This policy explains what we do with your information, why we need it, how long we keep it and what you can ask us to do with it. We have written it in plain language on purpose. It applies to hhkzd.com and to orders placed through this site.
1. Who we are
PawsEcho ("we", "us") operates this store. We are the data controller for the personal information described here. Our contact details and postal address are listed in the Contact us section below. If you are in the EU or UK and need a formal point of contact for data protection matters, write to the same address and mark your message "Data Protection".
2. What we collect
We only collect information we actually need to run the store. We do not buy data about you from data brokers, and we do not build advertising profiles from your memorial or pet-related orders.
| Category | Examples | Why we need it |
|---|---|---|
| Order details | Name, email, shipping and billing address, phone, items ordered, gift message, engraving text, pet name | To make, personalise, pack and deliver your order, and to provide support |
| Payment details | Payment method, transaction ID, last four digits and expiry where the provider returns them, payment status | To take payment, prevent fraud and issue refunds |
| Account & cart data | Cart contents, CSRF token, country selection, session cookie | To keep the shop working and to protect forms against tampering |
| Messages you send us | Support emails, return requests, product reviews you choose to submit | To answer you and to improve what we make |
| Marketing data | Email address, signup source, unsubscribe status | To send the occasional guide you asked for |
| Technical data | IP address (truncated for analytics), browser and device type, pages viewed, referring page | Security, fraud prevention and — only with your consent — anonymous measurement |
Engraving text and pet names can be deeply personal. We treat them as private order content: they are visible only to the workshop finishing your piece and to the support staff handling your order. We never publish them in marketing without your explicit permission.
3. How we use your information
- To fulfil your order — production, engraving, packing, shipping, delivery updates and returns.
- To take payment and prevent fraud — including verifying that a transaction matches the order amount.
- To reply to you — order questions, damaged item claims and data requests.
- To keep the site secure — detecting abuse, protecting forms and keeping audit logs of payment events.
- To improve the store — aggregate analytics, only after you accept optional cookies.
- To send marketing you opted into — and only until you unsubscribe.
- To meet legal duties — tax, accounting and consumer-law records.
We do not use your order or engraving data to make automated decisions about you, and we do not use it for targeted advertising.
4. Our legal bases (GDPR / UK GDPR)
- Contract — processing needed to deliver the goods you ordered and handle returns.
- Legal obligation — keeping invoices and tax records.
- Legitimate interests — fraud prevention, site security and answering your questions, balanced against your rights.
- Consent — optional analytics cookies and marketing emails. You can withdraw consent at any time without affecting anything we did before you withdrew it.
5. Payment information
Card payments are processed by Stripe and wallet payments by Apple Pay, Google Pay or Klarna where available; PayPal payments are handled on PayPal's servers. You enter card details on their systems, not ours. We never receive or store your full card number, CVC or bank credentials. We keep only the transaction reference, the amount, the payment status and any refund events, so we can reconcile orders and answer "where is my refund?".
Each provider acts as an independent controller for the data it processes under its own privacy notice. Payment webhooks are verified by signature before we act on them, and every payment event is logged against the corresponding order.
6. Cookies and similar technologies
We use a small number of first-party cookies. Strictly necessary cookies are always on because the shop cannot work without them. Optional analytics cookies are off until you press "Accept all" in the cookie banner, and you can change your choice at any time via "Cookie settings" in the footer.
| Cookie | Type | Purpose | Lifetime |
|---|---|---|---|
| pe_cart | Necessary | Remembers the items in your cart | 30 days |
| pe_csrf | Necessary | Protects forms against cross-site request forgery | 6 hours |
| pe_country | Necessary | Remembers the destination for shipping quotes | 30 days |
| pe_flash | Necessary | Shows a one-time confirmation message | Until read |
| pe_admin | Necessary | Keeps the shop owner signed in to the admin area | 12 hours |
| _ga / _ga_* | Optional | Google Analytics 4, loaded only after consent, with IP anonymisation | Up to 13 months |
Your choice is stored locally in your browser (localStorage), not on our servers. Clearing browser data resets it. See our Cookie Notice for the full detail.
7. Analytics and advertising
If you accept optional cookies, we use Google Analytics 4 to see which pages are read, where traffic comes from and which devices people use, with IP anonymisation enabled. If you reject optional cookies, no analytics script is loaded at all — the setting is checked before the script is added to the page. We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not run retargeting pixels for pet-loss-related keywords.
8. Marketing emails
If you subscribe, we send occasional guides about pet memorial rituals and outdoor dog safety. Every email includes an unsubscribe link, and unsubscribing takes effect immediately. Order confirmations, shipping updates and refund notices are service messages, not marketing, and are sent only because you placed an order.
9. Who we share data with
We share the minimum necessary with service providers who work on our behalf:
- Payment processors — Stripe, PayPal (and wallet providers) to charge and refund orders.
- Carriers and fulfilment — name, address, phone and tracking number so your parcel reaches you.
- Email delivery — the SMTP provider that sends order and support emails.
- Analytics — Google Analytics 4, only when you consent.
- Professional advisers and authorities — where legally required, for example tax audits or a valid court order.
These providers may only use the data to perform the service we asked for. We do not sell your personal information, and we do not share it for third-party advertising.
10. International transfers
Our store is operated from the United States. If you order from the EU, UK or elsewhere, your order data is transferred to the US so we can fulfil it. Where required, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an applicable adequacy decision. Payment providers operate their own global networks under their own safeguards. You can ask us for details of the transfer mechanism we rely on.
11. How long we keep data
| Data | Retention |
|---|---|
| Orders, invoices and payment events | 7 years, to meet tax and accounting obligations |
| Support correspondence | 24 months after the last message |
| Marketing subscriptions | Until you unsubscribe, then a minimal suppression record to make sure we do not email you again |
| Cart and session cookies | Up to 30 days in your browser |
| Analytics data | 14 months, aggregated |
When a retention period ends we delete or irreversibly anonymise the data, unless we must keep it longer to resolve a dispute or comply with the law.
12. Security
The site is served over HTTPS. Passwords for the admin area are stored as salted scrypt hashes, admin sessions are signed, forms are protected against CSRF, payment webhooks are signature-verified, and access to the database is limited to the server itself. Backups are taken as consistent SQLite snapshots. No system is perfectly secure, but we limit what we store so that a breach would expose as little as possible.
13. Your rights
Depending on where you live, you can ask us to:
- confirm whether we hold your data and give you a copy of it (access / portability);
- correct information that is wrong or incomplete;
- delete your data, where we have no legal reason to keep it;
- restrict or object to processing based on legitimate interests;
- withdraw consent for analytics cookies or marketing at any time;
- appeal a refusal, or complain to your local supervisory authority (in the EU/UK) — we would appreciate the chance to put things right first.
To make a request, email privacy@hhkzd.com with the address you used to order. We reply within one business day and complete verified requests within 30 days (or the shorter period your local law requires). We may ask for enough information to confirm the request is really from you; we will never ask for your password or full card number.
14. California privacy notice (CCPA / CPRA)
In the last 12 months we have collected the categories described in section 2 (identifiers, commercial information, internet activity and, where you provide it, sensitive personal content such as engraving text) for the business purposes in section 3. We do not sell personal information as defined by the CCPA/CPRA, and we have not done so in the preceding 12 months. We have not shared personal information for cross-context behavioural advertising, and we do not knowingly sell or share the personal information of consumers under 16.
California residents have the right to know, access, correct, delete and obtain a portable copy of their personal information, the right to limit the use of sensitive personal information, and the right not to be discriminated against for exercising these rights. We use sensitive information only to produce the item you ordered. Submit requests to privacy@hhkzd.com; an authorised agent may act for you with written proof. Under California's "Shine the Light" law (Civil Code §1798.83), we do not disclose personal information to third parties for their own direct marketing.
15. Children's privacy
This store is intended for adults. We do not knowingly collect personal information from children under 16. If you believe a child has placed an order or subscribed, write to us and we will delete the data and cancel any related marketing immediately.
16. Third-party links
Our pages occasionally link to carriers, payment providers or informational sites. Their privacy practices are their own; we encourage you to read their notices before giving them information.
17. Changes to this policy
If we change how we use data, we will update this page and the "Last updated" date above. If a change materially affects your rights, we will also email customers who have an active order or subscription. Previous versions are kept on file and available on request.
18. Contact us
Email: privacy@hhkzd.com (privacy) or care@hhkzd.com (orders).
Post: PawsEcho, 1820 Sansome Street, San Francisco, CA 94111, United States.
We answer every message within one business day.
Last updated: November 15, 2026 · PawsEcho
Questions about this page? Email care@pawsecho.com or read the FAQ. Your statutory rights are never limited by anything written here.
← All policies