Privacy & cookies
What we collect, why we collect it, who else sees it, and how to make us delete it. Written to be read, not to be survived.
Last updated: 8 November 2026
Who is responsible
DUNE PAWS is a trading name of Shenyang Yuanmei Trading Co., Ltd. (沈阳市沅美商贸有限公司), registered in Tiexi District, Shenyang, Liaoning, China. That company is the data controller for everything described on this page.
One address for anything privacy related: hello@dunepaws.com. WhatsApp is +86 195 3714 4996. A person reads both, usually within a day.
Collection
What we hold
Five categories. Nothing else is stored on our side.
| Category | What it includes | Where it comes from |
|---|---|---|
| Order details | Name, delivery address, emirate, phone number, email, items ordered, engraving text | You, at checkout |
| Payment record | Transaction ID, payer name, amount, currency, payment status | PayPal. Your card number never reaches us |
| Messages | Whatever you type into the contact form, an email, or a WhatsApp message | You |
| Newsletter | Email address only | You, if you subscribe |
| Device and usage | IP address, browser and device type, pages viewed, the link you arrived from | Your browser, automatically |
What we never collect
No card numbers. No passport or Emirates ID. No health information. No precise GPS location. No biometric data. Nothing about children.
What we never do
We do not sell your data. We do not rent it. We do not hand it to data brokers, list vendors or anyone running a "similar audience" business. If a request like that arrives, the answer is no.
Purpose
Why we use it, and on what basis
Each purpose below has one legal basis. None of it is used to build a profile of you for resale, and refusing any optional part of it does not block your order.
| What we do | Legal basis |
|---|---|
| Take payment, pack and ship your order, complete customs paperwork | Performance of a contract |
| Handle returns, exchanges and warranty claims | Performance of a contract |
| Answer your messages and give sizing advice | Legitimate interest |
| Detect fraud, chargebacks and abuse of discount codes | Legitimate interest |
| Understand which pages lead to a sale | Legitimate interest — analytics cookies, which you can block |
| Show our products to you again on Meta and Instagram | Legitimate interest — advertising cookies, which you can block |
| Send the newsletter you asked for | Consent |
Sharing
Who else sees your data
Seven processors. Each one gets the minimum needed to do its single job, and nothing more.
| Recipient | What they receive | Why | Located in |
|---|---|---|---|
| Netlify | Order form submissions, server logs, IP addresses | Website hosting and form handling | United States |
| PayPal | Name, email, address, amount, transaction data | Payment processing and buyer protection | Luxembourg / United States |
| Alibaba Cloud Mail | Email address, message content | Business email hosting | China |
| Meta — WhatsApp | Phone number, message content | Customer support | United States |
| Meta — Pixel | Page views, add-to-cart and purchase events, cookie ID | Measuring and targeting advertising | United States |
| Google — Analytics | Page views, approximate city, device type | Traffic analysis | United States |
| Courier partner | Name, address, phone, declared contents and value | Delivery and customs clearance | China / United Arab Emirates |
We may also disclose data where a court, customs authority or regulator lawfully requires it. If that happens and we are allowed to tell you, we will.
As of 8 November 2026, Meta Pixel and Google Analytics are not switched on. They are listed above because the store will use them to measure advertising once campaigns begin, and this page is the reference for that use. Until they are on, no analytics or advertising cookie is set, and nothing about your visit leaves the site except the ordinary server log.
When they are switched on, this line changes to say so, and the date at the top of the page changes with it.
Cookies
Cookies and local storage
Three things are stored in your browser. One is required, two are optional.
| Name | Type | Purpose | Lasts | Optional |
|---|---|---|---|---|
| sp_cart_v1 | Local storage | Remembers what is in your bag between visits | Until you clear it | No |
| _ga, _ga_* | Analytics cookie | Tells one visitor apart from another so we can count traffic | 26 months | Yes |
| _fbp | Marketing cookie | Lets Meta attribute a purchase to the ad that caused it | 90 days | Yes |
Chrome — Settings → Privacy and security → Third-party cookies → Block third-party.
Safari — Settings → Privacy → Prevent cross-site tracking.
Firefox — Settings → Privacy & Security → Strict.
Edge — Settings → Cookies and site permissions → Block third-party.
On a phone the path is the same, inside the browser's own settings.
To stop Meta choosing our ads from your off-Facebook activity, open Meta ad preferences. This does not remove ads; it stops them being selected from what you do elsewhere.
Blocking either one does not change the price, the delivery time, or your ability to order.
Retention
How long we keep it
Long enough to run the shop and satisfy tax law, then gone.
| Category | Kept for | Why that long |
|---|---|---|
| Order and payment records | 7 years | Accounting and tax obligations |
| Contact messages | 2 years | So we can look up an old conversation when you ask again |
| Newsletter subscription | Until you unsubscribe | No reason to keep it after that |
| Analytics data | 26 months | Enough to compare one year against the next |
| Advertising data | 90 days | Meta's own attribution window |
| Server logs | 30 days | Security and debugging only |
Where your data goes
Our site is hosted in the United States. Our company is registered in China. Our customers are in the Gulf. Your data therefore crosses borders — that is unavoidable for a store that ships from China to the UAE, and we would rather say it plainly than bury it.
Every transfer to a processor outside your country relies on standard contractual clauses or an equivalent safeguard, and every processor listed above is bound by a data processing agreement. We keep the list short on purpose: seven processors is already more than we would like.
Your rights
Under the UAE Personal Data Protection Law, and under the EU GDPR where it applies to you, you can ask us to do any of the following:
- Show you a copy of everything we hold about you
- Correct anything wrong, including a misspelt delivery address
- Delete it, where we are not required by tax law to keep the order record
- Stop a particular use, such as advertising measurement
- Withdraw consent for cookies or the newsletter, at any time
- Export it in a machine-readable format
- Complain to your local data protection authority
Email hello@dunepaws.com with the subject line Data request. We reply within 30 days. We may ask one question to confirm the request is really yours. We do not charge for any of this, and we will not treat a request as a reason to close your account or refuse an order.
How we protect it
The whole site runs over HTTPS. Card numbers are entered on PayPal's page, not ours, and never reach our servers. We do not run our own database — orders live in Netlify Forms, which is access-controlled and encrypted at rest. Only the two people who run this store can open an order. Two-factor authentication is on for every account that can reach customer data.
If a breach ever affects your data, we email every affected customer within 72 hours of confirming it, and we tell you what was exposed and what we did about it.
Children
This shop is for adults. It is not directed at anyone under 18 and we do not knowingly collect their data. If you believe a child has sent us information, email us and we will delete it the same day.
Changes to this page
When we change how we use your data, we update this page and change the date at the top. Anything material gets a notice on the home page for 30 days. We do not backdate changes, and we do not quietly widen a purpose you already agreed to.
Contact
Email: hello@dunepaws.com
WhatsApp: +86 195 3714 4996
Post: Shenyang Yuanmei Trading Co., Ltd., Tiexi District, Shenyang, Liaoning, China
The button opens your mail app with the request already written. We reply within 30 days. There is no charge, and asking does not affect any order or warranty.
If you are in the UAE and are not satisfied with our answer, you can raise the matter with the UAE Data Office. If you are in the EU, you can contact your national supervisory authority.