Privacy Policy
Last updated: [DATE]
1. Who we are
This policy explains how we collect and use personal data when you visit https://peterdobias.com, buy from us, subscribe to Autoship, sign up for emails or SMS, or contact us.
"We", "us" and "our" mean the company named above. If you have any question about this policy or want to exercise your rights, please contact us at customercare@peterdobias.com
2. What personal data we collect
Information you give us
- Identity and contact details — first and last name, email address, postal and delivery address, phone number.
- Account credentials — password (stored in hashed form) and any security information used to access your account.
- Order information — what you bought, when, delivery address, order history, subscription settings.
- Payment information — we do not collect or store your card number, expiry date or security code. Payment details are entered directly into our payment providers' systems (Shopify Payments, PayPal, Klarna, Shop Pay, Apple Pay, Google Pay and others shown at checkout) and are processed by them. We receive only confirmation of payment, the payment method type and the last four digits of the card.
- Communications — messages you send us by email, contact form, live chat or phone, and our replies.
- Reviews and content — reviews, ratings, testimonials, competition entries and any content you post.
- Marketing preferences — whether you have opted in to email or SMS marketing, and your interests where you have told us.
- Health-related information about your dog — where you use tools such as the Healthy Dog Tool, Dog Food Recipe Maker or HairQ testing, or describe your dog's condition when contacting us. This is information about an animal, not special category personal data about you, but we treat it as confidential.
Information collected automatically
When you visit the site, we and our service providers may collect:
- IP address, approximate location derived from it, and country
- browser type and version, operating system, device type, screen size and language
- referring URL, pages viewed, time on page, scroll depth, clicks and mouse movement
- session recordings and heatmaps showing how pages are used
- form interaction data — which fields are completed or abandoned
- order and conversion events
Information from other sources
- Payment and fraud providers — confirmation of payment and fraud risk signals.
- Delivery partners — delivery status and address validation.
- Advertising and analytics platforms — aggregated campaign performance, and where you arrive from an ad, the click identifier associated with it.
- Review platforms — reviews you submit through our review provider.
- Affiliate partners — where you arrive through an affiliate link, the referral identifier.
We do not buy marketing lists or acquire contact data from data brokers.
3. Why we use your data, and our legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Process and deliver your order, take payment, handle returns and refunds | To perform the contract you entered into | Contract |
| Manage your account and Autoship subscription, including renewals and cancellations | To perform the contract | Contract |
| Send order confirmations, dispatch notices, subscription reminders and other service messages | To perform the contract | Contract |
| Respond to your enquiries and provide customer support | To perform the contract, or our interest in helping customers | Contract / Legitimate interests |
| Send marketing emails and SMS | Your consent, or where permitted, our interest in marketing similar products to existing customers | Consent / Legitimate interests |
| Display reviews and testimonials | Your consent when you submit them | Consent |
| Measure how the site is used, through analytics, heatmaps and session recording | Your consent where consent is required in your region; otherwise our interest in improving the site | Consent / Legitimate interests |
| Show you personalised advertising on other platforms and measure its effectiveness | Your consent | Consent |
| Run A/B tests and personalise site content | Your consent where required; otherwise our interest in improving the site | Consent / Legitimate interests |
| Detect and prevent fraud and abuse, and keep the site secure | Our interest in protecting the business and our customers | Legitimate interests |
| Keep accounting, tax and transaction records | To comply with tax and accounting law | Legal obligation |
| Respond to legal requests, exercise or defend legal claims | To comply with the law, or our interest in defending claims | Legal obligation / Legitimate interests |
| Transfer data as part of a merger, acquisition or sale of the business | Our interest in the orderly conduct of corporate transactions | Legitimate interests |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights. You can ask us for the details of that assessment, and you can object to processing on this basis at any time (section 9).
Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect anything done before you withdrew.
4. Marketing
Email. We send marketing emails only where you have opted in, or where you have bought from us and we are permitted to send you information about similar products. Every email has an unsubscribe link. You can also email us to be removed.
SMS. We send marketing texts only where you have separately opted in to SMS. Reply STOP to any message to opt out, or HELP for assistance. Message and data rates may apply. Your mobile number and SMS consent are shared only with the provider that operates our messaging platform, and are never sold or shared for anyone else's marketing.
Service messages are not marketing. We will still send order confirmations, dispatch notices, subscription reminders and account notices after you opt out of marketing, because they are needed to perform your contract.
5. Cookies and similar technologies
We use cookies, pixels, local storage and similar technologies to run the site, remember your cart and preferences, measure how the site is used, and deliver advertising.
Consent. In the EEA, the UK and other regions that require it, non-essential technologies are not activated until you consent through our cookie banner. Elsewhere, you can control them through your browser settings and the opt-outs described below. Strictly necessary technologies — those needed for the cart, checkout, login and security — run in all regions because the site cannot function without them.
Categories we use:
- Strictly necessary — cart, checkout, login, security, load balancing, consent state.
- Analytics — measuring visits, sessions, page performance, heatmaps, session recordings and form completion.
- Marketing — advertising audiences, conversion measurement, retargeting.
- Preferences — remembering language, country and currency.
Third parties that may set technologies on this site:
Shopify (platform and analytics), Google (Analytics, Ads, Tag Manager), Meta / Facebook (advertising pixel), Microsoft (Clarity session recording, Bing advertising), Crazy Egg (heatmaps and session recording), Zuko (form analytics), Convert (A/B testing), Klaviyo (email and onsite tracking), Gorgias (customer support chat), Trustpilot (reviews), UpPromote (affiliate tracking), YouTube (embedded video), Cloudflare (security and performance), and others listed in our [Cookie Policy].
Managing your choices. You can change your cookie preferences at any time via [the cookie settings link in our footer]. You can also block or delete cookies in your browser, though parts of the site may stop working. For interest-based advertising specifically:
- EEA/UK: https://www.youronlinechoices.eu
- US/Canada: https://optout.aboutads.info and https://optout.networkadvertising.org
Our full list of cookies and similar technologies, with providers, purposes and durations, is maintained in our [Cookie Policy] and updated as our tools change.
6. Who we share your data with
We share personal data with the following categories of recipient, only as far as they need it:
- E-commerce platform and hosting — Shopify, which operates the store and processes orders on our behalf.
- Payment providers — Shopify Payments, PayPal, Klarna and the other providers shown at checkout, who process payments as independent controllers under their own policies.
- Fulfilment and delivery — our warehouse and fulfilment partners and the carriers who deliver your order.
- Subscription management — the app that operates Autoship billing and schedules.
- Email and SMS platforms — the providers that deliver our marketing and service messages.
- Customer support tools — the helpdesk and live chat platform.
- Analytics and testing providers — Google, Microsoft, Crazy Egg, Zuko and Convert.
- Advertising platforms — Meta, Google, Microsoft and similar networks, where you have consented.
- Review platforms — the provider that collects and displays customer reviews.
- Affiliate platform — where an order originates from an affiliate link.
- Professional advisers — accountants, auditors and lawyers, where necessary.
- Authorities — where we are legally required to disclose.
- Acquirers — if the business or part of it is sold or merged.
We do not sell your personal data. See section 11 for what "sell" and "share" mean under US state law.
A current list of the specific providers we use is available on request.
7. International transfers
Our store platform hosts data in the United States, and several of our providers are established in the United States or process data there.
Where we transfer personal data from the EEA or the UK to a country without an adequacy decision, we rely on one or more of the following safeguards:
- the European Commission's Standard Contractual Clauses, and the UK Addendum where the UK GDPR applies;
- the provider's certification under the EU–US Data Privacy Framework and its UK extension, where applicable;
- an adequacy decision, where the destination country has one — including Canada, which benefits from a partial adequacy decision covering commercial organisations.
You can request a copy of the safeguards in place by contacting us at [PRIVACY EMAIL].
8. How long we keep your data
| Data | Retention |
|---|---|
| Order and transaction records | [10] years from the order, to meet tax and accounting obligations |
| Account data | For as long as your account is open, then [24] months after your last activity, then deleted or anonymised |
| Autoship subscription records | For the life of the subscription, then [10] years within the order record |
| Marketing contact data and consent records | Until you unsubscribe or withdraw consent, then [24] months to evidence the withdrawal, then deleted |
| Customer support correspondence | [36] months from the last message |
| Reviews and testimonials | Until you ask us to remove them |
| Analytics and session recording data | As set by each provider — typically [14] months for analytics and [30–90] days for session recordings; see our [Cookie Policy] |
| Cookie consent records | [12–24] months from the consent being given |
| Data held for legal claims | Until the relevant limitation period expires |
Where data is held in backups, it is isolated from further processing and deleted on the normal backup cycle.
9. Your rights
Depending on where you live, you have some or all of the following rights. If you are in the EEA or the UK, you have all of them.
- Access — a copy of the personal data we hold about you, and information about how we use it.
- Rectification — correction of data that is inaccurate or incomplete.
- Erasure — deletion of your data where we no longer have a good reason to hold it.
- Restriction — to ask us to pause processing while a dispute about accuracy or legitimacy is resolved.
- Portability — to receive the data you gave us in a structured, machine-readable format, or have it sent to another controller.
- Objection — to object to processing based on legitimate interests. You can object to direct marketing at any time and we will always stop.
- Withdraw consent — at any time, without affecting processing already carried out.
- Not to be subject to solely automated decisions producing legal or similarly significant effects. We do not make such decisions.
- Complain to a supervisory authority.
How to exercise them. Please contact us at customercare@peterdobias.com. We will respond within one month, which we may extend by two further months for complex requests — we will tell you if that happens. There is no charge unless a request is manifestly unfounded or excessive. We may ask for information to verify your identity.
Complaints. If you are in the EEA, you may complain to the supervisory authority in your country of residence, work, or where the issue arose. A list is at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. [Our lead supervisory authority is the Office for Personal Data Protection of the Czech Republic (Úřad pro ochranu osobních údajů), www.uoou.gov.cz.] If you are in the UK, you may complain to the Information Commissioner's Office, www.ico.org.uk. We would appreciate the chance to address your concern first.
10. Automated decision-making and profiling
We do not make decisions about you by purely automated means that produce legal or similarly significant effects.
We do use automated processing to segment audiences for advertising, to run A/B tests that vary what you see on the site, and to recommend products. Where this happens in a region requiring consent, it only happens with yours, and you can object or withdraw at any time.
11. United States privacy rights
If you are a resident of California, Colorado, Connecticut, Virginia, Texas, Oregon, or another US state with a comprehensive privacy law, you have the right to:
- know what personal information we collect, use and disclose;
- access a copy of it;
- correct inaccurate information;
- delete it, subject to legal exceptions;
- opt out of the sale or sharing of personal information, and of targeted advertising;
- limit the use of sensitive personal information;
- not be discriminated against for exercising these rights;
- appeal a refusal of your request, where your state provides for it.
Sale and sharing. We do not sell personal information for money. However, our use of advertising and analytics technologies may constitute "sharing" for cross-context behavioural advertising, or a "sale" as those terms are broadly defined under some state laws.
Global Privacy Control. We honour the GPC browser signal as a valid opt-out of sale and sharing where the law requires it.
Categories collected in the last 12 months: identifiers; customer records; commercial information; internet and network activity; approximate geolocation; and inferences drawn from these. Sources, purposes and recipients are described in sections 2, 3 and 6.
Authorised agents may submit requests on your behalf with written proof of authority.
Shine the Light. California residents may request, once a year and free of charge, details of personal information disclosed to third parties for their own direct marketing purposes in the preceding calendar year.
12. Canadian residents
If you are in Canada, you have the right to access the personal information we hold about you and to request correction, under PIPEDA and applicable provincial legislation. Requests go to [PRIVACY EMAIL]. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada at www.priv.gc.ca, or to your provincial regulator.
13. Children
The site is intended for adults. We do not knowingly collect personal data from children under 18, and we do not market to them.
If you are in the EEA, the minimum age at which a child can consent to online services ranges from 13 to 16 depending on the country; we apply the higher standard of 18 for purchases regardless.
If you believe a child has given us personal data, contact us and we will delete it.
14. How we protect your data
We use technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS), access controls, hashed passwords, and vetting of the providers we work with. Payment card data is handled by PCI DSS compliant payment providers and never stored by us.
No system is completely secure. If a breach occurs that is likely to result in a high risk to your rights, we will notify you and the relevant authority as the law requires.
15. Changes to this policy
We may update this policy. The date at the top shows when it last changed. Where a change materially affects how we use your data or your rights, we will give you notice by email or a prominent notice on the site before it takes effect.