Privacy Policy

1. Who is responsible

Dubicon is responsible for the personal information described in sections 2 to 5 of this policy (in legal terms, we are the “controller”).

When we work inside a client’s Klaviyo, Shopify or similar account, we handle that client’s customer data on the client’s behalf and under their instructions (we are a “processor”). The client’s own privacy policy applies to that data. Section 6 explains how we handle it.

2. Information we collect

• When you visit dubicon.net: technical information your browser sends, such as your IP address, browser and device type, the pages you view and the site that referred you. This is recorded by our hosting provider and by Google Analytics (see section 5).
• When you email us or request a store review: your name, email address, company, store address and anything else you choose to tell us.
• When you become a client: business contact details, billing details and the account access you give us for the work.
• When we review a store: we sign up to the store’s email list with our own address and record the emails we receive. We don’t collect information about the store’s customers during a review.

We don’t knowingly collect information from children under 16.

3. How we use it

• to reply to your messages and prepare store reviews and proposals;
• to deliver the work we agree on and keep you updated;
• to invoice and keep the business records the law requires;
• to understand how the website is used and improve it;
• to keep the site and our business secure and prevent misuse.

If you are in the European Economic Area, the United Kingdom or another place with similar laws, we rely on these legal bases: taking steps before or performing a contract with you; our legitimate interests in running and improving our business and answering enquiries; legal obligations; and your consent where we ask for it.

We don’t sell your personal information, and we don’t use it to make automated decisions that significantly affect you.

4. Who we share it with

We share personal information only with service providers that help us run the business, and only as much as they need:

• our website host (Hostinger);
• Google, for website analytics;
• the email and file storage services we use to communicate and keep project files;
• video tools we use to record store reviews and walkthroughs, such as Loom;
• payment providers used to send invoices and receive payments;
• professional advisers such as accountants, where needed;
• public authorities, when the law requires it.

Some of these providers store data outside your country, including in the United States and the European Union. Where the law requires it, these transfers rely on safeguards such as the standard contractual clauses the providers offer.

5. Cookies and analytics

Our website uses:

• Essential cookies that the site needs to work and stay secure.
• Google Analytics, added through Google Site Kit, to count visits and see which pages are used. Google Analytics uses cookies and processes your IP address. You can read how Google uses information from sites that use its services and Google’s privacy policy, and you can opt out with the Google Analytics opt-out browser add-on.

You can also block or delete cookies in your browser settings; the site still works without analytics cookies.

We don’t use advertising cookies at the moment. If we add advertising tools, such as Google Ads, we’ll update this policy first and, where the law requires it, ask for your consent.

6. Data we handle for clients

When a client gives us access to Klaviyo, Shopify or a similar tool, we may see information about their subscribers and customers, such as names, email addresses and order history. We use it only to do the work the client asked for, under the client’s instructions and our agreement with them. Access is limited to the people who need it for the work, we don’t copy the data out of the client’s systems unless the work requires it, and we delete any copies when the project ends.

If you are a customer of one of our clients, please contact that brand about your data. We’ll help them respond.

7. How long we keep it

• Enquiries and store review requests that don’t become projects: up to 24 months, then deleted.
• Client records and invoices: for as long as tax and accounting laws require.
• Analytics data: for the period set in our Google Analytics account, which is no longer than 14 months.
• Server logs: for the limited period set by our hosting provider.

8. Your rights

Depending on where you live, you may have the right to access your personal information, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent you’ve given. To use any of these rights, email yagiz@dubicon.net. We may need to confirm your identity first, and we’ll reply within the time the law requires.

If you’re unhappy with how we’ve handled your information, please tell us. You also have the right to complain to your local data protection authority, for example the Personal Data Protection Authority (KVKK) in Türkiye, the Information Commissioner’s Office in the UK, or the supervisory authority in your EU country.

9. Security

We use reasonable measures to protect personal information, including encrypted connections (HTTPS), limited access, and two-factor authentication on the accounts we use, where it’s available. No method of transmission or storage is completely secure, but we work to protect your information and will act quickly if something goes wrong.

10. Changes and contact

We may update this policy as our services or the law change. We’ll change the date at the top when we do, and for significant changes we’ll make it clear on this page. Questions or requests: yagiz@dubicon.net.