Privacy Policy

1. Data We Collect

We collect personal data in three ways:

• Information you give us — name, email, password (stored hashed), shipping and billing addresses, phone number, order history, product reviews, messages you send to sellers, and support requests.
• Information collected automatically — IP address, device and browser type, pages viewed, referring URLs, and similar diagnostic data, gathered through cookies and server logs to operate and secure the site.
• Information from third parties — payment confirmation and fraud signals from our payment processor, and delivery status from shipping carriers.

We do not seek special categories of data (e.g. health, biometrics); please do not send them to us or to sellers through chat.

2. How We Use Your Data

We use your data to:

• create and manage your account and authenticate you;
• process orders, payments, refunds, and returns;
• share order details with the seller fulfilling your purchase (see §3);
• provide customer support and respond to your messages;
• detect, prevent, and investigate fraud, abuse, and security incidents;
• maintain an internal rating and trust system to ensure the safety of our Seller and Buyer communities;
• send transactional emails and, with consent where required, marketing;
• comply with legal obligations and enforce our Terms of Service.

Our legal bases (where the GDPR applies) are: performance of a contract (orders, account), legitimate interests (security, service improvement), consent (marketing, non-essential cookies), and legal obligation (tax, accounting). We do not sell your personal data.

3. Sharing With Sellers

Hands To Home is a multi-vendor marketplace. When you place an order, the seller fulfilling it receives the information needed to ship and support it — your name, shipping address, the items ordered, and any messages or personalization you provide. Sellers act as independent controllers of that data and may only use it to fulfil and support your order; they may not use it for their own marketing without your consent.

4. Third-Party Processors

We share data with vetted service providers who process it on our behalf under contract, only as needed to run the marketplace:

• Payments — our payment processor handles card details; we never store full card numbers.
• Shipping & logistics — carriers receive the address required to deliver your order.
• Hosting & infrastructure — cloud hosting, content-delivery, and database providers store data securely.
• Communications — email delivery and in-app messaging providers send transactional messages.

We may also disclose data where required by law, court order, or to protect rights and safety.

5. Cookies & Similar Technologies

We use cookies and similar technologies in three categories:

• Strictly necessary — sign-in sessions, cart contents, and security. These cannot be switched off.
• Functional — remember preferences such as recently viewed items.
• Analytics — help us understand aggregate usage so we can improve the site.

Where required by law, non-essential cookies are set only with your consent, which you can change at any time through your browser settings or our cookie controls. Blocking necessary cookies may break core features like checkout.

6. Data Retention

We keep personal data only as long as needed for the purposes above. When data is no longer needed we delete or anonymise it. You can request earlier deletion as described in §9 and in your account settings, subject to legal retention obligations. Our retention schedule (#798):

• Account PII (name, email, phone): kept while your account is active; anonymised on account deletion.
• Addresses: street and phone anonymised on deletion; non-identifying fields kept for tax records (up to 7 years).
• Order & transaction records: up to 7 years for tax/accounting law, with buyer PII anonymised on deletion.
• Payment card details: never stored by us — held by our PCI-compliant payment processor.
• Support / chat messages: up to 2 years, then deleted.
• Product reviews: retained (anonymised) for the benefit of other shoppers.
• Analytics & diagnostic events: up to 90 days.

7. International Data Transfers

We and our processors may store and process data in countries other than your own. Where data is transferred out of the EEA, UK, or other regulated regions, we rely on appropriate safeguards — such as the European Commission’s Standard Contractual Clauses — to ensure your data receives an equivalent level of protection.

8. How We Protect Your Data

We use industry-standard safeguards including encryption in transit (HTTPS), hashed passwords, access controls, and regular security review. No method of transmission or storage is perfectly secure, but we work to protect your data and to limit access to those who need it.

9. Your Rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data (“right to be forgotten”);
• restrict or object to certain processing;
• data portability — receive your data in a portable format;
• withdraw consent at any time where processing is based on consent.

You can exercise most of these rights directly in your account settings, or by contacting support. We will respond within the timeframe required by applicable law (generally 30 days).

10. California Privacy Rights (CCPA/CPRA)

California residents have the right to know what personal information we collect, the purposes for collecting it, and the categories of third parties with whom we share it; to request deletion; to correct inaccurate information; and to be free from discrimination for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising as those terms are defined under the CPRA.

11. Children's Privacy

Hands To Home is intended for users aged 18 and over and is not directed to children under 13. We do not knowingly collect personal data from children under 13 (COPPA). If you believe a child has provided us with personal data, contact us and we will delete it.

12. Data Breach Notification

In the event of a personal-data breach likely to result in a risk to your rights, we will notify the relevant supervisory authority and, where required, affected users without undue delay and in accordance with applicable law.

13. Changes to This Policy

We may update this policy from time to time. Material changes will be posted on this page with a revised “Last updated” date, and where required we will notify you directly.

14. Contact & Complaints

Questions or requests about your privacy? Reach us through the support channel linked in the site footer. If you are in the EEA or UK and believe we have not resolved your concern, you also have the right to lodge a complaint with your local data-protection supervisory authority.