This Privacy Policy explains how personal information is handled when you browse hokafootwear.uk, place an order, create an account or contact us. It also outlines your data protection rights and how to raise a concern.

1. Responsibility for Your Information

The business operating hokafootwear.uk is the data controller for personal information it processes to operate the shop and manage customer relationships.

For privacy enquiries or requests concerning your information, use the contact details published on our Contact Us page.

Some organisations involved in your purchase, such as payment providers, may process information as independent controllers. Their privacy notices explain their own activities.

2. Personal Information We Process

The information involved depends on how you use the website and may include:

  • Identity and contact details: Your name, email address, billing address, delivery address and telephone number where needed.
  • Purchase information: Ordered products, sizes, quantities, order references, delivery updates and return records.
  • Payment records: Transaction references, payment status, payment method and refund information.
  • Account details: Registration information, saved addresses and preferences.
  • Customer communications: Enquiries, complaints and supporting information you provide.
  • Technical information: IP address, device and browser details, access times, error logs and website interactions.
  • Privacy choices: Marketing preferences and cookie consent or objection records.

Information may be supplied directly by you, generated through website use or received from payment and delivery providers in connection with your order.

3. Purposes and Lawful Bases

Processing your purchase

We use relevant information to administer orders, arrange payments and delivery, and handle returns. This is necessary to perform our contract with you or take steps you request before entering a contract.

Providing a customer account

Registration details and saved information are used to provide account functions you request. The lawful basis is performance of the account service agreement.

Answering enquiries

We process messages to respond to product questions, order queries and complaints. Depending on the circumstances, this supports our contract with you or our legitimate interest in providing customer assistance.

Protecting the website and preventing fraud

Technical and transaction information may be used to investigate suspicious activity and protect customers, accounts and systems. We rely on our legitimate interests in security and fraud prevention, balanced against your rights and interests.

Meeting legal requirements

Information may be processed to meet applicable accounting, tax, regulatory and other legal obligations.

Improving website performance

Where analytics or similar tools are used, their purposes and lawful bases depend on the actual configuration. Consent is obtained where required. Further details belong in the relevant cookie and service information.

Where information is necessary to fulfil an order, not providing it may prevent us from completing your purchase or supplying the requested service.

4. Marketing Preferences

Where promotional communications are offered, they will be sent only as permitted by applicable law. We will obtain consent where required.

You can unsubscribe through the link in a marketing message or contact us to update your preferences. Essential communications about orders, payments, delivery or product safety are separate from promotional messages.

You may object at any time to processing for direct marketing, including profiling connected with that marketing. ico.org.uk

5. Cookies and Similar Technologies

Cookies and related technologies may support functions such as shopping baskets, account sessions and stored preferences. Analytics or advertising technologies may also be used where enabled and lawfully configured.

Please read our Cookie Policy for information about the relevant categories and available controls. Technologies requiring consent must not be activated before you agree. Browsing alone does not constitute consent.

6. Recipients of Information

Where necessary for the relevant purpose, information may be shared with:

  • Website hosting, maintenance and technical support providers.
  • Payment processors and financial institutions.
  • Fulfilment and delivery providers.
  • Customer support and communications services.
  • Professional advisers, regulators and authorities where justified or legally required.

Providers processing information on our instructions must be subject to appropriate contractual arrangements. Organisations acting as independent controllers are responsible for their own processing.

7. Processing Outside the UK

Depending on the location of service providers and their systems, information may be processed outside the UK.

Where this constitutes a restricted international transfer, the applicable legal requirements must be met. Safeguards may include UK adequacy regulations or approved contractual arrangements, together with supplementary measures where necessary.

Contact us for details of safeguards relevant to your information and how to obtain a copy, subject to lawful redactions.

8. Retention of Information

Personal information is retained only for as long as necessary for its purpose or to meet applicable legal requirements.

Retention decisions take account of:

  • Whether an account or customer relationship remains active.
  • Outstanding deliveries, returns, refunds or complaints.
  • Accounting and tax obligations.
  • Relevant legal limitation periods and disputes.
  • The purpose and continuing necessity of security records.

Closing an account does not automatically erase records we must lawfully retain. Limited information may also be retained to respect a marketing objection and avoid sending further promotions.

Specific retention periods, or meaningful criteria used to determine them, must reflect the actual records and purposes involved. ico.org.uk

9. Protecting Your Information

Appropriate technical and organisational measures are required to protect personal information against unauthorised access, alteration, loss and misuse. No method of online transmission or storage can guarantee absolute security.

Keep your account credentials confidential. Do not send passwords, full card details, card security codes or banking verification codes through customer support messages.

10. Your Data Protection Rights

Depending on the circumstances and lawful basis, you may have the right to:

  • Obtain access to your personal information.
  • Request correction of inaccurate or incomplete details.
  • Request erasure.
  • Restrict certain processing.
  • Receive qualifying information in a portable format.
  • Object to processing based on legitimate interests.
  • Withdraw consent where processing relies on it.

These rights are subject to legal conditions and exceptions. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

To make a request, contact us through our published contact details. We may request proportionate information to verify your identity. We will respond within the applicable legal timeframe, normally one month, subject to lawful extensions or adjustments. ico.org.uk

11. Automated Decision-Making

If automated decisions with legal or similarly significant effects are used, the applicable privacy information must explain the processing, its consequences and available safeguards, including rights to human intervention and challenge where required.

Payment providers may carry out their own automated checks. Their privacy notices explain processing for which they are independently responsible.

12. Complaints

Please contact us if you have a concern about the handling of your information so we can investigate and respond.

You also have the right to complain to the UK Information Commissioner’s Office. Guidance and contact options are available on the ICO complaints page. ico.org.uk

13. Changes to This Policy

This policy may be updated when services, processing activities or legal requirements change. Where required, significant changes will be brought to your attention separately.

Before publication, add the controller’s actual legal identity and contact details, plus any required representative or data protection officer details. Verify the processing activities, providers, retention arrangements, international transfers and automated decision-making practices against the website’s actual operation.