TEAKMARSHLY · AMERICAN HERITAGE

GDPR & Data Protection Policy

Your Privacy. Your Rights. Our Responsibility.

LAST UPDATED: NOVEMBER 5, 2026

Respect for your personal information is part of the way we do business.

At teakmarshly, we recognize the importance of protecting your personal information and respecting your privacy. This GDPR Policy explains how personal data may be collected, used, stored, disclosed, and protected when you visit our website, browse our products, place an order, or communicate with our customer service team.

This policy is intended to provide information in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), where applicable, and other relevant data protection laws.

Our Privacy Commitment

We aim to collect only personal information that is reasonably necessary for our business purposes, explain why it is used, apply appropriate safeguards, and respect the rights available to individuals under applicable data protection laws. We do not intend to use this policy to limit any mandatory rights you may have under applicable law.

01. Who Is Responsible for Your Personal Data?

The business operating the teakmarshly online store is responsible for determining the purposes and means of processing customer personal information where it acts as the data controller under the GDPR.

For privacy-related questions, requests, or concerns, you may contact our business through the following details:

If a Data Protection Officer (DPO) or an EU/EEA representative is required under applicable law, the relevant appointment and contact information must be made available as required by law. This policy does not represent that such an appointment has been made.

02. Personal Information We May Collect

Depending on how you interact with our website and services, we may collect or process the following categories of personal information:

We do not intentionally request sensitive personal data unless it is necessary, legally permitted, and supported by an appropriate legal basis. Please avoid sending sensitive personal information through ordinary customer service messages unless it is necessary for your inquiry.

03. How We Collect Personal Information

Personal information may be obtained through several channels, depending on your interactions with our store.

• Directly from you when you place an order, complete checkout, or submit information through our website.
• When you contact us by email, telephone, or other available customer service channels.
• Automatically through website technologies, cookies, and similar tools, subject to applicable consent requirements and your privacy settings.
• Through Shopify and other service providers involved in operating the online store, processing transactions, or providing related services.
• From delivery, payment, or other service partners where information is necessary to complete or support a transaction.

Where personal data is obtained from a source other than you, we will provide the information required by applicable law, including information about the source where required.

04. Why We Use Your Personal Information

We process personal information only for purposes that are relevant to our business operations and supported by an appropriate legal basis.

The legal basis depends on the specific processing activity and applicable circumstances. The examples above describe potential legal bases, not a declaration that every listed activity or technology is currently enabled on our store.

05. How We Share Personal Information

We may disclose personal information to third parties when necessary to operate our online store, provide requested services, fulfill orders, or comply with applicable legal obligations.

Depending on the services used and your interactions with our website, recipients may include:

We do not treat the sharing of information necessary to fulfill an order as permission for unrelated marketing use. Where a third party independently determines its processing purposes, its own privacy notice may also apply.

06. International Data Transfers

teakmarshly operates from the United States. Depending on the services involved in operating our store, personal information relating to customers in the European Economic Area (EEA), the United Kingdom, or other regions may be processed or accessed in countries outside the country where the information was originally collected.

International transfers may occur through Shopify and other relevant service providers. The location of data processing depends on the services used and the applicable service arrangements.

Where GDPR transfer rules apply, we will rely on an appropriate transfer mechanism when required, such as:

• An adequacy decision adopted by the European Commission, where applicable.
• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable.
• Other legally recognized safeguards or transfer mechanisms permitted under applicable data protection law.

Appropriate safeguards and additional measures will be assessed where required by applicable law. You may contact us to request further information about relevant international data transfers and available safeguards.

07. Data Retention & Storage

We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law.

Retention periods may depend on:

• The nature and purpose of the personal information.
• Whether an order, customer service request, or other business relationship remains active.
• Applicable tax, accounting, consumer protection, and recordkeeping obligations.
• The need to resolve disputes, address complaints, or establish and defend legal claims.
• Applicable security, backup, and technical requirements.

When personal information is no longer required for its original purpose and no legal retention obligation applies, it will be deleted, anonymized, or otherwise handled in accordance with applicable requirements.

08. Your Rights Under the GDPR

If you are located in the EEA and the GDPR applies to our processing of your personal information, you may have the following rights, subject to applicable legal conditions and exceptions.

These rights are not absolute and may be subject to legal limitations. We will assess each request according to the applicable legal requirements.

09. How to Exercise Your Privacy Rights

To submit a GDPR-related request, please contact us using the email address below.

To help us locate your information and process your request, please include:

• Your name.
• The email address associated with your order or website interaction.
• Your order number, if your request relates to a purchase.
• A clear description of the privacy right you wish to exercise.

We may request reasonable additional information to verify your identity and protect your personal information from unauthorized disclosure.

Where the GDPR applies, we generally respond to valid requests without undue delay and within one month of receipt. Where legally permitted and necessary due to the complexity or number of requests, this period may be extended by up to two additional months. We will inform you of any such extension within the initial response period.

We do not charge a fee for ordinary valid requests. A reasonable fee or refusal may apply only where permitted by law, such as for manifestly unfounded or excessive requests.

10. Your Right to Lodge a Complaint

If you believe that the processing of your personal information violates applicable data protection law, you may have the right to lodge a complaint with the competent supervisory authority in the country of your habitual residence, place of work, or the place of the alleged infringement.

You may also contact us directly first so that we can review your concern and attempt to address it.

You can find information about data protection rights and relevant authorities through the European Commission's official website:

European Commission – Information for Individuals

11. Cookies & Similar Technologies

Our website may use cookies and similar technologies to support website functionality, remember preferences, understand website usage, and support other services where enabled.

Cookies may be grouped into the following categories:

Where required by law, non-essential cookies and similar technologies will only be activated after you provide the necessary consent. You can manage your cookie preferences through the available website privacy controls and your browser settings.

For more information, please refer to our Cookie Policy.

12. Marketing Communications

We may offer customers the opportunity to receive product updates, promotional information, or other marketing communications where such communications are available and legally permitted.

Where marketing requires consent, we will request your permission before sending the relevant communications.

You may withdraw your consent or unsubscribe from marketing emails at any time by using the unsubscribe instructions included in the relevant email or by contacting us directly.

Withdrawing marketing consent does not affect order-related, transactional, or legally required communications that are necessary for our business relationship with you.

13. Data Security

We take reasonable technical and organizational measures designed to protect personal information against unauthorized access, accidental loss, alteration, disclosure, or destruction.

Depending on the systems and services involved, protective measures may include:

• Using established e-commerce and service infrastructure.
• Restricting access to personal information to authorized personnel and service providers who require it for legitimate business purposes.
• Using appropriate security measures for website access and information transmission.
• Reviewing service arrangements and data access where appropriate.
• Taking reasonable steps to respond to suspected data security incidents.

No method of electronic transmission or storage can guarantee absolute security. We therefore cannot promise that personal information will be completely immune from every possible security incident.

14. Children's Privacy

Our website and online shopping services are intended for general consumers and are not knowingly directed toward children under the age of 16 for independent purchases or account activities.

We do not knowingly collect personal information directly from children in circumstances where parental or guardian authorization is required by applicable law.

If you believe that a child has provided us with personal information inappropriately, please contact us. We will review the situation and take appropriate steps in accordance with applicable legal requirements.

15. Third-Party Websites & Services

Our website may contain links to third-party websites, applications, payment services, delivery services, or other external platforms.

These third parties may have their own privacy policies, data handling procedures, and security practices. We encourage you to review their privacy notices before providing personal information directly to them.

We are not responsible for the independent privacy practices of third-party websites or services that we do not control, subject to any responsibilities imposed on us by applicable law.

16. Automated Processing & Profiling

Certain services used by online stores may involve automated processing for purposes such as transaction administration, security, fraud prevention, website analytics, or service optimization.

Where automated processing or profiling is used, its purpose and legal basis must be assessed according to the actual service and applicable law.

Where GDPR Article 22 applies, you may have rights relating to decisions based solely on automated processing that produce legal effects or similarly significantly affect you, subject to applicable exceptions and safeguards.

17. Personal Data Breaches

If a personal data breach occurs, we will assess the incident and take appropriate measures in accordance with applicable data protection laws.

Where the GDPR applies, we will notify the competent supervisory authority within the legally required timeframe when notification is required. Where a breach is likely to result in a high risk to individuals' rights and freedoms, affected individuals will also be informed when required by law.

Any notification will be handled according to the circumstances of the incident and applicable legal requirements.

18. Changes to This GDPR Policy

We may update this GDPR Policy from time to time to reflect changes in our business operations, website functionality, technology, service providers, or applicable legal requirements.

When changes are made, the revised policy will be published on this page with an updated revision date where appropriate.

We encourage visitors and customers to review this page periodically to remain informed about how personal information is handled.

19. Applicable Data Protection Laws

This policy is intended to address relevant GDPR transparency requirements where the GDPR applies to our processing activities.

Depending on your location and the nature of our relationship with you, additional data protection and privacy laws may apply. These may include the UK GDPR, applicable United States state privacy laws, and other regional privacy requirements.

Nothing in this policy is intended to exclude, restrict, or waive any privacy right that cannot lawfully be excluded or restricted under applicable law.

OUR COMMITMENT TO PRIVACY

Trust is built through transparency and respect.

Your personal information deserves thoughtful handling. At teakmarshly, we recognize that privacy is an important part of a reliable shopping experience, and we aim to handle customer information responsibly and transparently.

Contact Us About Your Privacy

For questions about this GDPR Policy, requests concerning your personal information, or concerns about our privacy practices, please contact us through the following channels.

THE ART OF THOUGHTFUL LIVING

teakmarshly

Privacy · Transparency · Trust