Privacy Policy

Last updated: 4 June 2026

1. Introduction

Welcome to Tutdan, operated by Bamboo Shop AS. We are committed to protecting and respecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit our website tutdan.com, place an order, or interact with our services.

By using our website and services, you consent to the practices described in this policy. If you do not agree with our practices, please do not use our services.

2. Information We Collect

We collect various types of information to provide and improve our services:

2.1 Personal Information You Provide

• Contact Details: Name, email address, phone number, and delivery address when you place an order or contact us.
• Order Information: Product selections, quantities, and payment details processed through secure payment gateways.
• Communication Data: Any messages, inquiries, or feedback you send through our contact forms.
• Account Information: If you create an account, we store your login credentials and purchase history.

2.2 Information Collected Automatically

• Device Information: IP address, browser type, operating system, and device identifiers.
• Usage Data: Pages visited, time spent, click patterns, and navigation paths through our website.
• Location Data: Approximate geographic location based on IP address for regional service optimization.
• Cookies and Tracking Technologies: See our Cookie Policy for detailed information.

3. How We Use Your Information

We use your personal information for the following purposes:

• Order Fulfillment: Processing and delivering your orders, managing returns, and providing customer support.
• Service Improvement: Analyzing usage patterns to enhance website functionality, product offerings, and user experience.
• Communication: Sending order confirmations, shipping updates, and responding to your inquiries.
• Marketing: With your explicit consent, sending promotional emails about new products, special offers, and company news. You can unsubscribe at any time.
• Legal Compliance: Meeting regulatory requirements, preventing fraud, and protecting our legal rights.
• Security: Detecting and preventing unauthorized access, fraud, and other security threats.

4. Legal Basis for Processing

Under UK GDPR, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to fulfill our contractual obligations when you place an order.
• Legitimate Interests: Processing for website improvement, fraud prevention, and customer service, balanced against your rights and interests.
• Consent: For marketing communications and optional features, where you have given explicit permission.
• Legal Obligation: Processing required to comply with applicable laws and regulations.

5. Data Sharing and Third Parties

We do not sell your personal information. We share data only with trusted service providers who assist us in operating our business:

• Payment Processors: Secure payment gateways that handle transaction processing (PCI DSS compliant).
• Delivery Services: Courier companies that deliver your orders to your specified address.
• Analytics Providers: Services that help us understand website usage patterns (anonymized where possible).
• Email Services: Platforms that manage our email communications and newsletters.
• Cloud Hosting: Secure servers that store and protect your data.

All third-party providers are contractually obligated to protect your data and use it only for specified purposes.

6. Data Security

We implement robust security measures to protect your personal information:

• 256-bit SSL encryption for all data transmissions
• Secure payment processing through PCI DSS compliant gateways
• Regular security audits and vulnerability assessments
• Access controls limiting employee access to personal data
• Secure data storage with encryption at rest
• Regular backups and disaster recovery procedures

While we strive to protect your information, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security but continuously work to enhance our protective measures.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data under certain circumstances.
• Right to Restrict Processing: Request limitation of how we use your data.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise these rights, contact us at [email protected]. We will respond within one month and may request verification of your identity.

8. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this policy:

• Order Records: 7 years for tax and accounting purposes
• Customer Support Records: 3 years after last interaction
• Marketing Consent: Until you withdraw consent or we cease marketing activities
• Website Analytics: 26 months for usage pattern analysis

After retention periods expire, data is securely deleted or anonymized.

9. International Data Transfers

Your data is primarily processed within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place, such as UK GDPR adequacy decisions or Standard Contractual Clauses, to maintain equivalent protection levels.

10. Children's Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately, and we will delete it.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on our website with a new effective date. Continued use of our services after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Bamboo Shop AS
Jomfrugata 20
Trondheim, Norway
VAT: NO 912690075
Email: [email protected]

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data protection rights have been violated.