Privacy Policy

At Dopp & Carry (doppandcarry.com, "we", "us", or "our"), we hold customer trust and data privacy as fundamental principles of our brand. This Privacy Policy details how we collect, process, share, protect, and retain personal information when you visit our website, interact with customer support, or purchase our leather travel goods and accessories. It also explains your statutory privacy rights across the jurisdictions we serve, including the United States, United Kingdom, European Union, Australia, and Canada.

1. Information We Collect & Payment Processing

We collect information in three distinct contexts: device telemetry collected automatically, order information provided during checkout, and payment transaction metadata received from our payment processor.

A. Device & Automated Technical Information

When you browse the Site, our systems automatically collect certain technical information from your browser or device, including your IP address, browser type and version, language settings, operating system, time zone, referring/exit pages, and timestamps. We also collect telemetry regarding the products and pages you view, search terms entered, and session interactions. We collect this data using standard web server logs and first-party cookies.

B. Order & Customer Information

When you place an order or create an account on the Site, you provide us with personal information necessary to fulfill your purchase. This includes your full name, billing address, shipping destination address, email address, telephone number, and order items. We refer to this information as "Order Information".

C. Payment Processing & PayPal Gateway Data Isolation

All online checkout transactions on Dopp & Carry are processed directly through PayPal (PayPal Inc. and PayPal (Europe) S.à r.l. et Cie, S.C.A.), our authorized third-party payment processor.

Payment Card Isolation: When you complete a purchase, your payment card number, CVV/CVC security code, expiration date, or PayPal account credentials are submitted directly to PayPal over an encrypted TLS connection. All payment processing conforms to strict PCI-DSS Level 1 security standards.

What Our Store Actually Receives: Dopp & Carry never collects, processes, views, or stores your full credit or debit card numbers, CVV codes, or PayPal account passwords. We only receive secure transaction metadata from PayPal necessary to confirm payment and manage order fulfillment, which includes:

• PayPal Transaction Reference ID and authorization status (e.g., Completed, Authorized);
• Order transaction amount and currency;
• Buyer name, billing address, and contact email associated with the transaction;
• Masked payment instrument summary (such as payment method type, card brand, and only the last four digits of the payment card, e.g., Visa ending in 1234).

2. How We Use Your Information (Purposes & Legal Bases)

We process personal information under defined legal bases under applicable data protection laws (including the GDPR, UK GDPR, and CCPA):

• Contract Performance: We use Order Information to fulfill your contract of purchase—specifically processing transactions, arranging parcel dispatch with logistics carriers, generating tax invoices, and sending order confirmation and tracking notices.
• Fraud Prevention & Risk Screening (Legitimate Interest / Legal Duty): We review order details and device telemetry (such as IP location and address verification) to protect against unauthorized transactions, chargeback fraud, and security threats.
• Customer Support & Post-Purchase Service (Contract / Legitimate Interest): We process customer communications to answer product inquiries, process 30-day returns and exchanges, and assist with delivery updates.
• Marketing & Newsletter (Consent): If you have opted in to "The Dispatch" newsletter, we use your email to send curated travel tips, product care guides, and collection announcements. You can withdraw consent at any time by clicking the "Unsubscribe" link in any promotional email.
• Store Optimization & Analytics (Legitimate Interest / Consent): We generate aggregated, pseudonymous metrics to evaluate website usability, page load performance, and product demand.

3. Categories of Service Providers & Data Flows

We do not sell, rent, or trade your personal information to data brokers or third parties for monetary gain. We only share personal data with vetted third-party service providers (data processors) who perform necessary business operations on our behalf under strict confidentiality and data protection obligations:

• Web Hosting & Cloud Infrastructure: Our website, database, and WooCommerce store are hosted on secure, high-performance cloud servers equipped with firewalls, DDoS protection, and SSL/TLS encryption.
• Payment Gateway (PayPal): PayPal receives payment transactions, billing details, and order amounts to authorize charges and process refunds under PCI-DSS Level 1 compliance.
• Order Fulfillment & Logistics Carriers: To pack and transport your order, your name, shipping address, order items, and telephone number are shared with our fulfillment center and shipping carriers (including USPS, UPS, FedEx, DHL Express, Royal Mail, Australia Post, Canada Post, and destination customs clearing agents) strictly for parcel transport, customs clearance, and delivery tracking.
• Transactional Email & Communications: We use reputable cloud email providers to deliver essential transactional notices (such as order receipts, shipping confirmations with tracking numbers, and customer support responses).
• Analytics Providers (Google Analytics): Google Analytics receives pseudonymous device telemetry and navigation events to compile aggregate reporting on website traffic.
• Advertising & Conversion Measurement Partners: Subject to your cookie consent preferences, Google Ads and Meta Platforms (Meta Pixel) receive conversion event data (such as page visits or completed purchases) to evaluate advertising performance and prevent redundant ads.

We may also disclose personal data if required by valid legal process (such as a court order, subpoena, or lawful government audit), or when necessary to protect our legal rights, investigate fraud, or enforce our Terms & Conditions.

4. Actual Tracking Tools & Technologies Used

To ensure transparent disclosure, our store utilizes only the following tracking and measurement tools:

• WooCommerce Essential Cookies: First-party session cookies (such as woocommerce_cart_hash, woocommerce_items_in_cart, and wp_woocommerce_session_) required to remember bag contents across page loads, maintain your shopping session, and process secure checkout. These cookies are strictly necessary for store functionality and do not track you across external websites.
• Google Analytics 4 (GA4): Operated by Google LLC. We use GA4 with IP anonymization enabled to monitor aggregate visitor behavior, traffic channels, and device trends. User-level event data is retained for 14 months before automated deletion. Learn more at Google's Privacy Policy.
• Meta Pixel (Facebook / Instagram): Operated by Meta Platforms, Inc. The Meta Pixel helps us measure the efficacy of social advertising campaigns and deliver relevant advertisements on Facebook and Instagram based on visits to our store.
• Google Ads Conversion Tracking: Measures conversion actions when a customer clicks a Google Search or Shopping ad, ensuring we do not serve repetitive or irrelevant ads to past purchasers.

Notice on Other Advertising Networks: We do not currently deploy tracking pixels from Pinterest, TikTok, or other speculative third-party advertising networks. Should we introduce any new marketing technologies in the future, we will update this policy and update our on-site cookie consent options prior to deployment.

5. Your Cookie Choices & Consent Management

You maintain full control over non-essential cookies and tracking technologies deployed on our website. You can change your preferences, manage cookie categories, or withdraw consent at any time.

Browser-Level Controls & Advertising Portals

In addition to our on-site Preference Center, you can manage cookies through your web browser:

• Web Browser Settings: Most browsers (Chrome, Safari, Firefox, Edge) allow you to view, block, or delete cookies through their Privacy & Security settings. Note that disabling all cookies may prevent items from staying in your shopping cart or inhibit checkout functionality.
• Google Analytics Opt-Out: You can install the official Google Analytics Opt-out Browser Add-on.
• Industry Advertising Portals: You may opt out of cross-site behavioral advertising from participating ad networks via the Digital Advertising Alliance (DAA), Network Advertising Initiative (NAI), or for UK/EU visitors, the European Interactive Digital Advertising Alliance (EDAA). Please note: These third-party advertising opt-out portals register browser-level advertising preferences across third-party ad networks and do not replace our website's direct on-site consent controls.

6. Data Retention Periods & Statutory Criteria

We do not retain personal information indefinitely. We retain your information only for as long as necessary to fulfill the purposes for which it was collected, satisfy statutory legal, accounting, and tax requirements, resolve disputes, and defend legal claims. We apply the following retention criteria:

• Completed Orders & Financial Invoices (7 Years): Order transaction records, customer names, billing/shipping addresses, invoices, and payment references are retained for seven (7) years following the close of the applicable tax year. This retention is mandatory under United States tax laws (IRS), United Kingdom HMRC statutory accounting rules, and European Union commercial code standards, as well as to defend against credit card chargebacks and warranty disputes.
• Customer Account Information: Retained for as long as your registered account remains active. If you request account closure, personal account profiles are deleted within 30 days, subject to the retention of completed order histories required by statutory tax obligations above.
• Customer Support Correspondence (24 Months): Email tickets, return inquiries, and customer service correspondence are retained for twenty-four (24) months after case resolution to provide continuity of support and verify warranty claims.
• Marketing Newsletter Subscriptions: Retained until you unsubscribe or withdraw consent. Upon unsubscribing, your email is immediately suppressed from future campaigns and preserved only on a suppression list to honor your opt-out preference.
• Web Server Security Logs (90 Days): Server access logs recording IP addresses and request headers are retained for 90 days for network security, DDoS mitigation, and forensic diagnostics before automated deletion.
• Google Analytics Event Telemetry (14 Months): Retained in Google Analytics for 14 months before automated deletion or permanent irreversible aggregation.

Notice on Deletion Requests: When you submit a request to delete your personal data under GDPR, CCPA, or applicable laws, we will delete all eligible personal information (such as marketing profiles and browsing history). However, applicable laws do not permit unconditional erasure of records that we are legally required to maintain for statutory tax, accounting, anti-money laundering, fraud prevention, or pending dispute resolution purposes until statutory limitation periods expire.

7. Business Identity, Location & Cross-Border Data Processing

Dopp & Carry is an e-commerce retail brand with business mailing presence and digital administrative operations based in the United States, serving customers across the United States, United Kingdom, European Union, Australia, and Canada.

Address: Our official business and dispatch address is 108 S Bernard St, Ruston, LA 71270, USA. Outbound customer orders are fulfilled and dispatched directly from this location. Please note that this is not a walk-in retail storefront or an unauthorized returns depot; all customer returns must be authorized in advance and directed to our designated returns intake facility as detailed in our Return Policy.

Administrative & Technical Infrastructure: Our cloud server hosting, customer support systems, and payment gateway infrastructure are managed through secure United States and global cloud providers. When you access our Site or place an order from the UK, EU, Australia, or Canada, your transaction data is transmitted to and securely processed across our United States and international server networks.

Fulfillment & Logistics Partners: Customer orders are fulfilled and dispatched directly from our facility located at 108 S Bernard St, Ruston, LA 71270, USA. Your order details (name, shipping address, and phone number) are securely shared with our carrier partners (such as USPS and UPS in the US, and regional postal authorities including Royal Mail in the UK, Australia Post in Australia, Canada Post in Canada, and national postal services across the EU) strictly for parcel delivery, customs clearance, and tracking purposes.

International Transfer Safeguards (GDPR / UK GDPR): For customers in the European Economic Area (EEA) and the United Kingdom, whenever personal data is transferred outside the EEA or UK to countries that have not received an adequacy decision from the European Commission or UK Information Commissioner, we ensure appropriate safeguards are implemented. These safeguards include the execution of European Commission approved Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and robust technical encryption measures.

8. Your Statutory Privacy Rights by Jurisdiction

Depending on where you reside, you are entitled to specific statutory rights regarding your personal information:

A. European Union & United Kingdom Residents (GDPR & UK GDPR)

• Right to Access (Art. 15): Request confirmation of whether we process your data and obtain a copy of your personal data.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal information.
• Right to Erasure (Art. 17): Request deletion of your data ("Right to be Forgotten"), subject to our statutory legal and tax recordkeeping duties.
• Right to Restriction (Art. 18): Request that we limit the processing of your personal information under certain circumstances.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21): Object at any time to processing based on legitimate interests or direct marketing.
• Right to Withdraw Consent: Withdraw previously given consent at any time without affecting the lawfulness of processing before withdrawal.
• Right to Lodge a Complaint: Lodge a complaint with your national supervisory authority (e.g., the Information Commissioner's Office (ICO) in the UK or your local EU Data Protection Authority).

B. United States Residents (California CCPA/CPRA, Virginia, Colorado & State Laws)

• Right to Know & Access: Request disclosure of the categories and specific pieces of personal information collected, the sources of collection, business purposes, and third parties with whom data is shared.
• Right to Delete: Request deletion of personal information collected directly from you, subject to statutory exemptions.
• Right to Correct: Request correction of inaccurate personal data maintained in our records.
• Right to Opt-Out of Sale / Sharing: Dopp & Carry does NOT sell your personal information for monetary compensation. To the extent third-party marketing cookies may be construed as "sharing" for cross-context behavioral advertising under California law, you can opt out via our on-site Cookie Preference Center above.
• Non-Discrimination: We will never deny goods, charge higher prices, or degrade service quality because you exercise your statutory privacy rights.

C. Canadian (PIPEDA) & Australian (Privacy Act 1988) Residents

Canadian and Australian customers have the right to request access to personal information held in our records, challenge its accuracy, request corrections, and withdraw consent for marketing communications.

9. How Privacy Requests Are Handled (Verification & Response)

To exercise any of your privacy rights, please contact our dedicated Data Privacy Team:

• Dedicated Email: privacy@doppandcarry.com
• Web Contact Form: Contact Us Page

Identity Verification Procedure: To protect your confidential information from unauthorized access, identity theft, or fraudulent erasure, we must verify your identity before fulfilling access or deletion requests. We verify your identity by confirming that your request originates from the email address associated with your purchase or account. For sensitive requests, we may request confirmation of non-financial order metadata (such as an order number, date of purchase, or billing ZIP code). We will never ask you to provide payment card numbers or account passwords during verification.

Response Timelines & Fees: We acknowledge receipt of privacy requests promptly and provide substantive responses within thirty (30) calendar days (or within forty-five (45) days under CCPA, with notice if an extension is warranted for complex inquiries). All privacy requests are processed free of charge, unless a request is manifestly unfounded or repetitive.

Authorized Agents: If an authorized agent submits a request on your behalf, we require written authorization signed by you and direct verification of your identity.

10. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our business operations, shipping arrangements, customer offerings, or applicable legal and regulatory standards. Any revisions will be published on this page with an updated "Last Updated" date at the top of the policy. We encourage you to review this policy periodically.