Privacy Policy

Data We Collect – When you interact with the Site we collect several categories of personal data, including your name, postal and e‑mail addresses, telephone number, and, where relevant, login credentials. If you make a purchase or donation, our payment processors receive limited payment information such as a card token, the last four digits of the card, or a PayPal ID, together with the amount of your transaction. We also record order details, size or style preferences, and any information you voluntarily provide in surveys, newsletters, or customer‑service messages. On the technical side, we automatically log your IP address, device type, browser version, referring URLs, and cookie identifiers, as well as anonymous usage statistics such as pages visited and time‑stamps.

How We Collect Data – Personal data reaches us either directly from you—through checkout forms, account‑registration pages, e‑mails, or live‑chat sessions—or automatically, through cookies, web beacons, and analytics scripts that monitor how visitors navigate the Site. We also receive limited information from third parties, chiefly payment gateways (for transaction tokens) and social‑media platforms you choose to link.

How We Use Data – We process your data first and foremost to fulfill the contract between us: to accept and ship your order or acknowledge your donation, send digital receipts, and provide customer support. Beyond that, we use data to remember the contents of your cart, to personalize your browsing or marketing experience, to send newsletters and event notices when you have given consent, and to protect the Site against fraud or security threats. Aggregated, anonymized analytics help us understand which products raise the most funds and how we can improve our mission.

Third‑Party Sharing – We do not sell or rent your personal information. We share only what is necessary with trusted partners: payment processors such as Stripe or PayPal receive your payment details under PCI‑DSS standards; postal carriers like USPS or UPS receive your shipping address through secure portals; analytics providers such as Google Analytics receive masked IP addresses to generate usage reports; and our e‑mail platform receives your address to send newsletters that you have opted to receive. We may also disclose information when compelled by law or to defend our legal rights.

Data Security – All traffic to and from the Site is protected by TLS 1.3 encryption. Payment data never touches our servers and is handled solely by PCI Level‑1‑certified providers through tokenization. Our hosting environment is SOC 2 Type II‑audited and protected with firewalls, intrusion‑detection systems, routine patching, and strict role‑based access controls. Staff and volunteers undergo annual data‑protection training, and we review our safeguards regularly.

Your Rights – Depending on where you live, you may have the right to request access to the data we hold, to correct inaccuracies, to delete or restrict processing, to object to certain uses, and to receive your data in portable form. You may also withdraw consent for marketing at any time by using the “unsubscribe” link in our e‑mails or by contacting us. Send all privacy enquiries to privacy@happydogsurfshop.org.

Data Retention – We keep order and donation records for seven years to satisfy tax and accounting obligations. Marketing e‑mail data remains until you unsubscribe or twenty‑four months after your last interaction. Server logs used for analytics are retained for twenty‑six months before they are anonymized or deleted, and dormant customer accounts are purged or anonymized after three years of inactivity.

Legal Basis for Processing – Under the GDPR and similar regimes, our primary grounds for processing are contractual necessity (fulfilling your orders or donations), your explicit consent (non‑essential cookies and marketing), legitimate interest (fraud prevention, site security, and service improvement), and legal obligation (book‑keeping and compliance).

Cross‑Border Transfers – We host data in the United States. For residents of the European Economic Area or United Kingdom, transfers are safeguarded by Standard Contractual Clauses and additional technical and organizational measures to ensure an adequate level of protection.

Policy Updates – Any material change to this Privacy Policy will appear on this page and, where appropriate, be announced by e‑mail or a banner on the Site at least fourteen days before taking effect. The “Last updated” line at the top of the document reflects the latest revision.

Contact – Write to happydogsurfshop@gmail.com or mail

Happy Dog Surf Shop,23 Caleb Brewster Rd, East Setauket, NY 11733, USA.