Privacy Policy

Debs & the Horse is a UK-based personalised horse portrait and merchandise business. We operate the website at debsandthehorse.com.

Data Controller: So So Group Limited, a company registered in England and Wales (company number 17284104), whose registered office is at 128 City Road, London, EC1V 2NX, United Kingdom, trading as Debs & the Horse.

Contact: hello@debsandthehorse.com

For the purposes of UK GDPR, we are the data controller for all personal data collected through this website.

2.1 Data you provide directly

• Identity data: your name.
• Contact data: your email address, telephone number, and delivery address.
• Order data: products ordered, design selections, and order history.
• Payment data: billing details. Note: we do not see or store your full card number — payment is processed securely by Shopify Payments.
• Photograph data: any photographs you upload to our website for the purpose of generating your AI portrait.
• Communications data: any messages, emails, or enquiries you send us.

2.2 Data we collect automatically

• Technical data: your IP address, browser type and version, device type, operating system, and time zone.
• Usage data: pages you visit, links you click, and how you navigate our website.
• Cookie data: see Section 8 below for full details of the cookies we use.

2.3 Data from third parties

• We may receive limited data from our payment processor (Shopify Payments) confirming the status of your transaction.
• If you interact with us via social media, we may receive basic profile information in accordance with your privacy settings on that platform.

We only use your personal data where we have a lawful basis for doing so. The table below explains what we use your data for and our lawful basis for each purpose.

Photographs: Photographs you upload are used solely to generate your AI portrait and fulfil your order. To create your portrait, your photograph is processed by our AI image-generation provider, Google, using its Gemini models. We use Google's paid Gemini API / Vertex AI service under Google's Cloud Data Processing Addendum, under which Google does not use your photograph to train its models. Your photographs are not used for any marketing or any other purpose, and are deleted from our systems within 90 days of your order being fulfilled.

We do not sell your personal data. We share your data only where necessary to deliver our service, with the following third parties:

All third-party processors are required to handle your data securely and only for the specific purpose for which it is shared. Where data is transferred outside the UK, we ensure appropriate safeguards are in place (see Section 7).

We retain your personal data only for as long as necessary for the purposes set out in this policy, or as required by law.

After the applicable retention period, data is securely deleted or anonymised.

You have the following rights in relation to your personal data:

• Right of access: you can request a copy of the personal data we hold about you (a “subject access request”).
• Right to rectification: you can ask us to correct inaccurate or incomplete data.
• Right to erasure: you can ask us to delete your personal data, subject to certain legal exceptions (e.g. where we are required to retain records for tax purposes).
• Right to restrict processing: you can ask us to limit how we use your data in certain circumstances.
• Right to data portability: you can ask us to provide your data in a structured, machine-readable format.
• Right to object: you can object to us processing your data for direct marketing at any time, and for other purposes where we rely on legitimate interests.
• Right to withdraw consent: where we rely on your consent to process your data (e.g. for marketing emails), you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us at hello@debsandthehorse.com. We will respond within one calendar month. In some cases we may need to verify your identity before processing your request.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Some of our third-party service providers process data outside the United Kingdom. Where this occurs, we ensure that appropriate safeguards are in place to protect your data in accordance with UK GDPR:

• Printful (Printful, Inc., USA; EU representative AS “Printful Latvia”, Riga, Latvia) — operates fulfilment centres in the EU (including Latvia and Spain) and the United States. Transfers to the EU are covered by the UK's adequacy regulations. Transfers to the US are safeguarded by Standard Contractual Clauses together with the UK International Data Transfer Addendum (IDTA), as set out in Printful's Data Processing Terms.
• Shopify (Shopify Inc. / Shopify International Limited) — headquartered in Canada, which benefits from a UK adequacy decision. Where data is processed in the United States, it is safeguarded by Standard Contractual Clauses with the UK Addendum, or by the UK Extension to the EU–US Data Privacy Framework (the “UK–US Data Bridge”) where the recipient is certified under it.
• Google Analytics (Google LLC) — data is processed in the United States. Google LLC self-certifies under the EU–US Data Privacy Framework and its UK Extension (the UK–US Data Bridge); transfers are also covered by Google's data processing terms incorporating Standard Contractual Clauses with the UK Addendum.
• Google (AI portrait generation) — your uploaded photograph is processed by Google's Gemini models in the United States to generate your portrait. Google LLC self-certifies under the EU–US Data Privacy Framework and its UK Extension (the UK–US Data Bridge); we use the paid Gemini API / Vertex AI under Google's Cloud Data Processing Addendum (incorporating Standard Contractual Clauses with the UK Addendum), under which your photograph is not used to train Google's models.

You can request details of the specific safeguards in place for any international transfer by contacting us at hello@debsandthehorse.com.

8.1 What are cookies?

Cookies are small text files placed on your device when you visit a website. They help websites function correctly, remember your preferences, and gather analytics information.

8.2 Cookies we use

8.3 Your cookie choices

When you first visit our website, you will be shown a cookie consent banner. You can choose to accept or decline non-essential cookies at that point. You can also change your preferences at any time by clicking the “Cookie Settings” link in the footer of our website.

You can also control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of our website. For more information on managing cookies, visit www.allaboutcookies.org.

We will only send you marketing emails if you have explicitly opted in to receive them (for example, by ticking a consent box at checkout or on a sign-up form).

You can unsubscribe from marketing emails at any time by clicking the “unsubscribe” link in any marketing email, or by emailing us at hello@debsandthehorse.com. Unsubscribing from marketing does not affect transactional emails about your order.

We take the security of your personal data seriously. We use the following measures to protect your data:

• SSL/TLS encryption on all pages of our website (HTTPS).
• Secure payment processing via Shopify Payments — we do not see or store full card details.
• Access to personal data is restricted to those who need it to perform their role.
• Regular reviews of our data processing practices and third-party suppliers.

While we take all reasonable steps to protect your data, no online transmission or storage system is 100% secure. If you believe your data has been compromised, please contact us immediately at hello@debsandthehorse.com.

Our website and products are intended for adults. You must be at least 18 years old to place an order, and our website is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has provided us with personal data, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make significant changes, we will update the effective date at the top of this page. We encourage you to review this policy periodically.

Your continued use of our website after any changes constitutes your acceptance of the updated policy.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

If you are not satisfied with our response, you have the right to contact the Information Commissioner's Office (ICO): ico.org.uk — 0303 123 1113.