.

We may request reasonable proof of identity before acting on a request. This is intended to prevent personal data being disclosed to an unauthorised person.

We will respond within the period required by applicable law.

You will not ordinarily be charged for exercising your rights. We may charge a reasonable fee or refuse a request where permitted by law, for example where a request is manifestly unfounded or excessive.

18. Complaints to the ICO

We encourage you to contact us first so that we can try to resolve your concern.

You also have the right to complain to the UK supervisory authority:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom

Telephone: 0303 123 1113

Your right to complain to the ICO is not affected by contacting us first.

19. Third-party websites and services

Our store may contain links to websites, applications or social-media platforms operated by third parties.

We are not responsible for the privacy, security or content of third-party services. Their collection and use of personal data are governed by their own privacy notices.

This may include social-media platforms, payment providers, Shopify services, advertising platforms and websites reached through links in product pages or marketing content.

20. Sale or sharing of personal data

We do not sell personal data to third parties in exchange for money.

We may disclose certain device, usage and advertising information to Shopify and advertising partners as described in this policy. Depending on the law applicable where you live, some advertising-related disclosures may be legally defined as “sharing” or “targeted advertising”.

Where required, we will provide appropriate consent or opt-out controls.

21. Changes to this policy

We may update this Privacy Policy to reflect:

• Changes to our business;
• New products or services;
• New applications, pixels or service providers;
• Changes to legal or regulatory requirements;
• Changes to how we process personal data.

The updated version will be published on our website with a revised “Last updated” date.

Where required by law, we will provide additional notice before making a significant change.

22. Contact us

Questions, complaints and data-protection requests should be sent to:

Zima Store
Operated by: Matheus Zimmermann, trading as Zima Store
Email: zimastoreadmin@gmail.com
Telephone: +44 7575 254079
Address: 7 Holymead, Reading, RG31 7BP, United Kingdom

For the purposes of applicable data-protection law, Matheus Zimmermann is the data controller responsible for the processing described in this Privacy Policy.