Privacy policy

This Privacy Policy explains how YourCelebrityMagazines (trading name of Buy Celebrity
Magazines Ltd, company number 06401443, registered at St Augustine's Arts & Events
Centre, Stanford Avenue, Brighton, England, BN1 6EA) (“YCM” "we", "us", "our") collects,
uses, stores, and protects your personal data when you use our website or purchase from
us.

SECTION 1 – WHO WE ARE (DATA CONTROLLER)

YourCelebrityMagazines is the data controller of your personal data. If you have questions
about how we handle your data, please contact us using the details in Section 10.
Trading name: YourCelebrityMagazines
Legal name: Buy Celebrity Magazines Ltd
Company number: 06401443
Registered address: St Augustine's Arts & Events Centre, Stanford Avenue, Brighton,
England, BN1 6EA
Email: info@yourcelebritymagazines.com

SECTION 2 – WHAT PERSONAL DATA WE COLLECT

2.1 Data You Provide
When you place an order or contact us, we may collect:
1. Name and title
2. Delivery and billing address
3. Email address
4. Phone number (if provided)
5. Payment information (processed securely – we do not store full card details)
6. Account login credentials (if you register)
7. Messages or enquiries you send us

2.2 Data Collected Automatically

When you browse our website, we may automatically collect:
8. IP address and approximate location
9. Browser type and version
10. Device type and operating system
11. Pages visited and time spent on pages
12. Referring website or source
13. Session data via cookies (see Section 7)

2.3 Data from Third Parties

We may receive limited data from Shopify (our platform provider), payment processors, or
marketing services in connection with processing your order or communicating with you. We
do not purchase personal data from third-party data brokers.

SECTION 3 – HOW WE USE YOUR PERSONAL DATA

We process your personal data only where we have a lawful basis to do so. For US
residents: while we map our data use to UK GDPR statutory categories (Contract, Legal
Obligation, Legitimate Interests, and Consent), these categories describe our transparent
operational purposes for handling your personal information and are used here for clarity
and consistency across all regions. Our uses include:

3.1 Fulfilling Your Order (Contract)
14. Processing and dispatching your order
15. Sending order confirmation and dispatch notifications
16. Handling returns, refunds, and complaints
17. Communicating with you about your order

3.2 Legal Compliance (Legal Obligation)
18. Maintaining financial and accounting records
19. Responding to lawful requests from authorities
20. Fraud prevention and detection

3.3 Improving Our Services (Legitimate Interests)
21. Analysing website traffic and usage patterns
22. Improving product descriptions and user experience
23. Internal quality assurance and administration

3.4 Marketing Communications (Consent)
With your consent, we may send you emails about new products, offers, or updates. You
can withdraw consent and unsubscribe at any time by clicking the unsubscribe link in any
marketing email or by emailing info@yourcelebritymagazines.com. Opting out of marketing
will not affect your order-related communications.

SECTION 4 – SHARING YOUR PERSONAL DATA

We do not sell your personal data. We share it only in the following limited circumstances:
4.1 Shopify. Our store is hosted on Shopify Inc. Your order and account data is processed
and stored on Shopify’s secure platform. You can read Shopify’s privacy policy at
shopify.com/legal/privacy.
4.2 Payment Processors. Payment card data is processed by our payment gateway
providers in accordance with PCI-DSS standards. We do not receive or store your full card
details.
4.3 Delivery and Logistics Providers. We share your name and delivery address with our
postal and courier service providers for the purpose of despatching your order.
4.4 Marketing and Analytics Providers. We may use third-party analytics tools (such as
Google Analytics) and email marketing platforms. These providers process data on our
behalf and are not permitted to use it for their own purposes.
4.5 Legal Requirements. We may disclose your data to competent authorities where
required by law, court order, or to prevent fraud or harm.
4.6 Business Transfer. If our business is acquired or merged, your information may be
transferred to the new owner. We will notify you of any such transfer where required by law.

SECTION 5 – INTERNATIONAL DATA TRANSFERS

Because our store is hosted and operated on the Shopify platform, the processing of your
personal data is inherently international in nature. Shopify Inc. is incorporated in Canada and operates a global infrastructure that includes data centres and server facilities located in the United States of America and other jurisdictions. As a result, personal data you provide to us when browsing our website, placing an order, or creating an account may be transferred to, stored in, or processed within the United States, Canada, or other countries outside the United Kingdom.

Safeguards in place. We only allow Shopify to process your personal data where they
have implemented appropriate safeguards to ensure that your data is protected to a
standard equivalent to that required under UK GDPR. The safeguards on which we rely
include one or more of the following, applied as appropriate to the specific transfer:

24. UK International Data Transfer Addendum (IDTA): where Shopify processes UK personal data, transfers to the United States and other non-adequate third countries are governed by the UK IDTA (the addendum to the EU Standard Contractual Clauses approved by the UK Information Commissioner’s Office), which contractually binds Shopify to protect your data in accordance with UK GDPR standards;

25. Standard Contractual Clauses (SCCs): Shopify’s Data Processing Addendum
incorporates the European Commission’s Standard Contractual Clauses (as adopted
and recognised under UK law) where applicable to transfers within its global
infrastructure; and

26. Binding Corporate Rules and adequacy: transfers to Canada (Shopify’s country of incorporation) benefit from the UK’s adequacy regulations under which Canada is
recognised as providing an adequate level of data protection for commercial
organisations. Shopify also maintains internal binding corporate rules governing data
protection across its global group entities.

Further information. You can review Shopify’s Data Processing Addendum and
international transfer safeguards at shopify.com/legal/dpa. If you would like further
information about the specific safeguards applied to any international transfer of your
personal data, please contact us at info@yourcelebritymagazines.com.

SECTION 6 – HOW LONG WE KEEP YOUR DATA

We retain personal data only for as long as necessary:

27. Order and transaction records: 6 years (legal and accounting requirements)
28. Account data: For the lifetime of your account, plus a reasonable period after closure
29. Marketing consent records: Until you unsubscribe or 3 years from last engagement
30. Website analytics data: Up to 26 months, in anonymised aggregate form

When data is no longer required, it is securely deleted or anonymised.

SECTION 7 – COOKIES

Our website uses cookies and similar tracking technologies to operate and improve your
experience. The main cookies we use include:

7.1 Strictly Necessary Cookies
These cookies are essential for the Shopify platform and our website to function correctly.
They cannot be disabled without affecting core website functionality. They include:

31. _shopify_session (or _session_id) – stores session data including referrer and
landing page; expires at end of session
32. _secure_session_id – session security token; expires at end of session
33. cart – stores the contents of your shopping cart; persists for 2 weeks
34. cart_ts – timestamp associated with the cart cookie; used to detect cart
abandonment; persists for 2 weeks
35. storefront_digest – used for password-protected storefronts; indefinite if store has a password
36. checkout (and checkout_token) – manages the checkout session and secures the
transaction flow; expires at end of session or on order completion
37. tracked_start_checkout – records when the checkout process was initiated; session-based

7.2 Analytics and Performance Cookies
These cookies are set by Shopify and help us understand how visitors interact with our
storefront. They require your consent where applicable under UK GDPR. They include:

38. _shopify_y – Shopify’s primary analytics identifier; assigned to each visitor and
persists for 1 year; used to measure and report aggregate storefront traffic statistics
39. _shopify_s – Shopify’s session-level analytics cookie; tracks individual session
activity within a 30-minute window; expires at end of session
40. _shopify_visit – records whether a visitor has visited the store before; session-based
41. _shopify_uniq – counts the number of visits by a single customer; expires at midnight
of the following day
42. _tracking_consent – stores your cookie consent preferences as recorded via our
storefront consent banner; used to ensure we respect your choices on subsequent
visits; persists for 1 year

7.3 Your Cookie Choices
When you first visit our website, our native Shopify storefront cookie consent banner will be displayed. You can use this banner to accept or decline non-essential analytics and performance cookies. Your preferences are stored in the _tracking_consent cookie and will be respected on your subsequent visits. You may change your preferences at any time by clearing your browser cookies or adjusting your browser settings, which will cause the
consent banner to display again. Please note that disabling strictly necessary cookies may
prevent core website functionality, including checkout, from operating correctly.

SECTION 8 – YOUR RIGHTS UNDER UK GDPR

You have the following rights regarding your personal data. We will respond to valid requests within one calendar month.

Right of access – Request a copy of the personal data we hold about you.
Right to rectification – Ask us to correct inaccurate or incomplete data.
Right to erasure – Ask us to delete your data where we have no lawful reason to retain it.
Right to restriction – Ask us to limit processing of your data in certain circumstances.
Right to data portability – Request your data in a machine-readable format.
Right to object – Object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – Withdraw consent for marketing or non-essential cookies at
any time.

8.1 Exercising Your Rights. To exercise any of these rights, please contact us at
info@yourcelebritymagazines.com. We may need to verify your identity before processing
your request.

8.2 Complaints. If you are not satisfied with how we handle your data, you may lodge a
complaint with the UK’s Information Commissioner’s Office (ICO) at www.ico.org.uk or by
calling 0303 123 1113.

SECTION 9 – SECURITY

We take the security of your personal data seriously and implement appropriate technical
and organisational measures to protect it, including:

43. HTTPS encryption on all website connections
44. PCI-DSS compliant payment processing
45. AES-256 encryption for stored payment data (where applicable)
46. Access controls limiting internal access to personal data
47. Regular security reviews

No internet transmission is 100% secure. While we take all reasonable steps, we cannot
guarantee absolute security.

SECTION 10 – CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. Changes are effective immediately
upon posting on our website. If we make material changes, we will notify you by email or a
notice on our website. We encourage you to review this policy periodically.

SECTION 11 – CONTACT US

For privacy enquiries, requests, or complaints, please contact us:

YourCelebrityMagazines / Buy Celebrity Magazines Ltd
Email: info@yourcelebritymagazines.com
Website: www.yourcelebritymagazines.com

Registered office: St Augustine's Arts & Events Centre, Stanford Avenue, Brighton, England,
BN1 6EA

SECTION 12 – ADDITIONAL DISCLOSURES FOR UNITED STATES RESIDENTS

This section applies to residents of the United States and supplements the information
provided elsewhere in this Privacy Policy. Where US state privacy laws — including but not
limited to the California Consumer Privacy Act (CCPA) as amended by the California Privacy
Rights Act (CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado
Privacy Act (CPA), and similar state-level frameworks — apply to our processing of your
personal data, we provide the following additional disclosures. In the event of a conflict
between this section and the remainder of this Privacy Policy, this section shall prevail for
US residents.

12.1 No Sale or Sharing of Personal Data
We do not sell your personal data to third parties for monetary consideration. We do not
share your personal data for cross-context behavioural advertising as that term is defined
under applicable US state privacy laws including the CCPA/CPRA. Because we do not
engage in these activities, we do not offer a separate opt-out mechanism for the sale or
sharing of personal data — there is nothing to opt out of. We confirm that we have not sold or shared personal data in the preceding twelve months.

12.2 Categories of Personal Data Collected in the Preceding 12 Months
In the preceding 12 months, we have collected the following categories of personal data,
which mirror the information described in Section 2 of this Privacy Policy:

48. Identifiers: such as real name, postal address, email address, and internet protocol
(IP) address;
49. Commercial information: such as records of products purchased, order history, and
transaction details;
50. Internet or other electronic network activity information: such as browsing activity on
our website, pages visited, session data, and information collected via cookies as
described in Section 7; and
51. Inferences: preferences inferred from purchase history or browsing patterns, used
solely for internal service improvement.

We do not knowingly collect sensitive personal information as defined under CCPA/CPRA
(including precise geolocation, financial account credentials, or biometric data) as part of our standard service.

12.3 Purposes for Which Personal Data Is Collected and Used
We collect and use the above categories of personal data for the operational purposes
described in Section 3 of this Privacy Policy, including: fulfilling and administering orders;
processing payments; communicating about your transaction; improving our website and services; complying with legal obligations; and, with your consent, sending marketing
communications. We do not use personal data for automated decision-making that produces legal or similarly significant effects on US residents.

12.4 Rights of US Residents
Subject to applicable state law and verification of your identity, US residents have the
following rights regarding their personal data. We will respond to verifiable requests within 45 days, with the option to extend by a further 45 days where reasonably necessary. We will not discriminate against you for exercising any of these rights:

52. Right to know/access: you may request disclosure of what personal data we have
collected about you, the categories and specific pieces of data, the sources from
which it was collected, the business purpose for collection, and the categories of third parties with whom it has been shared;
53. Right to deletion: you may request that we delete personal data we have collected about you, subject to certain exceptions permitted under applicable law (such as data required to complete a transaction or comply with a legal obligation);
54. Right to correct: you may request that we correct inaccurate personal data we hold about you;
55. Right to opt-out of sale/sharing: as stated in clause 12.1, we do not sell or share
personal data, so this right does not apply in practice; and
56. Right to non-discrimination: we will not deny you goods or services, charge you
different prices, or provide a different level of service because you have exercised
any privacy right.

12.5 How to Exercise Your Rights
Designated request route. To submit a verifiable consumer request, or to ask questions
about our data practices as they apply to US residents, please email us at
info@yourcelebritymagazines.com with "US Privacy Request" in the subject line. We may need to verify your identity before processing your request. Requests may be submitted by you directly, or by an authorised agent acting on your behalf with your written permission.

12.6 California “Shine the Light”
California residents may request information about whether we have disclosed personal
information to any third parties for their direct marketing purposes during the preceding
calendar year. We do not disclose personal information to third parties for their own direct
marketing purposes, and we have not done so in the preceding twelve months.