Privacy Policy

Effective date: September 23, 2026
Last updated: September 23, 2026

1. Who We Are

Daffanny is an online boutique for women's lingerie, including bras, lingerie sets, corsets, sleepwear and shapewear. We operate the website www.daffanny.com (the "Site"), sell our products in US dollars (USD) and ship to customers worldwide. In this Privacy Policy, "Daffanny", "we", "us" and "our" refer to the business that operates the Site, and "you" and "your" refer to anyone who visits the Site, creates an order, contacts us or otherwise interacts with us.

For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR and similar laws, Daffanny is the controller of the personal information described in this policy. That means we decide why and how your personal information is used and we are responsible for protecting it.

2. Scope of This Policy

This Privacy Policy applies to personal information we process when you:

• browse the Site on any device;
• add products to your shopping bag or wishlist;
• place an order through our checkout;
• track an order using our order tracking form;
• subscribe to our newsletter;
• write a product review;
• contact our customer care team by email or through the contact form; or
• otherwise communicate with us, for example about a return, exchange or accessibility request.

This policy does not cover third-party websites linked from the Site, such as a carrier's tracking portal, which have their own privacy policies. This policy should be read together with our Terms of Service, our Cookie Policy and our Shipping & Returns page.

3. Information We Collect

We collect personal information in three ways: information you give us directly, information collected automatically when you use the Site, and a limited amount of information we receive from third parties that help us run the store. The table below summarises each category, gives examples, explains why we use it and identifies the legal basis we rely on (see Section 5 for more on legal bases).

3.1 Information you provide to us

3.2 Information collected automatically

We do not currently load any third-party analytics, advertising or social media tracking scripts on the Site. If we decide to add analytics or advertising tools in the future, they will only run after you have given your consent through our cookie banner, and we will update this policy and our Cookie Policy before they go live.

3.3 Information from third parties

We do not buy personal information from data brokers or ask for sensitive information such as health data.

4. How We Use Your Information

We use personal information only for the purposes described in this policy, which are:

1. To sell and deliver products. Processing orders, taking payment, packing and shipping parcels, sending order confirmations, dispatch notices and tracking updates.
2. To provide customer care. Answering questions about sizing, fit and products, handling returns, exchanges and refunds, and resolving complaints.
3. To run the Site. Remembering the contents of your bag and wishlist, displaying recently viewed items, applying promotional codes, and remembering your cookie choice.
4. To send marketing you asked for. Sending our newsletter to subscribers who have opted in (see Section 10).
5. To publish reviews. Displaying your review under your chosen display name and moderating reviews for spam, offensive content or personal data.
6. To keep the Site and our customers safe. Detecting and preventing fraud, payment abuse, security incidents and misuse of promotional codes.
7. To meet legal obligations. Keeping accounting and tax records, responding to lawful requests from authorities, and complying with consumer protection and export laws.
8. To improve our business. Reviewing aggregated, non-identifying information such as which sizes are most frequently returned, so we can improve fit guidance and product range.

We do not use automated decision-making that produces legal or similarly significant effects on you. If our payment provider's automated fraud screening declines a payment, contact us and a person will review the order.

5. Legal Bases for Processing (GDPR and UK GDPR)

If you are in the European Economic Area (EEA), the United Kingdom or Switzerland, we must have a legal basis for each use of your personal information. We rely on:

• Performance of a contract – when processing is needed to take your order, deliver it and provide after-sales service, or to take steps at your request before you enter into a contract with us.
• Legal obligation – when we must process information to comply with the law, for example keeping invoices for tax purposes or responding to a court order.
• Legitimate interests – when processing is necessary for our reasonable business interests and those interests are not overridden by your rights. Examples are keeping the Site secure, preventing fraud, answering general enquiries and improving our products. You can object to processing based on legitimate interests at any time (see Section 11).
• Consent – for our newsletter, for publishing reviews and for any optional analytics or advertising technologies we may introduce in the future. You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6. How We Share Information and Our Processors

We do not sell your personal information, and we do not share it with third parties for their own marketing. We share personal information only with trusted service providers ("processors") who act on our instructions and are contractually required to protect it, and in the limited additional circumstances described below.

We may also disclose personal information where necessary to protect the rights or safety of Daffanny, our customers or others, or as part of a sale or restructuring of our business, in which case we would notify you before your information becomes subject to a different privacy policy.

A current list of our processors is available on request from [email protected].

7. International Data Transfers

Because we ship worldwide and use service providers located in different countries, your personal information may be transferred to, stored in and processed in countries other than your own, including the United States. The data protection laws of those countries may differ from those in your country.

When we transfer personal information out of the EEA, the United Kingdom or Switzerland to a country that has not been recognised as providing an adequate level of protection, we use appropriate safeguards, which are:

• the European Commission's Standard Contractual Clauses (SCCs), together with the UK International Data Transfer Addendum or Swiss amendments where relevant;
• transfers to recipients certified under the EU–US Data Privacy Framework and its UK and Swiss extensions, where applicable; or
• transfers that are necessary to perform a contract with you, for example sending your address to a carrier in the destination country.

You can request a copy of the relevant safeguards by writing to [email protected].

8. How Long We Keep Your Information

We keep personal information only for as long as we need it for the purposes described in this policy, including to meet legal, accounting and reporting requirements. When it is no longer needed, we delete it or anonymise it so that it can no longer be linked to you.

We may keep information longer where needed for a legal dispute or investigation.

9. Cookies and Local Storage

Our Site is designed to work with as little tracking as possible. Instead of storing your shopping bag, wishlist and preferences on our servers, we store them in your own browser using a technology called localStorage. This data remains on your device, is not readable by other websites and is not used to track you across the internet.

When you first visit, a cookie consent banner lets you choose Accept or Essential only. At present, both choices result in only essential and functional storage being used, because we do not load any analytics or advertising technologies. Your choice is saved so that the banner does not reappear on every page. If we introduce optional technologies later, they will only operate if you have chosen Accept, and we will ask again if the nature of those technologies changes significantly.

For a full list of what we store, why and for how long, and instructions for clearing it in your browser, please see our Cookie Policy.

10. Marketing Communications and Unsubscribing

We send marketing emails only to people who have actively subscribed to our newsletter, for example through the sign-up form on the Site or by ticking an unticked box at checkout. Our newsletter may include news about new collections, restocks, style and fit advice, and exclusive offers.

You can stop receiving marketing emails at any time by:

• clicking the unsubscribe link at the bottom of any newsletter;
• emailing [email protected] with the subject line "Unsubscribe"; or
• writing to [email protected].

We will process your request promptly and in any case within 10 business days. Even after you unsubscribe, we will still send you service messages that are necessary for any order you place, such as order confirmations, shipping updates and refund notices. These messages never contain promotional content.

11. Your Privacy Rights (EEA, UK and Switzerland)

If you are located in the EEA, the United Kingdom or Switzerland, you have the following rights under the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection:

• Right of access – to receive confirmation of whether we process your personal information and a copy of it.
• Right to rectification – to have inaccurate or incomplete information corrected.
• Right to erasure – to have your information deleted where there is no overriding reason for us to keep it, for example where we must keep invoices for tax purposes.
• Right to restriction – to ask us to limit how we use your information while a complaint or correction is being resolved.
• Right to data portability – to receive information you provided to us in a structured, commonly used, machine-readable format, or to have it transmitted to another controller where technically feasible.
• Right to object – to object at any time to processing based on our legitimate interests, and to object absolutely to direct marketing.
• Right to withdraw consent – where we rely on consent, you can withdraw it at any time.
• Right not to be subject to automated decisions – with legal or similarly significant effects, including profiling.
• Right to lodge a complaint – with a data protection supervisory authority (see Section 18).

To exercise any of these rights, email [email protected]. We will respond within one month. If your request is complex or we receive many requests, we may extend this by up to two further months and will tell you why. We may need to verify your identity, usually by asking you to reply from the email address used for your order or to confirm an order number. Exercising your rights is free.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, "CCPA"), gives you specific rights. This section also serves as our notice at collection.

Categories of personal information collected in the past 12 months

• Identifiers – name, email address, phone number, postal address, IP address, order number.
• Customer records (Cal. Civ. Code § 1798.80(e)) – billing and shipping address, limited payment information (card brand and last four digits).
• Commercial information – products purchased, returned or reviewed; order history.
• Internet or other electronic network activity – server log data and browser storage used to operate the Site.
• Geolocation data – approximate location derived from IP address or shipping address (not precise geolocation).
• Inferences – we do not create consumer profiles or draw inferences about your preferences for marketing purposes.

Sources, purposes, recipients and retention periods are described in Sections 3, 4, 6 and 8.

We do not sell or share personal information

Daffanny does not sell personal information and does not share personal information for cross-context behavioral advertising, as those terms are defined in the CCPA, and has not done so in the preceding 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA, so we do not offer a "Limit the Use of My Sensitive Personal Information" link.

Your California rights

• Right to know the categories and specific pieces of personal information we have collected, the sources, purposes and categories of recipients.
• Right to delete personal information we collected from you, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. Although we do not sell or share, we honour Global Privacy Control (GPC) signals as a valid opt-out request.
• Right to non-discrimination – we will not deny you goods, charge you different prices or provide a different quality of service because you exercised your rights.

To make a request, email [email protected] with the subject "California Privacy Request". We will confirm receipt within 10 business days and respond within 45 days (extendable by 45 days where necessary), verifying your identity by matching information we hold. An authorised agent may act for you with your signed permission.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes (Cal. Civ. Code § 1798.83).

13. Rights in Other US States

Residents of other US states with comprehensive privacy laws, such as Colorado, Connecticut, Oregon, Texas and Virginia, may have some or all of the following rights, depending on the state:

• to confirm whether we process your personal data and to access it;
• to correct inaccuracies;
• to delete personal data;
• to obtain a portable copy of your personal data;
• to opt out of targeted advertising, the sale of personal data and profiling in furtherance of decisions with legal or similarly significant effects. We do not engage in any of these activities.

Send requests to [email protected]. We will respond within the time required by your state's law, usually 45 days. If we decline your request, you may appeal by replying to our decision with the subject line "Privacy Appeal". We will respond to your appeal within the legally required period, and if you remain dissatisfied you may contact your state Attorney General.

14. Children's Privacy

The Site and our products are intended for adults. The Site is not directed to children under 16, and we do not knowingly collect personal information from anyone under 16. To place an order you must be at least 18 years old or the age of majority where you live, as set out in our Terms of Service. If a child has given us personal information, contact [email protected] and we will delete it.

15. How We Protect Your Information

We use appropriate technical and organisational measures to protect personal information against accidental or unlawful loss, access, alteration and disclosure. These include:

• encryption of all traffic between your browser and the Site using HTTPS (TLS);
• card payments handled by PCI DSS-compliant payment providers, so that full card numbers and security codes never touch or remain on our systems;
• access to customer data restricted to staff and contractors who need it for their role, protected by strong passwords and multi-factor authentication where available;
• written data processing agreements with our processors;
• keeping your shopping bag and wishlist in your own browser rather than on our servers, which reduces the amount of data we hold; and
• regular review of our security practices and prompt updating of software.

No method of transmission or storage is completely secure. If a personal data breach is likely to put your rights at risk, we will notify you and the relevant authorities as required by law.

16. Discretion for Intimate Purchases

We know that lingerie, corsets and shapewear are personal purchases, and we take extra care with how your order appears to other people:

• Plain packaging. Orders are shipped in plain, unbranded outer packaging with no product images or descriptions on the outside. Customs declarations, where required for international shipments, use a general description such as "apparel" or "clothing", as permitted by customs rules.
• Neutral billing descriptor. Charges appear on your card or bank statement as DFY*STORE, not as a product description.
• Neutral emails. Order confirmation and shipping email subject lines refer to "your order" rather than listing products.
• Shared devices. Because your bag, wishlist and recently viewed items are stored in your browser, anyone using the same browser profile may see them. You can clear them at any time through your browser settings, as explained in our Cookie Policy, or by using a private browsing window.

We never use your purchase history to make assumptions about your body, health or personal life, and we never disclose what you bought to anyone other than the processors who need it to fulfil your order.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the law, our practices or the services we use, for example if we add analytics or new payment methods. When we do, we will change the "Last updated" date at the top of this page. If the changes are significant, we will give you more prominent notice, such as a notice on the Site or an email to customers and subscribers, before the changes take effect. Where the law requires your consent to a change, we will ask for it.

18. Contact Us and Complaints

If you have any questions about this Privacy Policy, want to exercise your rights or wish to make a complaint about how we handle your personal information, please contact us:

• Privacy enquiries and rights requests: [email protected]
• Customer care (orders, returns, unsubscribes): [email protected], Monday to Friday, 9am–4pm Pacific Time, or through our contact form
• Accessibility requests, including this policy in an alternative format: [email protected]
• Postal correspondence: our registered business address, available on request via [email protected]

We aim to resolve every concern directly and quickly. If you are not satisfied with our response, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live, work or where you believe an infringement occurred. For example:

• in the EEA, your local data protection authority (a list is published by the European Data Protection Board);
• in the United Kingdom, the Information Commissioner's Office (ICO);
• in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC);
• in California, the California Privacy Protection Agency or the California Attorney General; and
• in other US states, your state Attorney General.