PATCHOLOGIE / PRIVACY POLICY
Privacy Policy
Business-specific working draft | Prepared October 2, 2026
Effective date: [DATE THIS APPROVED POLICY TAKES EFFECT]
Last updated: [DATE OF PUBLICATION OR MOST RECENT APPROVED REVISION]
1. Who we are and what this policy covers
[FULL LEGAL NAME OF PATCHOLOGIE BUSINESS], doing business as Patchologie ("Patchologie," "we," "us," or "our"), operates the Patchologie business and determines how personal information is used for its customer services.
This Privacy Policy explains how we collect, use, disclose, and retain personal information in connection with patchologie.com, patchologie.shop, our connected product customizers, customer communications, event inquiries, and purchases or sign-ups at our pop-ups and private events. Together, these are our "Services."
Our marketing website is built on Duda. Our online store and checkout use Shopify. Our connected customizer uses separate application hosting and storage. Moving between these parts of the Services does not change Patchologie's role as the business providing the merchandise and event services.
Personal information means information that identifies you or can reasonably be linked to you or your household. This policy is a notice about our practices, not a blanket consent to every use of information. When a particular activity requires your consent, we request it separately.
Privacy questions and requests should be directed to patchologie@gmail.com or [PATCHOLOGIE'S APPROVED BUSINESS MAILING ADDRESS].
2. Information we collect
Contact, account, and purchase information. When you inquire, create an available customer account, or place an order, we collect the information needed for that interaction. This includes your name, email address, telephone number when provided, billing and shipping addresses, account preferences, products selected, order references, and purchase, return, refund, and delivery information. A purchaser may provide another person's name and address when sending a gift.
Payment information. Shopify and the payment providers used at checkout process payment credentials and billing information. Patchologie receives the payment status, transaction details, and other order information needed to complete and support the purchase. Please do not send payment card numbers, security codes, or account passwords through an inquiry form, ordinary email, or a design note.
Custom designs and production records. When you save or submit a customized hat, pouch, tote, or other supported item, the customizer records the product and variant, color and size where applicable, patches selected, and their arrangement, including placement, scale, rotation, and layering where supported. Records can include a design reference, preview image, saved design instructions, price, creation time, and information needed to associate the design with a cart or order. An email address may be included when supplied with the design or associated transaction. Related production records can include order references, quantity, design snapshots, and fulfillment status.
Saving or submitting a design can create a record before a purchase is completed. We use these records to provide the design service, prepare purchased items, resolve order questions, and troubleshoot the customizer. A design may therefore exist separately from your Shopify account or order.
Messages and event inquiries. We collect what you provide in inquiries and customer-service conversations. For an event, this can include your organization, event date, location, type, approximate attendance, preferences, and custom merchandise requirements. If you separately send artwork, logos, photographs, or reference files for a request, those materials and accompanying messages form part of the inquiry.
Marketing preferences. When you subscribe to our mailing list, we collect your email address, any optional information you submit, and records of your subscription and communication choices.
Website and technical information. Our websites and their providers process information such as IP address, approximate location derived from it, browser and device information, pages and products viewed, referring pages, interaction times, and technical or security logs. Cookies and similar technologies can also remember cart, session, and privacy preferences. Optional analytics and advertising uses are described in Section 6.
Please provide information about another person only when you are authorized to do so. Do not include unnecessary information about children, government identification numbers, health, financial accounts, or other sensitive matters in an event request or custom design.
3. Where information comes from and how we use it
We receive information directly from you, automatically through the Services, and from providers that help process orders, payments, communications, and deliveries. We may also receive information from a purchaser or event organizer acting on your behalf, or through a social platform when you choose to contact us there.
We use contact, transaction, and design information to respond to requests, provide quotes, manage accounts, process orders, prepare customized products, arrange events and deliveries, and provide customer support. We use communications and technical records to investigate errors, maintain reliable services, prevent fraud or misuse, and protect customers and the business.
We use subscription information to send the marketing communications you request or otherwise lawfully receive, and to honor unsubscribe choices. Optional analytics and advertising are used only as described in Section 6 and subject to applicable consent and opt-out requirements.
We also use relevant records for accounting, legal compliance, dispute resolution, and establishing or defending legal claims.
We need certain information to fulfill your request. For example, we cannot ship an item without a delivery address or prepare a saved custom design without its design instructions. Optional marketing choices are separate from the information needed to complete a purchase.
Saving a design or buying an item does not, by itself, subscribe you to marketing or give us permission to identify you in public advertising. Identifiable customer photographs, testimonials, or event content intended for promotional use are addressed through separate permissions where required.
4. Who receives information
We disclose information relevant to the task to providers that help deliver the Services. These include Duda for website infrastructure and related website functions; Shopify for the storefront, checkout, accounts, orders, and related commerce services; Render for customizer application hosting and associated storage; and Studio Hufffor authorized website, integration, customizer, and technical support work.
Other recipients include the payment providers used for your purchase, shipping and fulfillment providers, suppliers preparing requested custom merchandise, and the email, communications, and business-service providers used to handle your request. Approved analytics and advertising recipients, if any, are identified in Section 6. We do not disclose every category of information to every provider.
When a provider processes personal information on our behalf, our arrangements restrict its use to the authorized services and other uses permitted by applicable law and the relevant agreement. Some providers also process information for their own purposes, as described in their notices. Shopify's additional role is addressed in Section 5.
We may disclose information when you direct us to do so; when reasonably necessary to comply with law or valid legal process; to protect against fraud, security threats, or unlawful activity; or to establish, exercise, or defend legal claims. Relevant information may be disclosed during a genuine business sale or reorganization, subject to applicable confidentiality and privacy obligations.
Studio Huff's role. Studio Huff is Patchologie's independent website and technology service provider, not the seller of Patchologie merchandise or the provider of Patchologie event services. Its authorized personnel may access relevant information to develop, maintain, troubleshoot, secure, or support the Services on Patchologie's behalf. For that work, Studio Huff processes customer information under Patchologie's documented instructions and applicable agreements, not for its own customer advertising or mailing lists. Patchologie handles customer privacy requests and coordinates any necessary action with its providers. Nothing in this policy removes a party's responsibilities under applicable law.
5. Shopify and connected services
Shopify hosts our online store and processes information when you browse, use checkout, create an available account, or make purchases. Information is transmitted to Shopify and its providers, including providers located outside your country. Depending on the service involved, Shopify processes information on our behalf or for purposes for which it is independently responsible.
For details about Shopify's own processing and choices, see the Shopify Consumer Privacy Policy and Shopify Privacy Portal. Requests concerning Patchologie's records should also be sent to Patchologie using Section 9.
[REVIEW GATE A: Verify Shopify Network Intelligence and all Enhanced Services. If enabled, insert the confirmed enhanced-services paragraph in the companion guide. The existing Shopify policy refers to these services, but that text alone does not verify the live setting.]
6. Cookies, analytics, advertising, and browser choices
Cookies, local browser storage, pixels, and similar technologies can serve different purposes. Technologies needed for security, cart and checkout functions, session continuity, and remembering privacy choices support the Services. Optional analytics measure how the Services are used; optional advertising technologies can connect browsing or purchase activity with advertising on other services.
[REVIEW GATE B: Identify the analytics, advertising, embedded social-content, and email-tracking tools actually enabled on Duda, Shopify, and the customizer. Insert the verified recipient names or specific recipient categories, data categories, purposes, and a factual sale/sharing statement from the companion guide. Do not publish either a blanket "we do not sell or share" claim or an unverified assertion that advertising is active.]
You can manage optional tracking through [WORKING COOKIE PREFERENCES LINK OR CONTROL]and, where applicable, opt out of sale, sharing, or targeted advertising through [WORKING YOUR PRIVACY CHOICES LINK]. Where consent is required, optional technologies are not used until you consent, and you may withdraw that consent through the same controls.
Where applicable law requires it, we treat a recognized opt-out preference signal, such as Global Privacy Control, as an opt-out for the browser or device sending the signal and extend it to an associated account where required and possible. A legacy "Do Not Track" setting is different from Global Privacy Control. [CONFIRM AND INSERT HOW THE SERVICES ACTUALLY RESPOND TO LEGACY DO NOT TRACK SIGNALS.]
Browser settings can also block or delete cookies. Doing so may affect website functions. Choices may need to be made again when you change devices, clear browser storage, or move between separately hosted parts of the Services. This does not limit any obligation we have to recognize or carry forward your choices under applicable law.
[IMPLEMENTATION GATE: Test every statement above on both domains and inside the embedded customizer before publication. A visible banner alone does not verify that tracking is blocked or that signals and choices reach the relevant providers.]
7. Marketing and your content
You may unsubscribe from promotional emails using the unsubscribe link in the message or by contacting us. We may still send communications needed for an order, event booking, account, or privacy request. Where required, we obtain consent before sending marketing messages.
REVIEW GATE C: Confirm the newsletter provider and any email open/click tracking. Marketing SMS consent is disabled in the Shopify checkout setting reviewed for this draft; confirm whether any separate SMS program exists. Add a separate, accurate SMS disclosure and appropriate sign-up terms before launching text-message marketing.]
If we invite you to submit a review, customer photograph, or other public contribution, we will explain what will be displayed when you submit it. Sending private artwork or an event inquiry is not the same as authorizing public display of your identity or images. Third-party social platforms apply their own rules to content you post there.
8. How long we keep information
We retain personal information only for as long as reasonably necessary for the relevant purposes described here, including applicable legal requirements. Our retention decisions distinguish the following types of records.
Orders, payments, and completed designs. We keep the records needed to fulfill and support purchases, address returns or disputes, maintain required accounting and tax records, and meet applicable legal obligations. The applicable obligation or unresolved claim may require some records to remain after an account is closed.
Saved designs without a completed purchase. We keep these for [APPROVED MAXIMUM PERIOD AND STARTING EVENT, SUCH AS TIME SINCE LAST SAVE], unless you request deletion sooner and no lawful exception applies. We then delete or irreversibly de-identify the records under the applicable deletion process.
Inquiries and event records. We keep these for the period needed to handle the request and any resulting booking, follow-up, or dispute, applying the retention rules for a completed transaction when appropriate.
Marketing records. We keep subscription information while the subscription remains active. We retain the minimum records needed to honor an opt-out and demonstrate consent or compliance when necessary.
Technical logs, copies, and backups. These are retained for defined security, troubleshooting, and recovery needs rather than indefinitely. [INSERT VERIFIED LOG RETENTION AND BACKUP EXPIRY PERIODS, INCLUDING HOW DELETION IS APPLIED TO BACKUPS.]
Deletion requests are considered across the relevant systems, including customizer design and production records, not only Shopify. We may retain information subject to a lawful exception, such as a required transaction record or legal hold. Where applicable, we explain the relevant exception in our response.
9. Your privacy rights and requests
Depending on your location and the laws applicable to our processing, you may have rights to obtain information about our practices; access and receive a copy of your personal information; correct inaccuracies; request deletion; or receive certain information in a portable format. You may also have rights to restrict or object to processing, withdraw consent, limit certain uses of sensitive information, and opt out of sale, sharing, targeted advertising, or certain forms of profiling.
To make a request, email patchologie@gmail.com with "Privacy Request" in the subject line, or use [ADDITIONAL REQUEST METHOD, IF REQUIRED FOR THE APPLICABLE LAW AND BUSINESS MODEL]. You may include a relevant order or design reference to help us locate the correct records.
Do not send a password, full payment-card number, or unnecessary identity documents.
For requests involving access, correction, or deletion, we may need proportionate information to verify your identity and authority. Where permitted, an authorized agent may act for you. We do not require identity verification or account creation for an opt-out when the applicable law prohibits it, although we may need enough information to identify the processing you want stopped.
We respond within the deadlines required by the applicable law, explain any permitted extension or denial, and do not unlawfully discriminate against you for exercising your rights. If a right to appeal applies, email us with "Privacy Appeal" and explain the decision you are challenging. You may also complain to the relevant privacy regulator.
Objection to direct marketing. Where this right applies, you may object to use of your information for direct marketing at any time. Use the unsubscribe mechanism or contact us. Withdrawing consent does not affect processing that was lawful before withdrawal.
10. International visitors and legal bases
Our Services use providers in the United States and other countries, so your information may be processed outside the country where you live. Privacy laws in those countries may differ from those in your country.
Where the GDPR or UK GDPR applies, we rely on the following bases as relevant: performing or taking requested steps toward a contract for orders, customization, and event bookings; compliance with applicable legal obligations for required records and legal requests; legitimate interests in providing reliable services, responding to inquiries, preventing misuse, and protecting legal rights, subject to your interests and fundamental rights; and consent for processing that requires it, including relevant optional tracking and marketing.
You may have additional rights to object to processing based on legitimate interests, restrict processing, and complain to a competent supervisory authority. UK individuals can contact the Information Commissioner's Office. EEA individuals can contact the authority where they live, work, or consider an infringement occurred. Other international rights apply as provided by the relevant local law.
[REVIEW GATE D: Before serving markets that require these provisions, confirm the actual international transfer arrangements and insert the applicable safeguards, destinations or recipient categories, and how to obtain information or copies. Do not claim Standard Contractual Clauses, an adequacy mechanism, or a certification is in place without verification. Add any required EEA/UK representative details. Confirm whether any solely automated decision with legal or similarly significant effects occurs and add the legally required explanation and choices if it does.]
11. Children and family events
Our online shopping accounts, checkout, and inquiry services are intended for adults, including parents or guardians organizing purchases and events. They are not designed for children under 13 to submit personal information directly. We do not knowingly collect personal information directly from a child under 13 without the authorization required by applicable law.
If you believe a child has provided information without the necessary authorization, contact us so we can investigate and take appropriate action, including deletion where required. An adult's event booking does not by itself authorize promotional use of a child's photograph or other identifying information. Any necessary child-related notices and permissions must be addressed separately.
12. Security and other websites
We use reasonable administrative, technical, and organizational measures appropriate to the information and the risks. No website, transmission method, or storage system can be guaranteed completely secure. Please use available account-security features and keep account credentials private.
The Services may link to websites or social platforms run by others. Their own privacy notices govern their independent processing. This does not remove our responsibilities for information we disclose to them or for our own use of their services.
13. Changes and contact
We may update this policy when our practices or legal requirements change. We will post the revised policy with a new "Last updated" date. For material changes, we will provide an appropriate additional notice, such as a prominent website notice or email when appropriate, and obtain consent where required. Continued use of the Services is not a substitute for consent when the law requires it.
