Privacy Policy

I have the utmost respect for your privacy. This policy explains what data I collect from you, why I collect it and what I do with it. This policy also lets you know how you can exercise your rights and ask me questions .

Who I am

I am Michelle Cross DBA Boring Senior Photos. For details of how to contact me please visit my contact me page.

I am a data controller for customer, employee, or contractor data collected from you when you visit this website, call me on the telephone, contact me by email or visit me.

How I collect your personal information

Most of the information I collect is provided to me directly by you, for example if you:

set up an account using the form on this website;
start or complete an order on this website;
contact me by using the contact form on this website or offline (for example by telephone, email or postal mail) to request product information;
ask that I send you my newsletter or request information from me;
place an order with me by telephone, by email, or in person.

The types of information that I collect

I may collect some or all of the following information, for example your:

name;
postal and billing addresses;
telephone number;
email address;
payment information;
and any other information you provide to me.

I don’t store your payment information as I use a third party to process this data.

I also receive personal information indirectly, for example if you visit or browse this website I will use cookies or similar technologies to collect information about your website visit (see the Cookies section below for what information I collect your personal information indirectly, and how I use it).

How I use your personal information

I will use your information to:

set up your web account;
process and fulfil your order;
contact you about your order, for example if there is a delay or a product is out of stock;
determine your geographic location to provide you with relevant information.

The use of your personal information in these ways may be necessary for me to fulfil my contract with you.

If you have contacted me via my contact form or offline (e.g. by telephone, letter, or in person) I will use your personal information to

answer your query or send any information or samples that you have asked for;
contact you by email with information and updates via a third-party mailing system (currently MailChimp).

You can choose to stop receiving emails from me at any time by clicking the unsubscribe link which is clearly marked on the bottom of every non-transactional email. I will never pass your personal information to other organisations for their marketing purposes. The use of your data in this way is necessary for both parties’ legitimate interests. I will never knowingly pass your personal information to other organisations for their marketing purposes.

I use personal information collected directly from you and also indirectly (via cookies) to:

show you personalised and non-personalised ads.

The use of your personal information in this way is with your consent (see the Cookies section below for more information).

How I store your personal information

I am committed to keeping your details secure by taking appropriate technical and training measures to ensure that your data is processed lawfully and protected against accidental loss.

How long I keep your data for

I keep your personal information as long as you remain a customer with me and for at least seven years after that, in order to comply with my legal obligations.

If you have asked me not to use your data in a particular way (such as unsubscribing from my mailing list) I will keep a record of your request to insure that I fully comply with it.

Payment security

When you make a payment on this website you can do this in one of two ways (credit card and Paypal). All data is protected using the most advanced methods available.

I do not store your payment information on this website. When you order from me online I do not have access to, and therefore do not store, your card details. However, my payment provider Stripe may allow me to take repeat payments (I may use this feature, for example, if you want to add something to your order). I will always check with you before using this feature.

Enhancing my data

I may analyze customer data. Where I can I anonymise the data to carry out the analysis or research. Sometimes I combine this data with data from third party companies. This is a necessary legitimate business interest used to:

learn more about my customer preferences;
identify patterns and trends;
provide information and content tailored to my customers’ needs;
send you personalised marketing messages;
enhance your experience on my websites;
display online ads to you.

Google reCAPTCHA

This site uses Google reCAPTCHA which uses an advanced risk analysis engine and adaptive challenges to keep malicious software from engaging in abusive activities on this website. Meanwhile, legitimate users will be able to login, make purchases, view pages, or create accounts and fake users will be blocked. The applicable Privacy Policy is located here and the applicable Terms of Service here.

Cookies

When you visit or browse this website I collect information using cookies.

Essential information we collect (first-party cookies)

In operating this website, it is essential for me to capture some information about your device, such as your IP address and information related to your visit when you browse my store. For example, this might include a time-stamp, the last page or product you visited, the indication that you logged in. I do that in order to:

remember who you are after you log in so that you do not need to authenticate at each click;
monitor if this website is running with the high performance I am dedicated to providing;
let you browse between products without having to start back from the home page at each click;
remember if you put something in your shopping cart before you decide to checkout; and
control that your data is processed securely.

I call the information mentioned above “essential information” and I collect it through the use of cookies. Cookies are small text files that most websites uses. A website places cookies in the web browser and then reads the information collected through the cookies every time the user performs an action. I use cookies. Without enabling this mechanism and these kind of cookies (first-party cookies), I could not provide you with the smooth experience that you expect while you are using this website.

Analytics & advertising (third-party cookies)

This site uses Google Analytics to recognise and count the number of visitors to the site and to see how they are using it. This helps me to improve the website.

This site may use the Google Ads “Adwords” advertising service and remarketing services to advertise on third party websites (including Google) to previous visitors to the site. It could mean that I advertise to previous visitors who haven’t completed a task on the site, for example using the contact form to make an enquiry. This could be in the form of an advertisement on the Google search results page, or a site in the Google Display Network. Third-party vendors, including Google, use cookies to serve ads based on someone’s past visits to the Oshadhi website. Any data collected will be used in accordance with my privacy policy and Google’s privacy policy.

You can set preferences for how Google advertises to you using Google’s Ads Personalisation page.

This website may use the Facebook pixel. Facebook may use the Facebook pixel to collect or receive information from this website and use that information to provide measurement services, targeted ads, and as described in the Facebook Data Policy.

If you have a Facebook account you can control your preferences by visiting:
https://www.facebook.com/ads/preferences/edit/

If you do not have a Facebook account you can opt out of seeing online interest-based ads using the Your Online Choices website: https://youradchoices.com/

How to disable cookies

Most web browsers allow some control to restrict or block cookies, however if you disable cookies you may find this affects your ability to use certain parts of this website. For more information about cookies and instructions on how to adjust your browser settings, see the ICO website.

Other choices

You can control your online behavioural advertising preferences using the Your Ad Choices website:
https://youradchoices.com/

Sharing your personal information

I may need to share or transmit your personal information with third party organisations that supply services to me for purposes that are described in this Privacy Policy or notified to you when I collect your personal information, such as:

web service providers: WordPress, Siteground;
telephone and mobile service providers: Verizon;
payment providers: Opayo and Paypal;
analytics providers: Google Ads, Google Analytics, Facebook;
email providers: MailChimp;
to any competent law enforcement body, regulatory, government agency, court or other third party where I believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend my legal rights or apply my terms and conditions, or (iii) to protect your vital interests or those of any other person;
to any other person with your consent.

When I share your personal information with third party service providers I ensure there is a contract in place that ensures your personal information is safe and your privacy protected. The contract is a legally binding document that ensures:

I provide only the information they need to perform their specific services;
they may only use your data for the purposes they specify in my contract with them;
I work with them to ensure that your privacy is respected and protected at all times;
if I stop using their services, any of your personal information held by them should either be deleted or rendered anonymous (subject to applicable law).

If you have any questions about the third parties, I share your personal information with, please contact me using the contact details provided below.

I do not pass your personal information to other organisations for their marketing purposes.

The lawful basis for using your personal information

Under the applicable data protection regulations in Oregon, the lawful bases I rely on for processing this information are:

where I need the personal information to perform a contract with you (for example when you buy something from me);
or where the processing is in my legitimate interests (for example when I share your information with one of my suppliers or software providers or I answer your question or send you information or receive your order);
or where I have your consent.

Transfers of personal information outside USA

This website provider and other third-party service providers (such as this website provider, email provider, email marketing provider and analytics companies) may not be hosted in the United States of America and this means that I may transfer any information which is submitted by you through the website outside of the USA to these other countries.

When you send an email to me, this may be stored on email servers which are hosted in or located on networks that may pass through these other countries. I will take steps to ensure that my third-party companies use the necessary level of protection for your information (including checking Standard Contractual Clauses) but if you do not want your information to be transferred outside the USA you should not use this website or contact me via email.

Your data protection rights

Under data protection laws, you may have rights including:

Your right to be informed

You have the right to be informed about how I collect and use your personal information. This privacy policy provides that information. If I update my Privacy Policy to reflect a change or improvement of my services or a new legal obligation, I will publish the new version on this website.

Your right of access

You may have the right to access and receive a copy of your personal data, and other supplementary information. This is commonly referred to as a subject access request or ‘SAR’. You can make a SAR verbally or in writing, including via social media. A third party can also make a SAR on your behalf (I will need your written consent).

I will respond without delay and within one month of receipt of the request. I may extend the time limit by a further two months if the request is complex or if I receive a number of requests from you. I may only refuse to provide the information if an exemption or restriction applies, or if the request is manifestly unfounded or excessive.

Your right to rectification

You have the right to have inaccurate personal data rectified or completed if it is incomplete. You can make a request for rectification verbally or in writing. I will respond to your request within one month. In certain circumstances I may refuse a request for rectification.

Your right to erasure

You have the right to have your personal data erased. The right to erasure is also known as ‘the right to be forgotten’. The right is not absolute and only applies in certain circumstances. You can make a request for erasure verbally or in writing. I will respond to your request within one month.

Your right to restriction of processing

You have the right to request the restriction or suppression of your personal data. This is not an absolute right and only applies in certain circumstances. When processing is restricted, I am permitted to store your personal data, but not use it. You can make a request for restriction verbally or in writing. I will respond to your request within one month.

Your right to object to processing

You have the right to object to the processing of your personal data in certain circumstances. You have an absolute right to stop your data being used for direct marketing. In other cases where the right to object applies I may be able to continue processing your personal data if you can show that you have a compelling reason for doing so. You can make a request for restriction verbally or in writing. I will respond to your request within one month.

Your right to data portability

You have the right to ask that I transfer the personal information you gave me to another organisation, or to you, in certain circumstances.

Exercising your rights

You are not required to pay any charge for exercising your rights.

The best way to contact me regarding your rights is to use the contact form on this website.

You can change your personal information by requesting me to update your record/s. If you wish to opt-out of receiving marketing emails you can unsubscribe using the link on each email.

Other sites

This site may contain links to other sites. I am not responsible for the privacy practices or the content of such web sites.

Privacy complaints

If you have any concerns about my use of your personal information, you can make a complaint to me using the contact form.