Privacy & Cookies Policy
INTRODUCTION
Upahaar Box is an independent UK business dedicated to respecting your privacy. This policy explains how we manage and protect the personal information we collect.
WHY DO WE COLLECT INFORMATION ABOUT YOU?
We gather personal details when you register with us or purchase our products. This information enables us to process your orders, manage your account, and—if you consent—send you updates about other products we believe may interest you.
GDPR DATA COMPLIANCE
We respect your rights under the General Data Protection Regulation (GDPR). You may contact us to exercise the following rights:
- Data Erasure Request: Request that we delete your personal data.
- Data Export Request: Request a copy of the data we hold about you.
ACTIVITY & SITE MANAGEMENT
- Data Used: To deliver site functionality and record activities around site management, the following information is captured: user email address, user role, user login, user display name, WordPress.com and local user IDs, the activity to be recorded, the connected site ID, the Jetpack version, and the timestamp of the activity. Some activities may also include the actor’s IP address (e.g., login attempts) and user agent.
- Activity Tracked: We track login attempts/actions, post and page updates, comment/pingback submission and management, plugin and theme management, widget updates, user management actions, and the modification of various site settings.
- Data Synced: Successful and failed login attempts, which include the actor’s IP address and user agent.
ADVERTISING (ADS)
- Data Used: The following information is collected and sent to our Demand Partners: IP address, geographical data (derived from IP), user agent, operating system, device type, unique user ID (randomly generated identifier), current URL, and IAB interest category.
- Retention: Log data (IP address, geography, user agent, OS, device type) is stored for 30 days. The unique user ID is stored in cookies and retained for 1 year.
- Activity Tracked: Ad impressions, video-related events (pause, mute, plays), errors, and ad click events.
- Cookies: Various cookies are used to deliver targeted advertisements, store user identifiers, and collect anonymous ad platform statistics.
CAROUSEL (IMAGE VIEWING)
- Data Used: If image view tracking is enabled, we use: IP address, user ID/username (if logged in), user agent, visiting URL, referring URL, timestamp, browser language, and country code.
- Activity Tracked: Image views.
COMMENT LIKES
- Data Used: To process a comment like, we use: User ID/username (if logged in), local site-specific user ID, and the like status. If performed from our mobile app, we also use: IP address, user agent, timestamp, blog ID, browser language, country code, and device info.
- Activity Tracked: Comment likes.
CONTACT FORMS
- Data Used: If Akismet is enabled, submission data (IP address, user agent, name, email, website, message) is submitted to the Akismet service for spam checking. The actual submission data is stored in our site database and emailed directly to the site owner.
- Data Synced: Post meta data associated with the submission.
GOOGLE ANALYTICS
- Data Used: For our WooCommerce store, purchase events send the following: order number, product ID/name, category, total cost, and quantity. We have enabled IP anonymization where possible.
- Activity Tracked: Page view events, video play events, shopping cart additions/removals, product listing views/clicks, product detail views, and purchases.
GRAVATAR HOVERCARDS
- Data Used: This feature sends a hash of the user’s email address to the Gravatar service to retrieve their profile image.
INFINITE SCROLL
- Data Used: To record page views with additional loads, we use: IP address, user ID/username (if logged in), user agent, visiting URL, referring URL, timestamp, browser language, and country code.
- Activity Tracked: Page views are tracked with each additional load (e.g., scrolling to the bottom of the page).
JETPACK COMMENTS
- Data Used: Commenter’s name, email, site URL, timestamp, and IP address. Additionally, the Jetpack IFrame receives the blog ID, post ID, user ID, and MD5 hash of the email. If Akismet is enabled, data is sent for spam checking.
- Activity Tracked: The comment author’s name, email, and site URL are stored in cookies.
LIKES (POSTS)
- Data Used: To process a post like, we use: IP address, User ID/username, site ID, post ID, user agent, timestamp, browser language, and country code.
- Activity Tracked: Post likes.
MOBILE THEME
- Data Used: A visitor’s preference on viewing the mobile version of the site.
- Activity Tracked: A cookie (akm_mobile) is stored for 3.5 days to remember your mobile viewing preference.
THIRD-PARTY DATA SHARING
- Payments: We do not store financial data. Payments are processed by Stripe or PayPal.
- Taxes: For automated tax calculations, the value of goods, shipping, and destination address are sent to Xero or similar providers.
- Shipping: For checkout rates, destination postal codes and product dimensions are sent to Royal Mail/DPD or similar providers. For shipping labels, customer data is sent to Royal Mail/DPD or similar providers.
MOBILE THEME
We may send you information about products that could be of interest to you. If you have opted in, you may receive communications from Upahaar Box unless you choose to opt out. You can withdraw your consent and stop receiving marketing messages at any time by clicking the “Unsubscribe” link in our emails.
International Data Transfers
As we serve customers globally, your personal data may be transferred to and processed in countries outside the UK. We ensure that such transfers are protected by appropriate safeguards, such as UK Adequacy Regulations or Standard Contractual Clauses (IDTAs), to ensure your data receives a level of protection equivalent to that provided under UK GDPR.