EU & UK data rights

1Why this page is separate

We trade from the United States, so the main privacy policy is written around US law. Shoppers in Europe and Britain are covered by a further set of rules, and burying those in the main document would make it worse for everybody. They live here instead, and they override the main policy wherever the two disagree for those customers.

We act as controller. Write to [email protected], or to Colorado Doorways, Inc 5151 Bannock street 17 Denver CO, 80216 USA at 5151 Bannock street 17 Denver CO, 80216 USA.

2Why each piece of processing is permitted

Getting a pillow to your door is simply the contract you entered into, and so is refunding it if you send it back. Holding on to the resulting invoice for years afterwards is not a choice we make — revenue law requires it. Screening an order for fraud and keeping the site standing are things any retailer has to do; we have weighed that against the intrusion and consider it slight, though you are entitled to tell us you disagree.

Everything optional runs on your say-so alone: a newsletter, an analytics or advertising cookie, or publishing a review you sent us. None of it is a condition of buying anything, and all of it stops the moment you withdraw consent.

3How long anything is kept

Invoices and order records stay seven years because tax rules set that clock. A support thread is kept three years so a later question about the same pillow has context. Security logs expire after twelve months. A review stays published until you ask us to pull it. When you unsubscribe we keep the bare minimum needed to remember not to contact you again.

4What you can ask us to do

You can see what we hold and take a copy of it, and have anything wrong put right. You can ask for deletion, and we will comply except for the records tax law obliges us to keep — we will say plainly which those are rather than refusing in general terms. If something is in dispute you can have processing frozen instead of erased, and you can ask for your data in a portable file to hand to someone else.

Two of these work as an outright veto: you can object to anything we justify by our own legitimate interests, and you can stop direct marketing with no reason given and no argument from us.

5Lodging a request

Email from the address the order was placed under and name the right you are using — that is the entire procedure, and there is no form to fill in. A reply comes within one month. Something genuinely tangled can take up to two months longer, and if that happens we tell you before the first month is out rather than afterwards. We do not charge, unless a request is plainly baseless or repeated to make a point.

6Data leaving Europe

Because we are based in the United States, your information does travel out of the EEA and the UK to reach us. That transfer runs on the European Commission’s standard clauses, or the UK addendum to them, or an adequacy finding where one covers the route. Ask and we will tell you which applies to your order.

7If we handle it badly

Come to us first — it is faster, and most complaints turn out to be a misunderstanding we can clear up the same week. You never lose the right to go over our heads: in Britain that is the Information Commissioner’s Office at ico.org.uk, and in the EU it is the authority for the country where you live, where you work, or where the problem happened.