Last updated: 4 August 2026

This Privacy Policy explains how PillowForma (the “Site”, “we”, “us” or “our”) collects, uses, stores and shares your personal data when you visit pillowforma.com, purchase from us, contact us or otherwise use our services (together, the “Services”).

For the purposes of UK data protection law, the controller of your personal data is [INSERT LEGAL BUSINESS NAME], trading as PillowForma, of [INSERT REGISTERED OR BUSINESS ADDRESS]. You can contact us at support@pillowforma.com.

Please read this Privacy Policy carefully. It should be read together with our Terms of Service, Cookie Policy and any other privacy information we provide when collecting your personal data.

1. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, Services or legal and regulatory requirements. We will publish the revised version on the Site and update the “Last updated” date above. Where required by law, we will provide additional notice of material changes.

2. Personal data we collect

The personal data we collect depends on how you interact with us. It may include:

• Identity and contact data: your name, billing address, delivery address, email address and telephone number.
• Order and transaction data: products purchased, order value, payment status, discounts, returns, refunds, delivery information and transaction history.
• Payment data: payment method and limited payment details or confirmation supplied by our payment providers. Full card details are generally collected and processed directly by authorised payment providers rather than stored by us.
• Account data: account credentials, account preferences, saved addresses and order history, where customer accounts are enabled.
• Shopping and preference data: products viewed, searches, cart activity, wish-list activity, product preferences and responses to promotions or surveys.
• Communications data: messages, enquiries, reviews, feedback and information you provide when contacting customer support or communicating with us.
• Technical and usage data: IP address, browser type, device type, operating system, device identifiers, approximate location derived from IP address, referring pages, pages viewed, links clicked, session information and interactions with the Site.
• Marketing data: your marketing preferences, consent records and interactions with our emails, advertisements and campaigns.
• Fraud and security data: information used to detect suspicious transactions, protect accounts and prevent fraud or misuse of the Services.

Please do not send us health information or other special category data unless we specifically ask for it and have a lawful reason to process it.

3. How we collect personal data

We collect personal data:

• Directly from you when you place an order, create an account, subscribe to marketing, contact us, submit a review, enter a promotion or otherwise provide information to us.
• Automatically when you use the Site, through cookies, pixels, server logs and similar storage or access technologies.
• From service providers such as Shopify, payment processors, delivery and fulfilment providers, customer-support tools, fraud-prevention providers, analytics providers and advertising partners.
• From third-party platforms when you interact with our advertisements, social-media pages or integrations, subject to your settings and the relevant platform’s privacy notice.

4. How and why we use your personal data

We only use personal data where we have a lawful basis under applicable UK data protection law. Depending on the circumstances, we rely on contractual necessity, legal obligations, legitimate interests or consent.

Purpose	Types of data	Lawful basis
Processing payments, fulfilling orders, arranging delivery, handling returns and refunds, and providing order updates	Identity, contact, order, transaction and payment data	Performance of our contract with you; compliance with legal obligations
Creating and managing customer accounts	Identity, contact, account and shopping data	Performance of our contract with you; our legitimate interest in providing account functionality
Responding to enquiries, complaints and customer-support requests	Identity, contact, communications, order and transaction data	Performance of our contract; compliance with legal obligations; our legitimate interest in providing effective support
Operating, maintaining and improving the Site and Services	Technical, usage, shopping, preference and communications data	Our legitimate interests in understanding and improving our business; consent where required for non-essential cookies or similar technologies
Protecting the Site, customers and our business, including fraud prevention and security	Identity, contact, transaction, technical, usage, fraud and security data	Our legitimate interests in preventing fraud and keeping the Services secure; compliance with legal obligations
Sending marketing communications and personalising advertising	Identity, contact, shopping, preference, technical, usage and marketing data	Consent where required; otherwise our legitimate interests and the electronic-marketing rules applicable to existing customers
Maintaining financial, tax and legal records and establishing, exercising or defending legal claims	Identity, contact, order, transaction, payment and communications data	Compliance with legal obligations; our legitimate interests in protecting our legal rights

Where we rely on legitimate interests, we consider whether our interests are necessary and proportionate and balance them against your rights and freedoms. You may contact us for further information about this assessment.

5. Marketing communications

We may send you marketing emails or text messages where you have consented or where the law permits us to contact an existing customer about similar products and we offered an opt-out when collecting the details. You can unsubscribe at any time by using the unsubscribe link in an email, following the instructions in a text message or contacting support@pillowforma.com.

Opting out of marketing will not stop service messages that are necessary for your order, account, delivery, returns, security or other transactions.

6. Cookies and similar technologies

We use cookies, pixels, local storage and similar technologies to operate the Site, remember preferences, keep the Site secure, understand how visitors use the Services and, where permitted, personalise content and advertising.

Some technologies are necessary for the Site to function and may be used without consent. For non-essential technologies, including certain analytics and advertising technologies, we request consent where required. Where an exemption applies, we will provide the information and objection controls required by law. You can manage your choices through the cookie banner or preference controls available on the Site. You may also control cookies through your browser, although blocking necessary cookies may affect Site functionality.

For information about cookies used by Shopify to power our store, visit Shopify’s Cookie Policy.

7. How we share personal data

We may share personal data with the following categories of recipients where necessary for the purposes described above:

• Shopify and ecommerce providers that host and operate our online store and related services.
• Payment providers that securely process payments, refunds and payment-related fraud checks.
• Delivery, warehouse and fulfilment partners that prepare, dispatch, track and deliver orders.
• Technology and business-service providers that provide hosting, cloud storage, customer support, email delivery, analytics, security, fraud prevention and operational services.
• Advertising and marketing partners where permitted by law and consistent with your consent choices.
• Professional advisers such as accountants, auditors, insurers, lawyers and financial advisers.
• Authorities and other parties where disclosure is required by law, court order or legal process, or is necessary to protect rights, safety and security.
• Parties to a business transaction such as a merger, financing, acquisition, reorganisation or sale of assets, subject to appropriate confidentiality and data-protection safeguards.

Service providers may use personal data only as permitted by their contracts with us and applicable law. Some providers, including Shopify and certain payment or consumer-service providers, may also process personal data as independent controllers for their own specified purposes. Their processing is governed by their own privacy notices. You can read Shopify’s Privacy Policy.

We do not sell your personal data for money. If we use advertising technologies that constitute a regulated disclosure or targeted advertising under a law applicable to you, we will provide the notices and controls required by that law.

8. International transfers

We and our service providers may store or process personal data outside the United Kingdom. When a transfer is restricted under UK data protection law, we use an approved transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the European Commission’s Standard Contractual Clauses, or another legally permitted safeguard. Where required, we also assess whether the transferred data will receive an essentially equivalent level of protection.

You may contact us for further information about the safeguards used for international transfers relevant to your personal data.

9. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Services, maintaining records, meeting legal, tax and accounting requirements, resolving disputes, preventing fraud and enforcing agreements.

Retention periods vary by data type and purpose. For example:

• Order, transaction and accounting records are generally retained for up to six years after the relevant financial year, or longer where legally required.
• Account data is generally retained while the account remains active and for a reasonable period afterwards.
• Customer-support records are retained for as long as needed to resolve the enquiry and manage related legal or operational requirements.
• Marketing records are retained until you withdraw consent or opt out, together with limited suppression information needed to respect that choice.
• Cookie and analytics data is retained according to the lifespan disclosed in our cookie controls and the settings of the relevant provider.

When personal data is no longer required, we delete it, anonymise it or securely isolate it until deletion is possible.

10. Security

We use reasonable technical and organisational safeguards designed to protect personal data against accidental or unlawful loss, misuse, alteration, disclosure or access. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

You are responsible for keeping any account credentials confidential. If you believe your account or personal data may have been compromised, please contact us promptly at support@pillowforma.com.

11. Automated decision-making

We and our providers may use automated tools to help detect fraud, protect transactions and maintain security. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you unless this is permitted by law and appropriate safeguards are in place. Where applicable, we will provide additional information about the logic involved, the significance and possible consequences, and your rights.

12. Your UK data protection rights

Depending on the circumstances and the lawful basis used, you may have the right to:

• request access to your personal data and related information;
• request correction of inaccurate or incomplete personal data;
• request deletion of your personal data;
• request restriction of processing;
• receive certain personal data in a portable format or have it transferred to another provider;
• object to processing based on legitimate interests;
• object at any time to the use of your personal data for direct marketing;
• withdraw consent at any time, without affecting processing carried out before withdrawal; and
• challenge certain decisions made solely by automated means and request human intervention where the right applies.

These rights are not absolute and exemptions may apply. To exercise a right, email support@pillowforma.com. Please describe your request clearly. We may ask for information reasonably necessary to confirm your identity and protect your data. We will normally respond within one month after receiving a valid request and any information reasonably required to verify your identity, subject to lawful extensions for complex or multiple requests.

You will not be discriminated against for exercising your data protection rights. You may authorise another person to submit a request on your behalf, but we may require proof of their authority and verification of your identity.

13. Data protection complaints

If you have a concern about how we use your personal data, please email support@pillowforma.com with the subject line “Data Protection Complaint”. We will take reasonable steps to help you submit the complaint, acknowledge it within 30 days and respond without undue delay, as required by applicable law.

You also have the right to complain to the UK Information Commissioner’s Office (ICO). We encourage you to contact us first so that we have an opportunity to address your concern.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint

14. Children’s data

The Services are not directed at children, and we do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe a child has provided personal data to us, please contact support@pillowforma.com so that we can investigate and, where appropriate, delete it.

15. Third-party websites and services

The Site may contain links to third-party websites, apps or services. We do not control and are not responsible for their privacy, security or content. Please review the relevant third party’s privacy notice before providing personal data.

16. Information you must provide

Certain personal data is required to enter into or perform a contract with you, including information needed to process payment and deliver an order. If you do not provide required information, we may be unable to accept or fulfil your order or provide a requested feature. Other information is optional, and choosing not to provide it will not normally prevent you from browsing the Site.

17. Contact us

For questions about this Privacy Policy, to exercise a data protection right or to submit a complaint, contact:

PillowForma
Legal entity: PillowForma
Address: 4855 Rock Ln, Dayton, Wyoming, WY 82836, United States
Email: support@pillowforma.com
Website: pillowforma.com

If we are required to appoint a UK representative or data protection officer, their contact details will be added to this section.