Privacy Policy
Effective Date: 6 January 2026
Website:www.wafani.com
Wafani Limited (“we”, “our”, “us”) values your privacy and is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Privacy Policy outlines how we collect, use, store, and protect your information when you visit or make a purchase from www.wafani.com (the “Site”).
1. Who We Are
Wafani.com is an online e-commerce platform operated by Wafani Limited, a company registered in England and Wales.
- Company Registration Number: 07954123
- Registered Office Address: 4 Whitfield House, 2–10 Salisbury Street, London, NW8 8AT, United Kingdom
- Data Protection Email: contact@wafani.com
- Customer Support Phone: +44 (0) 20 3724 4841
- Operating Hours: Monday – Friday, 9:00 AM – 6:00 PM (GMT) | Saturday, 10:00 AM – 4:00 PM (GMT)
2. Information We Collect & Specific WordPress Features
We collect several categories of information to fulfill your orders, provide customer support, and improve your shopping experience:
- Personal Identity & Contact Data: Name, email address, phone number, shipping address, and billing address collected during checkout or account registration.
- Transaction & Order Data: Order details, item history, transaction values, shipping fees (£4.95 baseline or free over £30), and voucher usage. Note: We do not process or store full credit/debit card numbers on our servers; all payments are processed securely by PCI-DSS compliant third-party gateways (Stripe, PayPal).
- Technical & Browsing Data: IP address, browser type, operating system, time zone settings, referral URLs, and site interaction data collected automatically via cookies.
- Customer Support & Contact Forms: When you submit an inquiry via our contact form or support line (+44 (0) 20 3724 4841), we process your name, email address, phone number, and message text. We retain this strictly for customer service and dispute resolution, never for marketing unless explicitly requested.
- Comments & Customer Reviews: When visitors leave product reviews or comments on Wafani.com, we collect the data shown in the comments form, along with the visitor’s IP address and browser user agent string to assist in spam detection.
- Media Uploads: If you upload images to the site (e.g., product review attachments), avoid uploading images with embedded location data (EXIF GPS) included, as visitors can download and extract location data from images on the website.
3. Purpose of Processing & Legal Basis (UK GDPR)
We process your data under the following legal bases:
| Purpose of Processing | Data Categories Used | Legal Basis (UK GDPR) |
| Order Processing & Delivery | Name, Address, Email, Phone, Order Details | Contractual Necessity (Art. 6(1)(b)) |
| Payment & Fraud Prevention | Payment status, IP Address, Billing Details | Contractual Necessity & Legitimate Interests |
| Customer Support & Inquiry Forms | Name, Contact Info, Correspondence History | Legitimate Interests (Art. 6(1)(f)) |
| Marketing Communications | Name, Email Address | Consent (Opt-in via form/checkout) |
| Site Analytics & Ad Targeting | Cookies, IP Address, Device Identifiers | Consent (Via Cookie Banner & Google Consent Mode v2) |
| Tax & Accounting Records | Order History, Billing Address, Payment Verification | Legal Obligation (HMRC Compliance – Art. 6(1)(c)) |
4. Data Sharing & Third-Party Processors
We do not sell, rent, or trade your personal information. To operate our WooCommerce store and fulfill your orders, we share necessary data strictly with trusted third parties:
- E-Commerce Infrastructure: WordPress and WooCommerce core system software.
- Payment Processors: Stripe and PayPal for secure transaction handling.
- Couriers & Delivery Partners: Royal Mail and UK logistics partners (sharing recipient name, delivery address, and phone number for parcel fulfillment).
- Analytics & Advertising Partners: Google Analytics, Google Search Console, Google Ads, Google Merchant Center, and Meta (Facebook) Pixel. Tracking data is transmitted strictly according to your selections in our CookieYes banner using Google Consent Mode v2.
- Anti-Spam & Security Services: Akismet (checks comments/forms for spam) and LiteSpeed Cache (manages web server performance).
- Legal Authorities: When mandated by law, regulation, or court order.
Third Parties We Receive Data From: We may receive transaction verification data, address validation checks, or fraud protection risk scores from our payment processors (Stripe/PayPal) during the checkout process to prevent fraudulent orders.
5. Cookies & Tracking Technologies
Our Site uses essential, functional, analytics, and marketing cookies managed via the CookieYes Consent Management Platform.
- Essential Cookies: Activated automatically to enable fundamental shopping cart behavior, session maintenance, and secure checkout.
- Analytics & Marketing Cookies: Only activated after you click “Accept All” or enable them under “Customise”.
You can manage or revoke your consent at any time via the “Cookie Settings” link located in our website footer or through your web browser preferences.
6. International Data Transfers
When site data is processed by international service providers (such as Google LLC, Meta Platforms, Inc., or Stripe) located outside the UK and European Economic Area (EEA), we ensure appropriate safeguards are enforced. Transfers rely on approved legal mechanisms, including the UK International Data Transfer Agreement (IDTA) and Standard Contractual Clauses (SCCs), ensuring your personal data receives equivalent protection under UK law.
7. Data Retention Schedule
We retain personal data only for as long as necessary to fulfill operational, legal, and tax requirements:
- Order & Transaction Records: Retained for 6 years following tax year completion to satisfy UK HMRC statutory compliance.
- Customer Account Data: Retained until an account deletion request is submitted.
- Contact Form & Support Logs: Retained for 12 months for customer service monitoring, then securely purged.
- Product Comments & Reviews: Retained indefinitely so follow-up comments can be recognized and approved automatically, rather than holding them in a moderation queue.
- Marketing Subscriptions: Retained until you click “Unsubscribe” or withdraw consent.
- Cookie Data: Session cookies expire upon closing your browser; persistent cookies expire between 30 days and 2 years.
8. Data Security & Breach Procedures
- Technical Security Measures: We maintain robust administrative and technical protections including full site SSL/TLS encryption, restricted backend access limited to authorized personnel using two-factor authentication (2FA), PCI-DSS compliant payment gateway integration, and automated vulnerability scanning.
- Data Breach Response: In the event of a confirmed or suspected personal data breach that poses a risk to individual rights, we maintain an incident protocol to contain the issue, notify the UK Information Commissioner’s Office (ICO) within 72 hours, and contact affected users without undue delay where high risk is identified.
9. Your UK GDPR Statutory Rights
Under UK data protection laws, you hold the following rights:
- Right of Access: Request a copy of the personal data we hold about you.
- Right to Rectification: Request correction of inaccurate or incomplete records.
- Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data (where legal retention limits permit).
- Right to Restrict or Object: Limit or object to how we process your data.
- Right to Data Portability: Request a structured, transferable copy of your data.
- Right to Withdraw Consent: Revoke marketing or cookie consent at any time.
To exercise any of these rights, email us at contact@wafani.com. You also have the right to lodge a complaint with the UK supervisory authority: Information Commissioner’s Office (ICO) at ico.org.uk.
10. Children’s Privacy
Our Site is not directed at or intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal details without parental consent, please contact us immediately for prompt deletion.
11. Automated Decision Making & Profiling
We do not engage in automated decision-making or credit scoring that produces legal or significant effects on customers. We use basic targeted advertising algorithms via Google Ads and Meta Pixel strictly when explicit marketing consent is granted through our cookie banner.
12. Privacy Policy Updates & Contact Information
We may update this policy periodically to reflect legal or operational changes. Updates will be posted on this page with an updated “Effective Date.”
For privacy requests, Data Protection Officer inquiries, or regulatory queries:
- Company: Wafani Limited (Company No. 07954123)
- Email: contact@wafani.com
- Phone: +44 (0) 20 3724 4841
- Address: Wafani Limited, 4 Whitfield House, 2–10 Salisbury Street, London, NW8 8AT, United Kingdom