Privacy policy

Privacy Policy

Last updated: September 3, 2026

This Privacy Policy explains how PoTiTo, operated by Abderrahman Khachi as an independent online retailer, collects, uses, stores, and shares personal information when you visit our website, place an order, contact us, or otherwise interact with our services.

1. Information We Collect

Depending on how you interact with our store, we may collect the following information:

  • Contact and customer information: name, email address, telephone number, billing address, and shipping address.
  • Order information: products purchased, order details, transaction information, and delivery information.
  • Payment information: payment information required to complete a transaction. Payment details are processed by Shopify Payments and are not stored directly by PoTiTo.
  • Technical information: IP address, browser type, device information, operating system, approximate location, and information about how you interact with our website.
  • Communications: information you provide when contacting us through email, contact forms, or customer support.
  • Marketing preferences: information about whether you have chosen to receive marketing communications from us.

2. How We Use Your Information

We may use your personal information for the following purposes:

  • To process and fulfil your orders.
  • To arrange shipping and delivery of purchased products.
  • To process payments through Shopify Payments.
  • To communicate with you about your orders, including confirmations, shipping updates, and delivery information.
  • To respond to customer service requests and enquiries.
  • To maintain the security of our website and help prevent fraud or abuse.
  • To comply with applicable legal, accounting, tax, and regulatory requirements.
  • To analyse and improve our website, products, services, and customer experience.
  • To send marketing communications where permitted by law and where any required consent has been obtained.

3. Legal Bases for Processing

Where UK data-protection law applies, we process personal information using appropriate legal bases depending on the circumstances, including:

  • Contract: where processing is necessary to process and fulfil an order or provide services requested by you.
  • Legal obligation: where processing is necessary to comply with legal, accounting, tax, or regulatory requirements.
  • Legitimate interests: where processing is necessary for purposes such as website security, fraud prevention, customer service, and improving our services, where those interests are not overridden by your rights.
  • Consent: where applicable, including certain marketing communications or non-essential cookies where consent is required.

4. Sharing Your Information

We may share personal information with service providers and business partners where necessary to operate our store and fulfil your requests.

These may include:

  • Shopify, which provides our ecommerce platform.
  • Shopify Payments, which processes transactions on our behalf.
  • Shipping, delivery, and fulfilment providers that help deliver your orders.
  • Google Analytics, which helps us understand how visitors use our website. You can opt out at https://tools.google.com/dlpage/gaoptout.
  • Technology, analytics, security, and website service providers that help us operate and improve our store.
  • Professional advisers or authorities where disclosure is required by law.

We do not sell your personal information as a product to third parties.

5. Shopify

Our online store is powered by Shopify. Shopify may process personal information in connection with providing ecommerce, hosting, security, payment, and related services. For more information about how Shopify handles personal information, please refer to Shopify's privacy information.

6. International Data Transfers

Some of the service providers we use may process personal information outside the United Kingdom. Where personal information is transferred internationally, we take appropriate steps to ensure that the transfer is handled in accordance with applicable data-protection requirements.

7. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including fulfilling orders, providing customer support, resolving disputes, maintaining business and financial records, preventing fraud, and complying with applicable legal obligations.

8. Your Privacy Rights

Depending on your circumstances and applicable law, you may have rights concerning your personal information, including the right to:

  • Request access to the personal information we hold about you.
  • Request correction of inaccurate or incomplete information.
  • Request deletion of your personal information where applicable.
  • Request restriction of certain processing.
  • Object to certain processing, including certain direct marketing.
  • Request portability of certain personal information where applicable.
  • Withdraw consent where processing is based on consent.

To exercise a privacy right, please contact us using the details provided below. We may need to verify your identity before completing certain requests.

9. Cookies and Similar Technologies

Our website uses cookies and similar technologies to operate essential website functions, remember preferences, understand website usage, improve our services, and, where applicable, support advertising or marketing activities. Some cookies are necessary for the website to function and cannot be disabled through our systems. Where applicable, non-essential cookies such as analytics or marketing cookies may be subject to your choices or consent as required by applicable law.

10. Marketing Communications

Where permitted by law, we may send marketing communications about our products, promotions, or services. You can unsubscribe from marketing emails at any time by using the unsubscribe link included in the message or by contacting us.

11. Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration, or disclosure. However, no method of transmitting or storing information can be guaranteed to be completely secure.

12. Children's Privacy

Our website is not intended for children who are not legally permitted to make purchases or provide personal information without appropriate authorisation. We do not knowingly collect personal information from children for purposes that are prohibited by applicable law.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, legal requirements, or business practices. Any updates will be posted on this page with the revised "Last updated" date.

14. Contact Us

If you have questions about this Privacy Policy, your personal information, or wish to exercise an applicable privacy right, please contact us:

PoTiTo
Operated by Abderrahman Khachi
Email: support@potito.shop
Address: 4 Law St, Dundee, DD3 6HT, United Kingdom

15. Complaints

If you are in the United Kingdom and believe that your personal information has been handled in a way that does not comply with applicable data-protection law, you may contact us first so that we can try to resolve your concern.

You may also have the right to complain to the UK's data-protection supervisory authority, the Information Commissioner's Office (ICO).