The Pet HeadquartersCart
View CartYour cart is empty
The Pet HeadquartersYour cart is empty
Premium products for your beloved companions.
The Pet Headquarters is a trading name of CHERYA HOLDINGS LIMITED, a company registered in England and Wales (company no. 17203315). Registered office: 167-169 Great Portland Street, London, W1W 5PF. In this policy, "we", "us", and "our" mean CHERYA HOLDINGS LIMITED. We are the data controller responsible for your personal data and we comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
For any privacy-related question or to exercise your rights, email contact@thepetheadquarters.co.uk. You can also write to us at our registered office above. We aim to respond within 7 working days and always within the 30-day deadline UK GDPR allows (extendable to 90 days for complex requests, with notice).
You must be at least 18 years old to place an order with us — UK contract law gives minors only limited capacity to enter purchase contracts, and we are not equipped to verify parental consent for individual orders. You may create an account from age 13, the minimum age at which UK GDPR (Article 8) and the Data Protection Act 2018 (Section 9) allow you to consent to your own data processing. We do not knowingly collect personal data from anyone under 13 — if you are a parent or guardian and believe a child has provided us with their data, please contact us and we will delete it promptly. If you are between 13 and 17, your parent or guardian must place any orders on your behalf.
We collect: contact information (name, email, phone, delivery address) when you place an order or create an account; payment information processed securely through Stripe (we never see or store your full card number, only the last four digits and brand); order history and customisation uploads (e.g. pet photos for engraved or printed items); browsing data including pages visited, products viewed, search queries, and items added to your cart; device and technical data such as IP address (anonymised within 24 hours for analytics), browser type and operating system; communication data from emails, contact forms, and product reviews; review content you submit, including the display name you choose.
We use your data to: process and fulfil your orders (including passing your shipping details to our suppliers and couriers); communicate about your orders, account, returns and refunds; verify that promotional codes are eligible (e.g. first-order discounts); send marketing emails about similar products to those you've bought, where you've not opted out (PECR soft opt-in); send other marketing communications only with your explicit consent; improve our website and product range using anonymous, aggregated analytics; comply with our tax, accounting and statutory obligations; prevent fraud, abuse, and chargeback disputes; respond to and resolve customer service queries.
We process your data on these UK GDPR bases: contractual necessity (to fulfil your order, manage your account, handle returns); legitimate interests (improving our services, preventing fraud, sending PECR soft-opt-in marketing about similar goods to existing customers, defending against legal claims); consent (for marketing to prospects who haven't yet bought from us, for any non-essential cookies, and for analytics); legal obligation (HMRC tax records, statutory accounting, Companies Act disclosures, breach reporting to the ICO).
If you've bought from us, we may email you about similar products under PECR's soft opt-in rule. Every email includes a one-click unsubscribe link, and you can also email contact@thepetheadquarters.co.uk at any time to opt out. If you've signed up to our newsletter without buying, we send marketing only on your explicit consent and you can withdraw it the same way. We do not run SMS marketing, telemarketing, or direct postal marketing.
We share the minimum needed with the following processors. Each is bound by a written agreement (a data processing agreement under UK GDPR Article 28) and may only handle your data on our instructions: • Stripe (payment processing, US-based) — card details, billing email, order amount. • Resend (transactional email, US-based) — your email address and the email content we send you. • Cloudinary (image hosting, US-based) — product images, any customisation images you upload, and admin-uploaded receipts. • Railway (application + database hosting, EU/US regions) — all of the above stored in our PostgreSQL database. • Cloudflare (DNS + email routing, global) — domain resolution and routing of contact@thepetheadquarters.co.uk to our team inbox. • Microsoft Clarity (session-replay analytics, US-based, runs only if you accept analytics in the cookie notice) — pseudonymous interaction data (clicks, scrolls, mouse movement). Form text, addresses and any personal text you type are masked in the recording itself before it leaves your browser. No card details, no email body, no full names are sent to Microsoft. • Royal Mail, DPD, Evri, UPS or other couriers (as relevant) — your shipping address and contact details for delivery. • Our suppliers for dropshipped items — your shipping address and contact details for fulfilment. • Telegram (admin notifications only — order summaries to our team; never your full card or email body). We never sell your personal data and we do not share it for marketing purposes with any third party.
Some of our processors (Stripe, Resend, Cloudinary, Cloudflare) process data outside the UK and EEA, mainly in the United States. Where this happens, we rely on the UK government's adequacy regulations (where they apply), the UK International Data Transfer Addendum (IDTA) to the EU Standard Contractual Clauses, or the UK-US Data Bridge under the EU-US Data Privacy Framework. You can request a copy of the safeguards in place by emailing contact@thepetheadquarters.co.uk.
• Order records (invoices, customer details on the order, VAT records): 6 years from the end of the accounting period in which the order was placed, the minimum HMRC requires for tax and corporation tax records. • Account data (profile, addresses, preferences): until you delete your account, then anonymised within 30 days. The associated order records survive in anonymised form to keep our accounting consistent. • Marketing consent and communications: until you withdraw consent, then deleted within 30 days. • Reviews you've posted: kept while visible on the product page. Hidden or removed reviews are deleted within 90 days. • Contact-form messages: 24 months from receipt. • Customisation uploads (e.g. pet photos for printing): deleted within 90 days of order completion unless you request earlier removal. • Anonymous analytics aggregates: kept indefinitely in aggregated form — they cannot be tied back to you.
We use appropriate technical and organisational measures to protect your data: HTTPS-only delivery, encrypted database backups, access controls limiting who on our team can see customer data, no card-data ever touching our servers (Stripe handles all payment details), HttpOnly + Secure + SameSite-locked authentication cookies, and routine review of our subprocessors. We will notify you and the ICO within 72 hours of any breach affecting your personal data, as required by UK GDPR Article 33–34.
Under UK GDPR you have the right to: access your personal data and receive a copy (subject access request); rectify inaccurate or incomplete data; erase your data ("right to be forgotten") where there is no overriding legitimate basis for us to keep it; restrict processing in certain circumstances; data portability — receive your data in a structured, commonly used, machine-readable format; object to processing that is based on legitimate interests; withdraw consent at any time, with no detriment to services not relying on consent; not be subject to a decision based solely on automated processing (we don't do this — see section 14). To exercise any of these, email contact@thepetheadquarters.co.uk. We may need to verify your identity before responding.
If you believe we've handled your data unlawfully, you have the right to complain to the Information Commissioner's Office (ICO). Contact them at https://ico.org.uk/make-a-complaint/ or 0303 123 1113. We'd appreciate the chance to address concerns first if you contact us before going to the ICO.
We do not use automated decision-making, profiling, or algorithmic scoring that produces legal effects or similarly significant effects on you. Any review of high-risk orders, refund disputes, or potentially abusive accounts is done by a person.
We use the minimum tracking necessary. With your consent, we use Microsoft Clarity to record pseudonymous session replays — this helps us identify confusing parts of the site and fix them. You can decline this when you first visit, and change your preference at any time by clearing your browser site data or emailing us. We do not use Google Analytics, Facebook Pixel, or any advertising cookies. See our Cookie Policy for full details on what we store on your device and why.
We may update this policy as our services evolve. Material changes will be flagged on the website and, where the change affects you significantly, by email if you have an account. The "last updated" date at the top always reflects the current version.