Privacy Policy


Last updated: 13 February 2026

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use and share information when you visit poshpinnacle.com or purchase from us.

1. Who We Are

Data controller:
Sonak Media Ltd trading as PoshPinnacle
Registered address: Sonak Media Ltd, 5 Brayford Square, London, E1 0SG, England, United Kingdom.

Contact email: support@poshpinnacle.com
Telephone: +44 7457 408836

About Us

PoshPinnacle is an independent fashion retailer operated by Sonak Media Ltd and hosted on the Shopify platform, which provides the technology we use to run our store securely.

Your data is stored through Shopify’s data storage, databases and the general Shopify application. They store your data on secure servers behind firewalls.

Payment

If you choose a direct payment gateway to complete your purchase, then Shopify stores your payment card data. It is encrypted through the Payment Card Industry Data Security Standard (PCI‑DSS).

Your purchase transaction data is stored only as long as is necessary to complete your purchase transaction. After that is complete, your purchase transaction information is deleted.

All direct payment gateways adhere to the standards set by PCI‑DSS as managed by the PCI Security Standards Council (a joint effort of brands like Visa, MasterCard, American Express and Discover). PCI‑DSS requirements help ensure the secure handling of credit card information by our store and its service providers.

For more insight, you may also want to read Shopify’s Terms of Service or Privacy Policy.

2. Where Your Order Ships From

To keep delivery times reasonable, we use fulfilment centres in the UK and across Europe. Your order may be routed through the location best placed to fulfil it quickly and efficiently.

We may occasionally use warehouses in other regions (for example the EU or US) where this is necessary to deliver your order.

Our Warehouse Network (legacy information)

In the past we have used a wider global warehouse network, including locations such as Sydney (Australia), Salzburg (Germany), various cities in Italy, Jönköping and Stockholm (Sweden), Alicante (Spain) and facilities in Florida and Minnesota (USA). As our supplier mix evolves, we may adjust the exact locations used, but the principles in this policy continue to apply.

3. Where We Deliver

We currently deliver to:

  1. United Kingdom
  2. European Union
  3. United States
  4. Canada
  5. Australia
  6. United Arab Emirates

For more information about delivery times and costs, please see our Shipping Policy.

4. The Data We Collect

We collect only the personal data we need in order to operate our business, fulfil your orders and improve your experience.

a. Identifiers and contact details

  • Name and surname
  • Billing and shipping addresses
  • Email address
  • Telephone number

These details are required for order fulfilment and to provide customer support and legal documentation (for example, invoices and tax records).

b. Payment information

  • Payment card details (processed by Shopify Payments, PayPal or similar providers)
  • Transaction amounts and dates

We never store full raw card data on our servers. Payment information is processed securely by our payment providers in line with PCI‑DSS.

c. Device and behavioural data

  • IP address, browser type, device type and operating system
  • Time zone and language settings
  • Pages viewed, time spent on pages, links clicked
  • Referring URLs and general browsing patterns

This information is collected via cookies and similar technologies (see Section 11) and helps us understand how visitors use our site, detect problems and improve the experience. It may also be used to personalise product recommendations and content.

d. Account information (if you create an account)

  • Username and encrypted password
  • Order history and saved addresses
  • Wishlist, preferences and marketing subscriptions

Some orders may relate to more sensitive product categories, such as lingerie and intimatewear. We treat all purchase history confidentially and do not disclose specific items you have bought to third parties for their own marketing, and we avoid using intimate purchases in public marketing (for example, named testimonials or social proof) without your explicit consent.

e. Customer support records

  • Emails and contact form submissions
  • Live chat logs
  • Notes from phone calls

We use these to respond to enquiries, resolve issues and improve our service.

Legal basis: We process data primarily to fulfil orders (contractual necessity), to comply with legal obligations, to improve our services (legitimate interest), or with your consent (for example, marketing emails).

5. Why We Use Your Data (Legal Bases)

We process your data because:

  • Contractual necessity: To take steps at your request and perform our contract with you when you place an order (e.g. processing payment, delivering goods, handling returns and refunds).
  • Legal obligation: To comply with UK law, including tax and accounting rules, and to respond to lawful requests from authorities.
  • Legitimate interests: To prevent fraud, secure our website, understand how customers use our site, improve our products and services and run our business efficiently. We balance these interests against your rights and expectations.
  • Consent: For email marketing and certain cookies or analytics where consent is required. You can withdraw consent at any time (see Section 10).

6. How We Use Your Data

Your information is used to:

  • Process orders: Take payment, provide order confirmations, arrange shipping, manage returns and handle customer service queries.
  • Prevent fraud: Screen high‑risk transactions and protect our store and customers from fraudulent activity.
  • Improve our website: Analyse traffic and user behaviour to fix issues, optimise layout and plan new features.
  • Send marketing (with your consent): Share news, product updates and special offers via email or other channels you have opted into.

We do not sell your personal data to third‑party companies for their own marketing.

7. Consent

a. How we obtain your consent

When you provide personal information to complete a transaction, verify your card, place an order, arrange for a delivery or return a purchase, we imply that you consent to our collecting it and using it for that specific purpose.

If we ask for your personal information for a secondary purpose, such as marketing, we will either ask you directly for your explicit consent or give you a clear opportunity to say no.

b. How to withdraw your consent

If you change your mind after opting in, you may withdraw your consent for us to contact you or to continue processing your information (where consent is the legal basis) at any time by contacting us at support@poshpinnacle.com.

You can also stop marketing emails at any time by clicking the “unsubscribe” link in any marketing message.

8. Third‑Party Services and Links

In general, the third‑party providers we use will only collect, use and disclose your information to the extent necessary to allow them to perform the services they provide to us (for example payment processing, analytics, shipping or customer support).

However, certain third‑party providers, such as payment gateways and other payment processors, have their own privacy policies in respect of the information we are required to provide to them for your purchase‑related transactions. We recommend that you read their privacy policies so you can understand how your personal information will be handled by them.

Some providers may be located in or have facilities located in a different jurisdiction to you or us. If you proceed with a transaction involving a third‑party provider, your information may become subject to the laws of the jurisdiction(s) where that provider or its facilities are located (for example, United States law if a gateway is based in the US).

Once you leave our website or are redirected to a third‑party site or application, this Privacy Policy and our Terms of Service no longer apply.

Third‑party links

Our site may contain links to external websites (for example, partner brands or social media platforms). These sites are not governed by this policy. When you click on external links, we are not responsible for the privacy practices of those sites and encourage you to read their privacy statements.

Third‑party categories we work with

Category Partners Purpose Data shared
Payment processors Shopify Payments, PayPal Secure payment processing Card details (encrypted), billing details
Shipping carriers Trusted courier partners (e.g. Royal Mail, DPD, UPS, DHL) Deliver orders and provide tracking Name, address, phone number, email where needed
Analytics Google Analytics and similar tools Improve website performance Anonymised or pseudonymised browsing data
Customer support Tidio and similar providers Respond to enquiries Order details, contact information, messages
Professional services Accountants, lawyers, compliance advisers Legal, accounting and compliance Limited data as necessary

Note: Third‑party providers operate under their own privacy policies. For example, companies based in the United States may be subject to US legislation when handling personal data.

9. Data Security

We protect your data through measures such as:

  • SSL/TLS encryption for data transmitted between your browser and our site.
  • PCI‑DSS compliance via our payment providers for secure card processing.
  • Access controls so only authorised staff can view personal data.
  • Use of reputable third‑party providers with strong security practices.
  • Internal policies and staff training on data protection.

While no system can be 100% secure, we regularly review our safeguards to keep your information safe.

10. Retention Periods

We keep personal data only as long as necessary. Typical retention periods are:

  • Orders: 7 years (for tax and legal compliance).
  • Customer accounts: Deleted or anonymised after 2 years of inactivity, unless we must retain data longer for legal reasons.
  • Marketing data: Removed when you opt out or after 2 years of no engagement.

11. Your Rights (GDPR / UK GDPR)

Under data protection law, you have the following rights in relation to your personal data:

  • Access – to request a copy of the data we hold about you.
  • Rectification – to correct inaccurate or incomplete data.
  • Erasure – to request deletion of your data in certain circumstances.
  • Restriction – to ask us to suspend processing in certain cases.
  • Objection – to object to processing based on legitimate interests or direct marketing.
  • Data portability – to receive your data in a usable format, where applicable.
  • Withdraw consent – where processing is based on consent (for example, marketing).

To exercise any of these rights, email support@poshpinnacle.com with “Data Request” in the subject line. We may ask you to verify your identity before acting on your request.

If you are unhappy with how we handle your data, you can also complain to the UK Information Commissioner’s Office (ICO) at www.ico.org.uk.

12. Cookies and Tracking

We use cookies and similar technologies to:

  • Essential cookies: Required for core site functions like cart and checkout.
  • Analytics cookies: Help us understand site usage (you can opt out via tools such as Google’s opt‑out add‑on).
  • Advertising cookies: Used for personalised ads, only where you have given consent.

You can manage your preferences at any time on our cookies page: Cookie settings.

Do Not Track (DNT): at the moment, we are not able to respond to DNT browser signals.

13. International Data Transfers

Because we use global service providers (such as Shopify, payment processors and analytics services), your data may be transferred outside the UK and the European Economic Area.

When we make such transfers, we ensure appropriate safeguards are in place, such as adequacy decisions or Standard Contractual Clauses, so that your data remains protected to standards equivalent to UK data protection law.

Examples include transfers to Shopify in North America and to logistics providers operating from the EU.

14. Age of Consent

By using this site, you represent that you are at least the age of majority in your state or province of residence, or that you are the age of majority and you have given us your consent to allow any of your minor dependants to use this site.

Our services are not intended for users under 18. We delete any data we discover has been collected from minors upon request.

15. Automated Decisions

We do not use fully automated decision‑making (including AI profiling) that produces legal or similarly significant effects on you. We may use automated tools to help detect potential fraud, but any important decisions are reviewed by a person.

16. Data Breach Response

We have procedures in place to identify and manage personal data breaches. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will:

  1. Notify affected users without undue delay (usually within 72 hours); and
  2. Report the breach to the UK Information Commissioner’s Office (ICO) where required.

17. Updates to This Policy & Contact

We may update this Privacy Policy from time to time to reflect changes in our business, legal requirements or technology. When we make significant changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or a notice on our website.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact:

Email: support@poshpinnacle.com