Privacy Policy
Last updated: 5 October 2026
This policy explains what personal data itemtrail collects when you visit https://itemtrail.com or buy from us, why we collect it, who we share it with, and your rights. It is written to meet the EU General Data Protection Regulation (GDPR) and the UK GDPR.
1. Who is responsible for your data
The controller is itemtrail, postal address available on request by email. For any privacy question or request, email shop@itemtrail.com.
2. What we collect
- Order data: name, shipping and billing address, email, phone number, items bought, order value and order notes.
- Account data (if you create an account): login email, a securely hashed password, and saved addresses.
- Payment data: card and PayPal payments are handled directly by Stripe and PayPal. We only receive the payment status, the card type and its last four digits. We never receive your full card number.
- Support messages: what you send us by email, including photos of damaged items.
- Technical data: IP address, browser and device type, pages visited and referring site, from server logs and the cookies described below.
- Product views and clicks on partner sites: some partner sites, such as reveal.world, show our products. Your browser loads these from https://itemtrail.com. We count anonymously how often each product is shown and clicked, on which partner page and in which page language. These counts are not stored with your IP address or browser details, and we set no cookies on the partner site.
3. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Processing, fulfilling and delivering your order, sending order and tracking emails, handling returns and refunds | Performance of a contract (6(1)(b)) |
| Running your customer account | Performance of a contract (6(1)(b)) |
| Keeping invoices and accounting records | Legal obligation (6(1)(c)) |
| Preventing fraud and keeping the Site secure | Legitimate interests (6(1)(f)) |
| Understanding which sites send us visitors, for example reveal.world, to improve the shop | Legitimate interests (6(1)(f)) |
| Counting product views and clicks on partner sites, and working out which orders came from them, to measure and settle those partnerships | Legitimate interests (6(1)(f)) |
| Marketing emails (only if you opt in) | Consent (6(1)(a)), which you can withdraw at any time |
We don’t sell your personal data. We don’t make decisions about you that are based solely on automated processing and that have legal or similarly significant effects.
4. Who we share it with
We share only what each service needs to do its job:
- Order fulfilment: our fulfilment partners CJdropshipping and EPROLO, and the partner warehouses that pack and ship your items. They receive your name, shipping address, phone number and the items ordered.
- Carriers: postal and courier services receive your delivery details. Tracking links open the carrier’s site or 17TRACK, which receives only the tracking number.
- Payments: Stripe and PayPal, which act as independent controllers for fraud prevention and regulatory purposes.
- Hosting and email: our cloud hosting provider (Oracle Cloud Infrastructure) and our email delivery provider.
- Authorities and advisers: tax authorities, accountants, lawyers or law enforcement, where the law requires it.
5. Transfers outside the EU/EEA
Some of these services, and some of our suppliers, are based outside the EU/EEA, including in the United States and Asia. When we transfer data there, we rely on one of the following:
- An adequacy decision, such as the EU–US Data Privacy Framework for certified companies.
- The European Commission’s Standard Contractual Clauses.
- Where needed to deliver your order, the transfer being necessary to perform our contract with you (GDPR Art. 49(1)(b)).
You can ask us for a copy of the safeguards.
6. How long we keep it
- Orders and invoices: for as long as tax and accounting law requires, typically 6–10 years. After that, they are deleted or anonymised.
- Accounts: until you ask us to delete your account.
- Support emails: up to 2 years after the matter is closed.
- Server logs and backups: up to 30 days.
- Partner view and click counts: individual view records up to 90 days, after which only daily totals are kept. Click records contain no IP address or browser details and are kept for partner reporting.
7. Cookies
We don’t use advertising or social-media tracking cookies. We use the following:
| Cookie | Purpose | Duration |
|---|---|---|
woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* | Keep your basket and checkout working (strictly necessary) | Session – 2 days |
wordpress_logged_in_*, wordpress_sec_* | Keep you logged in to your account (strictly necessary) | Session – 14 days |
__stripe_mid, __stripe_sid | Fraud prevention during card payment, set by Stripe (strictly necessary) | 30 minutes – 1 year |
sbjs_* | Records which site or campaign brought you to an order, so it can be attributed (WooCommerce order attribution) | Session – 6 months |
itemtrail_reveal | Remembers that you arrived from reveal.world, so Reveal perks can be applied | 30 days |
itemtrail_click | Set when you follow a product link from a partner site or campaign. It holds a random ID for that click (the latest click replaces earlier ones), so an order you place can be credited to that partner | 30 days |
You can block or delete cookies in your browser settings. If you block the strictly necessary ones, the basket and checkout won’t work.
8. Your rights
Under the GDPR, you have the right to:
- Access your data and get a copy of it.
- Correct inaccurate data. You can update most of it yourself in My account.
- Erase your data, except records we must keep by law.
- Restrict or object to processing, including processing based on legitimate interests.
- Data portability: receive your data in a machine-readable format.
- Withdraw consent at any time, for example by using the unsubscribe link in marketing emails.
- Complain to a data protection supervisory authority, especially the one in the EU country where you live or work (list of EU authorities). In the UK, this is the ICO.
To use any of these rights, email shop@itemtrail.com. We may ask you to confirm your identity. We respond within one month.
9. Security
The Site is served only over HTTPS. Passwords are hashed, and access to our systems is restricted and logged. Payment details are handled by PCI-DSS-certified providers.
10. Children
The Site is not intended for anyone under 16. We don’t knowingly collect data from children.
11. Changes
If we change this policy, we’ll update the date above. If the changes are significant, we’ll also tell account holders by email.