This Policy sets out how Patrick Radcliffe, LLC (“we,” “our,” “us”) processes personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the California Consumer Privacy Act (CCPA), and the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA). This policy applies to all data collected via us.patrickradcliffe.com and at in-person sales events.

Lawful Bases for Processing

We only process your data where a legal basis exists. For UK and international clients, these include:

• Contractual Necessity: Processing required to fulfill your order (e.g., shipping and payment).
• Legitimate Interests: Processing for business improvements, fraud prevention, and direct marketing (where permitted).
• Legal Obligation: Processing required to comply with tax, export, or consumer protection laws.
• Consent: Where you have provided clear, affirmative action (e.g., newsletter opt-ins).

Comprehensive Data Collection

We collect and process the following categories of data:

• Identifiers: Name, billing/shipping address, email, and IP address.
• Commercial Information: Records of products purchased, obtained, or considered.
• Financial Data: Tokenized payment details (processed via secure third-party gateways).
• Technical & Usage Data: Browser type, time zone settings, and interaction with our digital storefront.
• Sensitive Data: We do not intentionally collect “Sensitive Personal Information” (as defined by CCPA/GDPR) such as biometric or health data.

Data Sharing & International Transfers

Your data may be transferred across borders (e.g., from the UK to US-based servers).

• Safeguards: For UK/EEA data subjects, we utilize Standard Contractual Clauses (SCCs) to ensure your data receives an equivalent level of protection as it would in your home jurisdiction.
• Third Parties: We share data with essential processors (FedEx for shipping, payment processors, and cloud infrastructure) under strict Data Processing Agreements (DPAs).

Data Retention Schedule

We retain personal data only as long as necessary for the purposes for which it was collected:

• Transaction Records: Retained for seven (7) years for tax and audit compliance.
• Marketing Data: Retained until you withdraw consent or after 24 months of inactivity.
• Client Service Inquiries: Retained for two (2) years following the resolution of the inquiry.

Automated Decision-Making & Profiling

We may use automated systems to detect fraudulent transactions or to provide personalized product recommendations. You have the right to request human intervention if an automated decision results in a legal effect (e.g., a declined transaction).

Your Legal Rights

Depending on your location, you have the following rights:

• Right to Access/Know: Request a copy of the data we hold about you.
• Right to Deletion (Right to be Forgotten): Request that we erase your personal data.
• Right to Correction: Correct inaccurate or incomplete information.
• Right to Opt-Out: Object to “Targeted Advertising” or the “Sale/Sharing” of data. (Note: We do not sell your data for monetary value).
• Right to Portability: Request your data in a structured, machine-readable format.

Security & Data Breach Protocol

We maintain industry-standard technical and organizational measures (encryption at rest/transit, firewalls). In the event of a significant data breach, we will notify relevant supervisory authorities and affected individuals within 72 hours where required by law.

Contact & Redress

For all data-related inquiries or to exercise your rights, please contact our Data Privacy Liaison:

• Email: client-services@us.patrickradcliffe.com
• Response Window: Within 30 days (as required by GDPR/CCPA).