PRIVACY POLICY

This Privacy Policy describes how travelbrushkit (referred to herein as “we”, “us”, or “our”) collects, uses, processes, retains, and discloses your personal data when you visit or make a purchase from www.travelbrushkit.com (the “Site”).

We operate in full compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the European Union General Data Protection Regulation (EU GDPR), and relevant United States federal and state consumer privacy laws.

1. Data Controller and Contact Information
   For the purposes of applicable data protection legislation, the data controller responsible for your personal information is the operating entity of travelbrushkit. If you have any inquiries regarding this policy or our data management practices, please contact us at:
   Brand Operator: travelbrushkit
   Registered Office Address: 85 Great Portland Street, First Floor, London, England, W1W 7LT, United Kingdom
   Official Correspondence Email: travel@travelbrushkit.com
   Customer Support Telephone: +44 20 7946 3821
2. Personal Data We Collect
   When you interact with our Site, we collect certain categories of personal information necessary to facilitate transaction fulfillment and provide customer services:
   Identity and Contact Data: Includes your full name, billing address, shipping address, email address, and telephone number.
   Transaction Data: Includes details about payments made by you and details of products purchased from our platform.
   Technical and Usage Data: Includes internet protocol (IP) addresses, browser type and version, time zone settings, operating system, and data reflecting how you navigate the Site.
3. Legal Basis and Purposes of Data Processing
   We process your personal information under the following lawful metrics:
   Performance of a Contract: To process orders, manage distribution, and handle administrative inquiries related to your purchases.
   Legal Compliance: To satisfy statutory tax, accounting, and anti-fraud reporting mandates across the United Kingdom, Europe, and the United States.
   Legitimate Interests: To maintain the functional operational integrity of our Site, perform internal statistical analysis, and mitigate commercial risks.
4. Payment Processing by Stripe
   All financial transactions conducted on our Site are routed through and processed by our third-party payment infrastructure provider, Stripe.
   When making a purchase, your transactional financial details are transmitted directly to Stripe. We do not store, view, or retain your complete credit card numbers or raw financial authentication details on our internal database systems. Stripe manages and processes this information in accordance with their independent privacy framework and strict industry standards, including the Payment Card Industry Data Security Standard (PCI-DSS). The processing by Stripe is strictly necessary to finalize the commercial contract initiated by your purchase request.
5. Data Retention Periods
   We maintain your personal data only for as long as is strictly necessary to fulfill the operational purposes for which it was originally collected, as well as to satisfy mandatory legal, regulatory, tax, accounting, or reporting frameworks required under UK, EU, and US jurisdictions:
   Customer Order Data and Transactional History: Retained for a standard period of six (6) to seven (7) years following the completion of the transaction, in accordance with UK and European statutory tax documentation laws and US Internal Revenue Service (IRS) standards.
   General Inquiry Communications: Correspondence and customer service logs are retained for up to two (2) years from the date of final resolution to manage follow-up queries and address operational needs.
   Technical Log Data: Automated system access logs are systematically overwritten or deleted within ninety (90) days, unless required for active operational compliance or review.
6. Data Disclosure to Third Parties
   We do not engage in the sale or unauthorized renting of customer personal information. To fulfill our commercial obligations, your data is shared exclusively with necessary service operators, including:
   Payment Infrastructure Operators: Specifically Stripe, to execute payment captures and standard financial screening.
   Logistical Entities: Corporate courier networks and postal services tasked strictly with physical item delivery.
   Regulatory Frameworks: Law enforcement, tax authorities, or legal advisers where a statutory duty of disclosure exists.
7. Data Protection Standards
   We implement structured institutional procedures and technical measures designed to restrict unauthorized access, alteration, disclosure, or destruction of your personal data. These protocols are evaluated routinely to support operational stability. Please note that while we employ standard practices to manage and shield our data assets, no method of digital transmission or electronic storage can be declared completely immune from external compromise, and we do not provide absolute assertions regarding total data invulnerability.
8. Your Statutory Rights
   Depending on your geographical location (UK, EU member states, or specific US states), you possess distinct statutory privileges concerning your personal data under prevailing frameworks:
   Access and Portability: The right to request copies of the personal information we maintain regarding your account.
   Rectification: The right to demand the correction of inaccurate or incomplete data records.
   Erasure (“Right to be Forgotten”): The right to request the deletion of your records, subject to overriding statutory data retention laws.
   Restriction and Objection: The right to limit or object to specific processing channels based on legitimate interests.

To exercise any of these rights, please submit a formal administrative request to travel@travelbrushkit.com. We intend to address all verified inquiries within the legally prescribed statutory timeframe.