At PetPurrlo (“we,” “us,” or “our”), we operate a pet supplies e-commerce site at www.PetPurrlo.com. This Privacy Policy explains what personal data we collect, why we process it, who receives it, how long we keep it, and how you can exercise your rights.
We are the controller of the personal data described here. Our business is based in the United States, and we sell to customers in the United States and the European Union. Where we offer goods to customers in the EU, or monitor their behaviour there, the GDPR applies to that processing alongside U.S. law. Where we process the personal data of California residents, the CCPA/CPRA applies; where we process the personal data of Kentucky residents, the ICDPA applies.
This Policy is organized around how the Site actually works: what an order collects, how payment is routed, and what happens after checkout.
1. What We Collect, and on What Legal Basis
We do not collect data “just in case.” Each category below is tied to a specific purpose and, where GDPR applies, a specific legal basis under Article 6.
A. Order and account data
What: full name, shipping address, billing address, email address, telephone number, account login credentials (stored hashed and encrypted). Why: to process and deliver your order, manage returns, and provide order-related customer service. GDPR legal basis: performance of a contract (Art. 6(1)(b)). Consequence of not providing: we cannot process or deliver an order.
B. Wallet payment data
What: the wallet selected (iDEAL or BLIK), transaction ID and payment reference, authorization status, amount, currency, timestamp, refund/chargeback status, and limited identifiers returned by the payment service provider. Why: to authorize, settle, refund, and reconcile payments. GDPR legal basis: performance of a contract; legal obligation for transaction records.
We do not receive or store your online banking password, wallet login credentials, full payment account number, or CVV. iDEAL and BLIK authorization takes place in your banking environment or via a one-time code you enter; the credential itself is not transmitted to or retained by us.
C. Pet preference data
What: pet type, breed, size, and age, if you enter them in your account or at checkout. Why: to recommend products that fit the animal you are shopping for, and to provide size- or material-relevant information where a product has weight or breed suitability limits. GDPR legal basis: consent (Art. 6(1)(a)) where you voluntarily enter this information; performance of a contract where the information is necessary to fulfil an order (for example, a harness sized to your dog’s measurements). You can remove this information at any time by editing your account, and removing it does not affect the lawfulness of processing before removal.
We do not use pet preference data to infer characteristics about you, and we do not share it with advertising partners for their own use.
D. Automatically collected technical data
What: IP address, browser type and version, operating system, device type, referring/exit pages, pages viewed, and general geographic location derived from IP. Why: site security, fraud prevention, and aggregated analytics. GDPR legal basis: legitimate interests (Art. 6(1)(f)) in keeping the Site secure and functional; consent where analytics or advertising cookies require it.
E. Cookies and tracking technologies
Essential cookies (cart, checkout, login, security) are necessary for the Site to function and do not require consent. Analytics and advertising/remarketing cookies are loaded only after you give clear, affirmative consent through the cookie banner, and you can withdraw consent at any time via the “Cookie Settings” link in the footer. Pre-ticked boxes are not used, and the “reject” option is presented with the same prominence as “accept.” Affiliate cookies track referrals on an anonymized basis.
For EU/UK visitors, non-essential cookies are blocked until you affirmatively opt in. Silence, scrolling, or continued browsing does not constitute consent. We do not use cookie walls that make access to the Site conditional on accepting non-essential cookies. Consent records are stored for no longer than six months, after which we will ask you to reaffirm your preferences.
Where we use advertising or remarketing pixels, those tools may receive cookie identifiers and event data. We do not pass your name, email, or address to advertising platforms for their own use.
F. Marketing data
If you subscribe to newsletters or pet care updates, we process your email address and your recorded marketing preference. GDPR legal basis: consent (Art. 6(1)(a)), withdrawable at any time via the unsubscribe link in each email. Withdrawal does not affect the lawfulness of processing before withdrawal.
G. Sensitive personal information
We do not intentionally collect precise geolocation, government identifiers, health data, or other categories of “sensitive personal information” as defined under the CCPA/CPRA for the purpose of inferring characteristics about you. The pet preference data described in Section 1.C is not used to infer characteristics about you. If you voluntarily include sensitive information in a customer-service message, we will use it only to resolve your request and will not use it for any other purpose.
2. How We Use and Share Data
A. Processing purposes, mapped to operations
| Purpose | Data used | GDPR basis |
|---|---|---|
| Take payment via iDEAL/BLIK and settle the transaction | Wallet data, order amount, currency | Contract |
| Pack and ship the order via carriers (USPS, FedEx, DHL, or regional last-mile partners) | Name, shipping address, phone (where required by the carrier) | Contract |
| Handle returns, refunds, and exchanges | Order data, wallet reference, return reason where provided | Contract |
| Recommend products based on the pet you are shopping for | Pet preference data | Consent |
| Respond to customer-service inquiries | Contact details, order reference, message content | Contract / legitimate interests |
| Detect and prevent payment fraud | IP, device data, order pattern, wallet status | Legitimate interests |
| Send marketing communications where opted in | Email, recorded consent | Consent (withdrawable) |
| Comply with tax, accounting, and customs obligations | Order and payment records | Legal obligation |
We do not sell personal information, and we do not share it for cross-context behavioural advertising in exchange for money. Where advertising cookies are used, that may constitute “sharing” under the CCPA/CPRA only if the recipient uses the data for its own purposes; we configure our advertising tools so that they receive cookie identifiers for measurement and remarketing on our behalf, not for their independent use.
B. Who receives data
- Payment service providers: the provider that enables iDEAL and BLIK receives the data necessary to authorize and settle the transaction. It acts under its own regulatory and security obligations; we do not control its independent processing.
- Logistics and carriers: receive name, shipping address, and, where the carrier requires it for delivery, a phone number. They do not receive wallet data, pet preference data, or marketing preferences.
- IT, hosting, and analytics providers: process data on our instructions under data-processing agreements, and are bound to use it only for the specified purposes.
- Professional advisers and authorities: where necessary to comply with law, enforce our terms, or protect rights and safety.
We do not disclose personal data to suppliers or carriers beyond what is necessary to fulfil the order. We do not provide marketing lists to third parties.
C. International transfers
Our business is based in the United States, and our service providers may process data in the U.S. or other countries. Where GDPR applies and we transfer personal data from the EU/EEA to the U.S., we rely on Standard Contractual Clauses approved by the European Commission, supplemented by measures appropriate to the transfer. A copy of the SCCs can be requested using the contact details in Section 6.
3. Payment Routing and the Zero-Storage Boundary
Our checkout is built around two local wallet methods: iDEAL (Netherlands, EUR) and BLIK (Poland, PLN). We do not present card-number fields, and we do not ask you to enter card details on the Site.
The flow: after you click “Place Order,” our system evaluates the shipping destination and order currency and displays the wallet methods available for that combination. You select iDEAL or BLIK and are then directed to your banking environment or wallet interface to authorize the transaction. The result is returned to the Site, and the order is accepted or declined accordingly. Payment method availability is therefore determined after the order is submitted, not before, because the system needs the final destination and currency to determine which local method applies.
What we retain: transaction ID, payment reference, authorization status, amount, currency, and refund/chargeback status. What we do not retain: your banking password, wallet login credentials, full account number, CVV, or one-time authentication codes. We will never ask you to send those credentials to us by email or message. If you receive such a request that appears to come from PetPurrlo, contact us before responding.
4. Retention and Your Rights
A. Retention
| Data | Retention |
|---|---|
| Order and transaction records | 7 years from the end of the relevant tax year, or the period required by applicable tax and accounting law, whichever is longer. |
| Account information | Until you delete your account or request removal, plus a short period to complete deletion across systems and backups. |
| Pet preference data | Until you remove it from your account or delete your account. |
| Marketing preferences | Until you withdraw consent or opt out. |
| Server and analytics data | Retained in identifiable form only as long as needed for security and analytics; aggregated or anonymized data may be retained for trend analysis. |
Where data is no longer needed, we delete or anonymize it.
B. Your rights under the GDPR / UK GDPR
If you are in the EU/EEA or the UK, you have the rights described in Sections 1 and 2, including: access; rectification; erasure; restriction of processing; data portability; objection to processing based on legitimate interests or for direct marketing; and withdrawal of consent at any time, without affecting the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with your supervisory authority.
C. Your rights under the CCPA/CPRA (California)
If you are a California resident, you have the right to:
- Know what personal information is collected, used, and disclosed;
- Delete personal information, subject to legal retention requirements;
- Correct inaccurate personal information;
- Opt out of sale or sharing. We do not sell personal information. Where advertising cookies constitute “sharing,” you can opt out via the “Your California Privacy Choices” link or by sending a Global Privacy Control (GPC) signal. We treat a GPC signal as a valid opt-out request for the browser or device on which it is sent.
- Limit the use and disclosure of sensitive personal information. We do not use sensitive personal information beyond the purposes necessary to provide the goods or services reasonably expected by you, and this Policy states that limitation as the basis for not presenting a separate “Limit the Use of My Sensitive Personal Information” link. If our use changes, we will provide the link and update this Policy.
- Non-discrimination for exercising any privacy right.
You may use an authorized agent to submit a request where the law permits it.
D. Your rights under the ICDPA (Kentucky)
If you are an Kentucky resident, you have the right to:
- Confirm whether we are processing your personal data, and access that data;
- Delete personal data you have provided to us;
- Obtain a portable copy of personal data you have provided to us;
- Opt out of the sale of personal data. We do not sell personal data.
- Opt out of targeted advertising, where applicable. You can do this through the “Cookie Settings” link or a browser-based opt-out preference signal where our systems recognize it.
The ICDPA does not include a right to correct inaccurate data or a right to limit the use of sensitive data, and this Policy does not describe those rights for Kentucky residents. To exercise an ICDPA right, contact us using the details in Section 6. We will respond within the timeframe required by Kentucky law.
E. Automated decision-making
We use automated tools for fraud screening and payment authorization, but these do not produce legal or similarly significant effects based solely on automated processing. If a payment is declined by the provider, you can contact us and we will review the order through a human process. We do not use automated processing to set individualized prices.
F. Children
The Site is not directed to children under 18, and we do not knowingly collect their personal data. Where we learn that we have collected personal data from a child under 18, we will delete it promptly. If you believe a minor has provided data, contact us.
5. Cookies — Control and Withdrawal
Essential cookies cannot be disabled without affecting core functionality. Non-essential cookies are loaded only after you give consent, and you can withdraw consent at any time via the “Cookie Settings” link. Rejecting non-essential cookies is as easy as accepting them; we do not use pre-ticked boxes, cookie walls, or “continued browsing means consent” language. Non-essential cookies expire within a defined period, typically no longer than 24 months. Consent records are kept for no longer than six months, after which you will be asked to reaffirm your preferences.
6. Contact
Controller: DIAZ IRONCREST WHOLESALE LLC
Address: 1890 Star Shoot Pkwy, Lexington, KY 40509, United States
Email: [email protected]
Phone: +1 5026083295
Part number: 1528171
For privacy requests, include “Privacy Request” in the subject line so the request is routed correctly. EU/EEA data subjects also have the right to contact their local supervisory authority.