Privacy policy

Privacy Policy
Last updated: Thursday 24 September 2026

This Privacy Policy explains how Johanna Amy Lambert trading as Totally Trash Panda collects, uses, stores and protects personal information when you visit or purchase from our website at www.totallytrashpanda.com.

We are a sole trader business based in the United Kingdom.

We respect your privacy and are committed to handling your personal information fairly, lawfully and transparently.

This Privacy Policy applies to customers, website visitors and other individuals who interact with our website or business.

1. Who We Are

The data controller responsible for your personal information is:

Johanna Amy Lambert
Trading as: Totally Trash Panda

Email: hello@totallytrashpanda.com
Website: www.totallytrashpanda.com

For the purposes of UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, we are the controller of personal information that we collect and use in connection with our business.

Where applicable, EU data protection law, including the EU General Data Protection Regulation (EU GDPR), may also apply to our processing of personal data belonging to individuals in the European Union.

If you have any questions about this Privacy Policy or how we use your information, please contact us using the details above.

2. What Personal Information We Collect

Depending on how you interact with us, we may collect some or all of the following information.

Information you provide when placing an order

This may include:

• your name;

• billing address;

• delivery address;

• email address;

• telephone number, where provided or required for delivery;

• details of the products you purchase;

• order number;

• order date;

• payment and transaction information;

• delivery and tracking information; and

• communications relating to your order.

We do not normally receive or store your full payment card number. Payment transactions are processed through the payment provider selected at checkout.

Information you provide when contacting us

If you contact us by email, contact form, social media or another method, we may collect:

• your name;

• email address;

• telephone number, if provided;

• order information;

• photographs or other information you send to us;

• the contents of your correspondence; and

• any information reasonably necessary to deal with your enquiry or complaint.

Information relating to personalised products

If we offer personalised products, we may collect information you choose to provide for that purpose.

This could include:

• names;

• initials;

• dates;

• messages;

• photographs;

• artwork;

• logos;

• text; or

• other information supplied by you.

Please do not provide sensitive personal information unless it is genuinely necessary for the service you have requested.

Website and technical information

When you visit our website, certain information may be collected automatically.

Depending on the technologies and services enabled on our website, this may include:

• IP address;

• browser type;

• device type;

• operating system;

• approximate location derived from IP address;

• referring website;

• pages visited;

• products viewed;

• date and time of visits;

• interactions with our website;

• language and browser settings; and

• information relating to cookies and similar technologies.

Some of this information may constitute personal data under applicable data protection law.

3. How We Collect Your Information

We may collect personal information:

• directly from you when you place an order;

• when you create or use an account;

• when you contact us;

• when you sign up to marketing communications;

• when you browse or interact with our website;

• through cookies and similar technologies;

• through Shopify and other service providers used to operate our store;

• through payment providers;

• through delivery and fulfilment providers; or

• from other sources where this is lawful and necessary.

4. Why We Use Your Personal Information

We use personal information only where we have a lawful reason to do so.

The purposes for which we may process your information include:

Processing and fulfilling orders

We use your information to:

• process your order;

• take or arrange payment;

• manufacture or arrange manufacture of your products;

• provide your delivery address to the relevant fulfilment provider;

• arrange delivery;

• send order confirmations;

• provide shipping and tracking information;

• communicate with you about your order; and

• deal with returns, refunds and complaints.

The primary lawful basis for this processing is that it is necessary to perform our contract with you or to take steps at your request before entering into a contract.

Customer service

We may use your information to answer questions, investigate problems, deal with complaints and provide customer support.

The lawful basis will generally be performance of our contract with you, compliance with a legal obligation, or our legitimate interests in managing and improving our business, depending on the circumstances.

Legal and accounting obligations

We may process and retain information where necessary to:

• comply with tax and accounting obligations;

• maintain appropriate business records;

• comply with consumer protection requirements;

• comply with other legal obligations;

• establish, exercise or defend legal claims; or

• cooperate with lawful requests from courts, regulators or public authorities.

The lawful basis for this processing is generally compliance with a legal obligation and/or our legitimate interests.

Fraud prevention and security

We may use personal information to:

• detect and prevent fraudulent transactions;

• protect our website and systems;

• investigate suspicious activity;

• protect our business and customers; and

• maintain the security of our services.

The lawful basis will generally be our legitimate interests and, where applicable, compliance with a legal obligation.

Business administration

We may process information for purposes such as:

• maintaining customer records;

• managing orders;

• managing payments;

• analysing sales;

• maintaining accounting records;

• improving our products and services; and

• managing our relationship with customers.

Where appropriate, this will be based on our legitimate interests in operating and developing our business.

Marketing

If you choose to receive marketing communications from us, we may use your name and email address to send information about:

• new products;

• new designs;

• promotions;

• offers;

• collections;

• news; and

• other information about Totally Trash Panda.

Where consent is required, we will ask for it before sending marketing communications.

You can withdraw your consent or unsubscribe at any time by using the unsubscribe link in our marketing emails or by contacting us.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

5. Our Lawful Bases for Processing

Depending on the circumstances, we rely on one or more of the following lawful bases under applicable data protection law:

Contract: We need certain information to enter into and perform our contract with you, such as processing and delivering your order.

Legal obligation: We may need to process information to comply with legal, accounting, tax, consumer-protection or other legal requirements.

Legitimate interests: We may process information where necessary for our legitimate business interests, provided those interests are not overridden by your rights and interests.

Examples include fraud prevention, website security, business administration and improving our services.

Consent: Where required, we will ask for your consent before processing information for a particular purpose, such as certain forms of marketing or the use of non-essential cookies.

We will not use one lawful basis where another is legally required.

6. Shopify

Our online store is operated using Shopify.

Shopify provides the ecommerce infrastructure that allows us to display products, process orders, manage customer information and operate our online store.

When you place an order or interact with our website, information may be processed through Shopify.

Shopify may process personal information in accordance with its own privacy terms and may use service providers and infrastructure located in different countries.

For more information about how Shopify handles personal information, please refer to Shopify's current privacy documentation.

7. Printful and Gelato

We use third-party print-on-demand and fulfilment providers, which may include Printful and Gelato.

When you place an order, we may provide the relevant fulfilment provider with information necessary to manufacture and deliver your order.

Depending on the product and fulfilment arrangement, this may include:

• your name;

• delivery address;

• email address;

• telephone number, where necessary;

• order details;

• product information;

• personalisation information; and

• information required for shipping and fulfilment.

Printful's current Data Processing Terms state that, where it processes merchant customer data to fulfil orders, the merchant is the controller and Printful acts as processor.

Gelato likewise provides print-on-demand and fulfilment services and may process information necessary to fulfil orders.

We only provide fulfilment providers with information that is reasonably necessary for them to perform their services.

They may use their own service providers, production facilities, delivery companies and other subprocessors where permitted under their applicable agreements and data protection arrangements.

8. Payment Providers

Payments are processed using payment services made available through our Shopify store.

Depending on the payment method you select, your payment may be processed by Shopify Payments or another third-party payment provider.

We do not normally store complete payment card details ourselves.

Payment providers may process personal information in accordance with their own privacy policies and applicable payment and financial regulations.

9. Delivery Companies

To deliver your order, we or our fulfilment providers may provide relevant information to postal operators, couriers and other delivery companies.

This may include:

• your name;

• delivery address;

• email address;

• telephone number, where necessary; and

• order or tracking information.

This information is used only to facilitate delivery and related services.

10. Other Service Providers

We may use other third-party service providers to operate our business.

These may include providers of:

• website hosting and ecommerce services;

• payment processing;

• accounting;

• email services;

• customer support;

• marketing;

• analytics;

• website security;

• cloud storage;

• IT services;

• fraud prevention; and

• delivery and fulfilment.

Where these providers process personal information on our behalf, we will take reasonable steps to ensure that appropriate contractual and data protection arrangements are in place.

11. Cookies and Similar Technologies

Our website uses cookies and similar technologies.

Some cookies are necessary for the website and shopping functionality to operate.

Other cookies may be used for purposes such as:

• remembering preferences;

• analysing website traffic;

• understanding how visitors use our website;

• improving website performance;

• advertising; and

• measuring marketing campaigns.

Where applicable law requires consent for non-essential cookies or similar technologies, we will ask for your consent before placing or using them.

You can manage your cookie preferences through our cookie consent mechanism where available.

For more information, please see our Cookie Policy.

12. Analytics and Advertising

Depending on the services enabled on our Shopify website, we may use analytics or advertising technologies to understand how visitors interact with our website and how our marketing performs.

These services may process information such as:

• IP address;

• device information;

• browser information;

• pages visited;

• products viewed;

• purchases;

• advertising interactions; and

• information relating to cookies or similar technologies.

We will use appropriate consent mechanisms where required by law.


13. Social Media

We may operate social media accounts or include links to social media platforms.

If you interact with us through social media, the relevant platform may process your personal information independently of us.

We are not responsible for the privacy practices of those platforms.

Please review the privacy information of the relevant social media provider.

14. Sharing Your Information

We do not sell your personal information.

We may share personal information where reasonably necessary with:

• Shopify;

• Printful;

• Gelato;

• payment providers;

• fulfilment providers;

• postal and courier services;

• IT and website service providers;

• email and communication providers;

• accounting and professional advisers;

• analytics and advertising providers, where applicable;

• fraud-prevention and security providers;

• government authorities, regulators or law-enforcement bodies where legally required; and

• professional advisers where necessary to protect or enforce our legal rights.

We only share information that is reasonably necessary for the relevant purpose.

15. International Transfers

Some of the service providers we use may process personal information outside the United Kingdom or European Economic Area.

Where personal information is transferred internationally, we will take steps to ensure that the transfer is carried out in accordance with applicable data protection law.

Depending on the circumstances, this may include relying on:

• an adequacy decision;

• UK International Data Transfer Agreements or Addendum;

• EU Standard Contractual Clauses;

• appropriate safeguards provided by the relevant service provider; or

• another legally permitted transfer mechanism.

Because Shopify, Printful, Gelato and other technology providers may use international infrastructure and subprocessors, the countries in which information is processed can change.

We will take reasonable steps to ensure that applicable contractual and legal safeguards are in place.

16. European Union Customers

If you are located in the European Union, the EU GDPR may apply to our processing of your personal information.

Where applicable, you have the rights described in this Privacy Policy.

If our activities make us subject to the EU GDPR and we are required to appoint an EU representative, we will provide the representative's details here:

EU Representative:

Additional product safety information

Beanie

Hoodie

Product safety compliance:

• Comply with regulatory requirements on dangerous substances (lead, cadmium, phthalates, and formaldehyde).
• Comply with regulatory requirements on flammability.

17. How Long We Keep Personal Information

We do not keep personal information for longer than reasonably necessary for the purpose for which it was collected, unless we are required or permitted by law to retain it for longer.

Different information may be kept for different periods.

For example:

Order and transaction records

We may retain order, transaction and accounting information for the period required by applicable tax, accounting and legal requirements.

Customer service correspondence

We may retain customer service correspondence for as long as reasonably necessary to deal with your enquiry, resolve disputes and protect our legal interests.

Marketing information

If you subscribe to marketing communications, we will generally retain your marketing preferences and contact details until you unsubscribe or we otherwise determine that they are no longer required.

Website and technical information

Cookie and analytics information will be retained according to the settings and retention periods of the relevant service.

We may retain certain information for longer where necessary to establish, exercise or defend legal claims.

When information is no longer required, we will take reasonable steps to delete it securely or anonymise it.

18. How We Protect Your Information

We take reasonable technical and organisational measures to protect personal information against:

• unauthorised access;

• accidental loss;

• destruction;

• alteration;

• disclosure; and

• other unlawful or unauthorised processing.

These measures may include appropriate account security, access controls, secure service providers and secure transmission technologies.

However, no online transmission or storage system can be guaranteed to be completely secure.

If we become aware of a personal data breach, we will assess and respond to it in accordance with applicable data protection law.

19. Your Data Protection Rights

Depending on the applicable law and circumstances, you may have rights including:

Right of access

You can ask us for a copy of personal information we hold about you.

Right to rectification

You can ask us to correct inaccurate or incomplete information.

Right to erasure

You can ask us to delete your personal information in certain circumstances.

This is sometimes called the "right to be forgotten".

This right is not absolute and may not apply where we have a legal reason to retain information.

Right to restriction

You may have the right to ask us to restrict how we use your personal information in certain circumstances.

Right to object

You may have the right to object to certain processing, including processing based on legitimate interests.

You can also object to direct marketing at any time.

Right to data portability

In certain circumstances, you may have the right to receive personal information you have provided to us in a structured, commonly used and machine-readable format, or ask us to transmit it to another organisation.

Right to withdraw consent

Where we process your information on the basis of consent, you can withdraw that consent at any time.

Withdrawal of consent does not affect processing that took place before consent was withdrawn.

Rights relating to automated decision-making

Where applicable law gives you rights in relation to solely automated decision-making or profiling that has legal or similarly significant effects, we will provide the relevant information and safeguards required by law.

We do not currently intend to make solely automated decisions producing legal or similarly significant effects on customers.

20. How to Exercise Your Rights

To exercise any of your data protection rights, please contact:

hello@totallytrashpanda.com

Please include enough information for us to identify you and understand your request.

We may need to verify your identity before responding to a request.

We will respond within the period required by applicable data protection law.

You will normally not have to pay a fee to exercise your data protection rights. However, where permitted by law, we may charge a reasonable fee or refuse a request where it is manifestly unfounded or excessive.

21. Complaints

If you have concerns about how we have handled your personal information, we would encourage you to contact us first so that we can try to resolve the issue.

You also have the right to complain to the relevant data protection authority.

UK customers

The UK supervisory authority is the:

Information Commissioner's Office (ICO)

Website: https://ico.org.uk/

The ICO provides information about data protection rights and how to make a complaint.

EU customers

If you are located in the European Union, you may also complain to the data protection supervisory authority in the EU Member State where you live, work or where you believe an infringement has occurred.

The appropriate supervisory authority depends on your circumstances.

22. Children's Privacy

Our website and products are intended for general consumers and are not knowingly directed at children for the purpose of collecting personal information.

We do not knowingly collect personal information from children where doing so would be unlawful.

If you believe that a child has provided us with personal information in circumstances where this should not have happened, please contact us.

23. Customer-Provided Photographs, Artwork and Personalisation

If you provide photographs, artwork, text, names or other content for a personalised product, that information may need to be shared with Shopify, Printful, Gelato or another fulfilment provider so that your product can be produced.

You should only provide information and content that you are entitled to provide to us.

Where a photograph or other content contains information about another person, you should ensure that you have an appropriate legal basis or permission to provide it to us where required.

We will use customer-provided content only as reasonably necessary to provide the service, subject to our other legal obligations.

24. Your Responsibility for Account and Order Information

You should take reasonable care to keep your account passwords and other login information confidential.

If you believe that your account has been compromised or that personal information has been accessed without permission, please contact us immediately.

25. Links to Other Websites

Our website may contain links to third-party websites.

This Privacy Policy applies only to our own website and processing activities.

When you follow a link to another website, that website will have its own privacy practices and policies.

We recommend reviewing the privacy policy of any third-party website you visit.

26. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to our business;

• changes to the services we use;

• changes to how we process personal information;

• changes to applicable law or regulatory guidance; or

• changes to our website.

The latest version will be published on our website with the updated "Last updated" date.

Where a change is significant, we will take reasonable steps to bring it to your attention where required by law.

27. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact:

Johanna Amy Lambert
Trading as Totally Trash Panda

Email: hello@totallytrashpanda.com

Postal address for letters only [no parcels accepted]: Johanna Lambert / Totally Trash Panda, Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA

Website: www.totallytrashpanda.com

Last updated: Thursday 24 September 2026