Data Privacy Policy

We may collect the following types of personal data when necessary for our business operations:

We do not intentionally request full debit card or credit card details through ordinary order messages. If payments are processed through a third-party payment provider, that provider may process payment information under its own privacy and security practices.

Upperoom Fragrances uses personal data for specific business purposes, including:

• Processing, confirming, and fulfilling customer orders.
• Communicating about order status, payment confirmation, availability, delivery timing, and customer support.
• Arranging delivery through local bearer, courier, Knutsford Express, or other delivery options selected by the customer.
• Responding to questions, complaints, exchange requests, delivery concerns, or policy requests.
• Maintaining accurate business, tax, accounting, fraud prevention, and customer service records.
• Improving our website, product listings, customer experience, and service quality.
• Sending marketing messages only where permitted, with an option to stop receiving such messages.
• Protecting our website, business, customers, and legal rights.

We aim not to use personal data in a way that is incompatible with the original reason it was collected, unless the law allows it or you have provided consent where required.

We process personal data only where we have a lawful and reasonable basis to do so. Depending on the situation, this may include:

• Contract necessity: to process your order, arrange delivery, verify payment, and provide customer service.
• Consent: where you voluntarily provide information, subscribe to updates, or agree to receive marketing communications.
• Legal obligation: where records must be kept for accounting, tax, regulatory, dispute, or legal purposes.
• Legitimate business interest: to prevent fraud, improve services, secure our website, manage customer relationships, and protect the business, provided your privacy rights are respected.

We may send promotional updates, product availability alerts, restock notices, offers, or fragrance recommendations where you have consented, where you are an existing customer and the message relates to similar goods or services, or where otherwise permitted by law.

Every direct marketing message should identify Upperoom Fragrances and provide a reasonable way for you to ask us to stop sending marketing communications.

We do not sell customer personal data. We only share personal data where necessary for business, delivery, payment, support, security, legal, or compliance purposes.

Personal data may be shared with:

• Delivery partners: including bearer services, couriers, and Knutsford Express where needed to complete delivery.
• Payment or banking providers: where needed to verify payments, process transactions, or resolve payment issues.
• Website, hosting, and technology providers: including services that help operate the website, store order records, secure the website, and improve performance.
• Professional advisers: including accountants, legal advisers, compliance support, or business advisers where necessary.
• Legal authorities or regulators: where required by law, court order, lawful request, or to protect our legal rights.

Where service providers process personal data on our behalf, we aim to use providers that apply reasonable privacy and security measures.

We keep personal data only for as long as reasonably necessary for the reason it was collected, unless a longer period is required or permitted for legal, accounting, tax, delivery, fraud prevention, dispute resolution, or regulatory purposes.

• Order records: kept for business records, accounting, customer support, and legal purposes.
• Delivery records: kept as needed to confirm delivery, handle disputes, or support customer service.
• Payment confirmation records: kept as needed for verification, accounting, dispute prevention, and legal records.
• Customer support messages: kept as needed to manage customer concerns and service history.
• Marketing preferences: kept until you unsubscribe, withdraw consent, or request removal where applicable.

When personal data is no longer needed, we will take reasonable steps to delete, anonymize, archive, or securely dispose of it.

We take reasonable technical and organizational steps to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, misuse, alteration, or disclosure.

Our safeguards may include:

• Restricting access to customer information to persons who need it for business purposes.
• Using secure website, hosting, and administrative access where available.
• Maintaining reasonable password, account access, and website security practices.
• Keeping website tools, plugins, and systems updated where applicable.
• Reviewing how customer data is collected, stored, shared, and disposed of.
• Taking steps to identify, contain, and respond to suspected data breaches.

No website or online system can be guaranteed completely secure. However, we aim to use reasonable safeguards to protect customer information.

Subject to applicable law, identity verification, and any lawful exemptions, you may have the right to:

• Request information about whether we process your personal data.
• Request access to personal data we hold about you.
• Request correction of inaccurate or incomplete personal data.
• Request deletion or disposal where the law allows and where we no longer have a lawful reason to keep the data.
• Object to certain processing or ask us to stop processing your personal data for a specified purpose where applicable.
• Withdraw consent where processing is based on your consent.
• Opt out of direct marketing communications.
• Request information about automated decision-making where a decision significantly affecting you is based solely on automated processing.
• Complain to the Office of the Information Commissioner if you believe your data protection rights have been breached.

To exercise your rights, contact us using the details at the end of this policy. We may need to verify your identity before processing your request.

Some website, hosting, email, analytics, payment, security, or technology providers may process or store personal data outside Jamaica.

Where personal data is transferred outside Jamaica, we aim to ensure that the transfer is lawful and that appropriate safeguards are in place, or that the transfer is otherwise allowed because it is necessary to complete an order, provide a requested service, perform a contract, comply with legal obligations, protect rights, or because you have provided consent where required.

Our website may use cookies and similar technologies to operate the online store, remember cart activity, improve website performance, understand visitor behavior, support security, and improve the shopping experience.

You may be able to manage or disable cookies through your browser settings. However, some website functions, including cart and checkout features, may not work properly if essential cookies are disabled.

If we become aware of a security breach or suspected breach that affects or may affect personal data, we will take reasonable steps to assess, contain, investigate, and respond to the issue.

Where required by law, we will report a qualifying breach or contravention to the Information Commissioner within the required timeframe and notify affected data subjects where applicable.

Our website and services are intended for general customers purchasing fragrance products. We do not knowingly collect personal data from children for marketing purposes.

If a parent or guardian believes that a child has provided personal data to us without appropriate permission, they may contact us and request review, correction, or deletion where applicable.

We may update this Data Privacy Policy from time to time to reflect changes in our business, website, legal requirements, customer service practices, or data protection procedures.

The “Last Updated” date will be revised when updates are made. Continued use of our website or services after changes means you acknowledge the updated policy.