Privacy policy

Effective date: 1 July 2026 Data controller: FG Paws — Justin Sterrenberg, 82 Rua Vale das Hastes, 2460-208 Alfeizirão, Portugal Contact: info@fgpaws.com

What this policy covers

This policy explains what personal data FG Paws collects when you use our website (fgpaws.com), how we use it, who we share it with, how long we keep it, and your rights as an EU data subject under the General Data Protection Regulation (GDPR) and Portuguese data protection law.

Who we are

FG Paws is a small online dog products store, registered in Portugal, run by Justin Sterrenberg. We sell ~200 curated dog products to customers across the European Union.

What data we collect

What	When	Why
Name	Account creation, checkout, contact form	To process orders, ship to you, reply to your messages
Email	Account creation, checkout, newsletter signup, contact form	Order confirmation, shipping updates, marketing (with consent), support replies
Postal address	Checkout	To ship your order
Phone number	Checkout (optional)	For carrier delivery contact if needed
Payment information	Checkout	To process payment — handled by Shopify Payments, Stripe, PayPal, or Klarna depending on your choice. We never see or store your full card details.
Browsing behaviour	Site usage	Improving the site, abandoned-cart emails (with consent), basic analytics
Cookies	Site visit	Essential site function + analytics + marketing (you choose which)
Your dog's info (optional, contact form)	Contact form	Helps us answer sizing/product questions accurately

We collect only what we need to operate the shop and serve you. We do not collect or store data on minors. We do not run third-party marketing tracking pixels beyond what's necessary for our own customer email flows.

Legal basis for processing (GDPR Art. 6)

Processing	Legal basis
Fulfilling your order	Contract (Art. 6(1)(b))
Replying to your contact form / email	Legitimate interest + your request
Marketing emails (newsletter)	Consent (Art. 6(1)(a)) — opt-in only, unsubscribe anytime
Abandoned cart emails	Consent (Art. 6(1)(a)) — opt-in at checkout
Site analytics, fraud prevention	Legitimate interest (Art. 6(1)(f))
Accounting / tax compliance	Legal obligation (Art. 6(1)(c))

Who we share your data with

We share the minimum necessary data with these processors to run the shop:

Processor	What they receive	What they do
Shopify, Inc. (Canada/Ireland)	All ecommerce data	Hosts the storefront, processes transactions, stores order data
Shopify Payments / Stripe (Ireland)	Payment information	Processes card payments
PayPal / Klarna (if you choose them)	Payment info, contact details	Processes alternative payments
Hofman Animal Care (Netherlands)	Name, shipping address, order contents	Picks, packs and ships your order
Carriers (DHL, DPD, PostNL, CTT, others)	Name, shipping address, phone (if given)	Delivers your parcel
Klaviyo (USA, GDPR-compliant)	Email, name, order history	Sends our email newsletter and abandoned-cart emails (with consent)
Judge.me (Hong Kong, GDPR-compliant)	Email, order data	Sends post-purchase review requests (with consent)
Google Analytics (USA)	Anonymised browsing behaviour	Site analytics — only with cookie consent

All processors are GDPR-compliant. Where data leaves the EU (e.g., to USA-based services), it does so under approved transfer mechanisms (Standard Contractual Clauses, EU-US Data Privacy Framework where applicable).

We do not sell, rent, or trade your personal data to third parties.

Cookies

We use cookies in three categories. You can choose which to allow via the cookie banner on your first visit, and change your choice anytime by clicking "Cookie settings" in the footer.

Category	Examples	Required?
Essential	Cart, checkout, login session	Yes — site won't function without
Analytics	Google Analytics, page view counts	No — opt-in
Marketing	Klaviyo tracking pixel, conversion tracking	No — opt-in

How long we keep your data

Data	Retention
Order data (name, address, items, payment record)	10 years — Portuguese accounting law requires this
Account information	Until you delete your account
Newsletter subscription	Until you unsubscribe
Contact form messages	2 years after last reply
Anonymous site analytics	14 months

Your rights (GDPR)

You have the right to:

Access your personal data — get a copy of what we hold
Rectification — correct anything inaccurate
Erasure ("right to be forgotten") — delete your data, subject to legal retention requirements
Restriction — pause our use of your data
Portability — get your data in a portable format
Object — to our processing based on legitimate interest
Withdraw consent — for marketing emails, anytime
Complain — to the Portuguese data protection authority (CNPD) at www.cnpd.pt

To exercise any of these rights, email info@fgpaws.com. We'll respond within 30 days, usually faster.

Security

We protect your data with: - HTTPS encryption across the entire site - Shopify's PCI-compliant payment processing - Two-factor authentication on admin access - Limited access — only Justin sees account-level data

If there's a data breach affecting your information, we'll notify you and the CNPD within 72 hours of discovery, as required by GDPR.

Changes to this policy

If we change this policy, we'll update the effective date at the top and, for material changes, email registered customers and account holders before the changes take effect.