Privacy Policy

1. Company Information and Scope

This Privacy Policy explains how Mishkatmann LLC collects, uses, discloses, retains, and protects personal information when an individual visits or uses our website, purchases products, contacts customer support, or otherwise interacts with our services.

Mishkatmann LLC is a limited liability company registered in the State of New Mexico, United States, and sells selected pet products through its website. Customers place orders and pay Mishkatmann LLC at the product price displayed on the website. Mishkatmann LLC then purchases the ordered products from independent suppliers and arranges for the suppliers or their fulfilment partners to handle physical preparation, packaging, dispatch, and direct delivery. We do not manufacture the products and do not ordinarily store, package, or physically dispatch customer orders.

For privacy-law purposes, Mishkatmann LLC generally determines the purposes and means of processing personal information collected through its website and in connection with customer purchases, subject to applicable law. Suppliers, payment providers, logistics companies, platforms, and other service providers may process personal information on our behalf or determine certain processing purposes independently, depending on their actual activities and applicable law. Contract labels alone do not determine those responsibilities.

This Policy applies to personal information processed in connection with our website and customer-facing services. It does not govern a third party’s independent processing under that third party’s own privacy notice.

2. Categories of Personal Information

Depending on the service used and the transaction, we may process the following categories:

• Identity and contact information: name, email address, telephone number, and other contact details supplied by the customer.
• Delivery and order information: recipient name, shipping address, delivery instructions, products selected or purchased, order number, order date, order status, and delivery or tracking information.
• Payment and transaction information: payment status, transaction reference, payment method type, authorisation or refund status, and limited payment-related information supplied by the payment provider. We do not intend to store full payment-card numbers or card security codes on our own systems; payment-card processing is handled by the payment provider. The currency, order amount, payment status and transaction reference may also be processed for order administration, refunds, reconciliation and dispute handling.
• Customer-service information: enquiries, complaints, return or refund requests, correspondence, and information supplied to investigate an order issue.
• Device and technical information: IP address, browser and device characteristics, timestamps, security events, log information, and cookie or similar-technology identifiers, to the extent collected by the website or its service providers.
• Preference and marketing information: communication preferences, consent records, and unsubscribe or opt-out status, if promotional communications or preference tools are used.

We do not intentionally request sensitive personal information for ordinary pet-product purchases. Please do not send payment-card details, passwords, or other sensitive information through ordinary email.

Payments are processed by the payment service provider presented at checkout. When a customer enters payment-card details, those details are transmitted through the payment provider’s checkout interface or secure payment fields. Mishkatmann LLC does not ask customers to send card numbers or card security codes by email or support message and does not intend to store full card numbers or card security codes on its own systems. The payment provider may process payment data under its own privacy notice and security obligations.

3. Sources of Personal Information

We collect information directly from customers when they browse the website, view product listings, enter checkout details, place and pay for an order, submit a form, contact support, or otherwise communicate with us. This may include the product selected, the displayed price and amount paid, order status, and information needed to purchase the product from a supplier and arrange direct delivery.

We may also receive relevant information from payment providers, website and e-commerce platform providers, independent suppliers, fulfilment partners, carriers, fraud-prevention services, and other service providers. Such information may be used to confirm payment status, coordinate delivery, investigate an order issue, maintain security, or prevent misuse.

Technical information may be collected automatically through the website and its service providers, including IP address, browser and device information, timestamps, security logs and cookie or similar-technology identifiers. The website cookie-preference interface identifies the following categories: Necessary (required for core website functions and always active); Functional (to support functions such as social sharing, feedback or connected tools); Analytical (to understand visits, interactions, traffic sources and website performance); and Advertisement (to support advertising or measure campaign effectiveness). The preference interface may show “None” for a category when no individual cookie is currently listed in that category. We do not represent that a particular third-party cookie is active unless it is actually deployed.

4. Purposes and Legal Grounds for Processing

We process personal information only for purposes that are relevant to our services and permitted by applicable law. Depending on the context, those purposes include:

• Receiving, validating, administering, and completing customer purchases, including recording the product price displayed at the time of order and the amount paid.
• Providing the minimum necessary recipient, address, contact, product, and order details to the relevant supplier, fulfilment partner, or carrier so Mishkatmann can purchase the product and arrange direct dispatch and delivery.
• Processing payments, refunds, chargebacks, and payment-related enquiries through payment providers.
• Sending order confirmations, service messages, delivery updates, and responses to customer enquiries.
• Investigating damaged, defective, incorrect, missing, delayed, or undelivered orders and administering appropriate resolutions.
• Maintaining accounting, tax, transaction, audit, and other records required by law.
• Protecting the website and services, detecting fraud or misuse, resolving disputes, enforcing contractual terms, and protecting legal rights.
• Maintaining, troubleshooting, evaluating, and improving website functionality and customer experience where permitted.
• Complying with applicable legal, regulatory, customs, court, and lawful-authority requirements.

Where EU GDPR or UK GDPR applies, we identify and document an appropriate lawful basis for each processing activity. Depending on the activity, this may be: (a) performance of a contract or steps requested before entering a contract; (b) compliance with a legal obligation; (c) legitimate interests, where those interests are not overridden by the individual’s rights and interests; or (d) consent, where consent is the appropriate legal basis. Consent may be withdrawn at any time, without affecting the lawfulness of processing before withdrawal.

A general reference to a lawful basis in this Policy does not replace the company’s obligation to determine and record the correct basis for each actual processing activity. We will not use personal information for a materially incompatible new purpose unless permitted by law and after providing any required notice or obtaining any required consent.

5. Disclosure and Categories of Recipients

We disclose personal information only to the extent reasonably necessary for the purposes described in this Policy, subject to applicable law. Recipient categories may include:

• Independent suppliers and fulfilment partners: product and order details, and the customer’s name, delivery address, telephone number, email address, and relevant delivery instructions where needed for Mishkatmann to purchase the product and arrange direct fulfilment.
• Carriers and delivery providers: recipient, address, contact, parcel, and tracking information needed to deliver an order or investigate a delivery issue.
• Payment providers: information required to authorise and process payments, administer refunds or disputes, and support fraud-prevention measures. Payment providers may separately determine purposes and means for some of their processing.
• Website, e-commerce, hosting, communications, security, analytics, and technical providers: information required to operate, maintain, secure, or support the website and business systems.
• Professional advisers, auditors, insurers, regulators, courts, law-enforcement bodies, and other authorities: where disclosure is required by law or reasonably necessary to establish, exercise, or defend legal claims.
• A successor or transaction party: where reasonably necessary in connection with a proposed or completed merger, restructuring, financing, sale, or transfer of all or part of the business, subject to applicable confidentiality and privacy requirements.

We will take reasonable steps, as appropriate to the relationship and applicable law, to require service providers handling information on our behalf to protect it, use it only for authorised purposes, and provide appropriate assistance with privacy obligations.

6. Sale, Sharing, Targeted Advertising and Opt-Out Rights

Some privacy laws use broad definitions of “sale,” “sharing,” or “targeted advertising” that may cover certain disclosures even where no money is paid for the information. The legal character of a disclosure depends on the actual technologies, purposes, recipients, and applicable law.

Mishkatmann LLC does not sell personal information for money. Functional, analytical or advertising technologies will be used only where they are actually enabled and, where required by applicable law, after the customer has given valid consent. The cookie-preference interface provides options to Accept All, Reject All or Save Preferences. Necessary technologies remain active because they are required for core website functions. Customers can use the preference interface to change or withdraw optional-cookie consent; withdrawal does not affect processing that occurred before withdrawal. We will honour any additional opt-out rights required by applicable privacy law.

Where a relevant US state privacy law applies, eligible residents may have rights to opt out of certain sales, sharing, or targeted-advertising processing and may have rights concerning recognised universal opt-out preference signals. We will honour applicable requests and signals in accordance with the law that applies to the individual and the company.

7. International Processing and Cross-Border Transfers

Because Mishkatmann serves customers internationally and coordinates orders with suppliers and service providers that may operate in different countries, personal information may be transferred to, accessed from, or processed outside the country where the customer is located.

For a product purchased by Mishkatmann from a supplier in China or another country and shipped directly to the customer, the information shared may include the customer’s name, delivery address, telephone number, email address, and product and order details necessary for dispatch and customer support. We do not provide full payment-card numbers or card security codes to suppliers for ordinary order fulfilment.

Where EU GDPR or UK GDPR restricts a transfer to a country outside the relevant transfer area, Mishkatmann will use a permitted transfer route where required, such as an applicable adequacy decision, approved standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum, or another lawful mechanism. Transfer assessments and supplementary measures will be completed where legally required. The publication of this Policy does not itself establish that a particular transfer contract or safeguard is in place.

Where another applicable law imposes conditions on overseas disclosures or transfers, we will apply the required conditions, notices, consents, assessments, or contractual safeguards. The countries and recipients actually involved must be documented from the supplier and service-provider records; a broad reference to “international processing” is not a substitute for that inventory.

8. Cookies and Similar Technologies

The website may use cookies, pixels, local storage or similar technologies for essential website operation, security, checkout and cart functionality, remembering preferences, performance measurement or advertising, but only to the extent those technologies are actually enabled. The cookie-preference interface groups optional technologies into Functional, Analytical and Advertisement categories and allows customers to accept all, reject all or save their preferences.

Necessary cookies and similar technologies may operate without consent where permitted by law because they support core website functions, security, cart and checkout operation. Functional, Analytical and Advertisement technologies are optional and will remain inactive until consent is obtained wherever applicable law requires prior consent. Customers may select Accept All, Reject All or Save Preferences and may later change or withdraw optional-cookie consent through the cookie-preference controls. Browser settings may also allow cookie controls, although disabling necessary technologies may affect website functionality.

The cookie-preference interface may display individual cookie names, providers and expiry periods where those details are detected. The cookie information available for this revision identifies the four preference categories above but does not identify individual cookie names, providers or expiry periods. We therefore do not invent or list individual cookies in this Policy. If a specific cookie or tracking technology is activated, its name, provider, purpose, category and duration should be disclosed in the preference interface or a linked cookie schedule, and this Policy should be updated if the technology materially changes.

9. Retention and Deletion

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including order administration, fulfilment, customer support, returns and refunds, security, dispute resolution, and legal or accounting obligations.

We determine retention periods by record category, purpose and applicable jurisdiction. Order and transaction records are retained for the accounting, tax, payment-dispute and limitation periods that apply to the business and transaction. Customer-support and complaint records are retained for as long as reasonably necessary to resolve the matter and address follow-up or legal claims. Technical and security logs are retained for a period proportionate to their security purpose. Backup copies may remain for a limited period under our backup and deletion procedures. We do not retain information longer than reasonably necessary unless a legal obligation or claim requires it.

When information is no longer required, we will delete it, anonymise it, or securely dispose of it where reasonably practicable, subject to legal holds, statutory retention duties, and technically necessary backup cycles. A specific retention schedule must be maintained internally and applied consistently.

10. Information Security and Personal-Data Incidents

We will maintain technical and organisational safeguards appropriate to the nature, volume, context, and risks of the personal information processed. Depending on the systems and service providers used, safeguards may include role-based access, strong authentication, secure transmission, restricted administrative access, service-provider due diligence, system updates, backup controls, and incident-response procedures.

No internet transmission or storage system can be guaranteed to be completely secure. If we become aware of a suspected personal-data incident, we will assess and contain it, preserve relevant evidence, document the response, and notify affected individuals and regulators where and when required by applicable law. Where EU GDPR applies, a reportable breach must be notified to the competent supervisory authority without undue delay and, where feasible, within 72 hours after awareness, unless the statutory exception applies.

11. Individual Privacy Rights

Depending on the applicable law and subject to its conditions and exceptions, an individual may be entitled to:

• Request confirmation of whether we process their personal information and obtain access to it.
• Request correction or completion of inaccurate or incomplete information.
• Request deletion or erasure of personal information.
• Request restriction of, or object to, certain processing.
• Request a portable copy of information in a legally prescribed format.
• Withdraw consent where processing is based on consent.
• Opt out of certain sale, sharing, targeted-advertising, or profiling activities where such rights apply.
• Request review or appeal of a decision concerning a privacy-rights request where required by law.
• Lodge a complaint with the competent privacy or data-protection regulator.

Rights are not absolute. We may need to retain or continue processing information where a legal exception applies, including to comply with law, complete a transaction, protect security, or establish, exercise, or defend legal claims. We will explain any refusal or limitation where required.

To submit a request, contact us using the details in Section 17 and include “Privacy Request” in the subject line. We may request information reasonably necessary to verify identity or authority. An authorised agent may submit a request where permitted by law and after any required verification. We will respond within the period prescribed by applicable law. Where the law provides an appeal right, we will explain how to submit an appeal and how to contact the relevant regulator if the appeal is unsuccessful.

12. Jurisdiction-Specific Legal Framework

The following is a high-level description of legal frameworks that may apply depending on the individual’s location and Mishkatmann’s activities. It is not a claim that all listed laws apply to every transaction.

12.1 United States

US privacy requirements include federal laws and a growing body of state comprehensive privacy statutes. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, and other state laws may grant eligible residents rights to access, correct, delete, obtain a portable copy, and opt out of certain sale, sharing, targeted-advertising, or profiling activities. Applicability depends on statutory thresholds, territorial scope, exemptions, and the company’s actual processing. State laws may also require specific notices, response procedures, appeals, risk assessments, or recognition of universal opt-out signals. We will provide those rights and mechanisms where the relevant law applies.

The Federal Trade Commission Act may prohibit unfair or deceptive privacy and security practices. The Children’s Online Privacy Protection Act and its implementing rule may apply to covered online services collecting personal information from children under 13. Our website is intended for adult purchasers and is not directed to children.

12.2 European Union and European Economic Area

Where the EU GDPR applies, we will process personal data in accordance with its principles and applicable national law, including transparency, purpose limitation, data minimisation, accuracy, storage limitation, security, and accountability. Eligible individuals may exercise the rights described in Section 11 and may complain to their competent supervisory authority. Where a non-EU controller is subject to the GDPR, an EU representative may be required unless a statutory exception applies. Where required, Mishkatmann will appoint and identify that representative in the relevant privacy information.

12.3 United Kingdom

Where UK GDPR, the Data Protection Act 2018, as amended, and the Privacy and Electronic Communications Regulations apply, we will comply with the relevant transparency, lawful-basis, individual-rights, security, direct-marketing, cookie, and international-transfer requirements. A UK representative may be required for a non-UK controller subject to the UK GDPR unless an exception applies. Where required, the representative’s details will be published in the relevant privacy information.

12.4 Australia

The Privacy Act 1988 (Cth) and Australian Privacy Principles may apply if Mishkatmann is an APP entity under the statutory tests and no relevant exemption applies. If applicable, the company will maintain an APP-compliant privacy policy, manage access and correction requests, handle privacy complaints, protect personal information, and address overseas disclosures under the APPs. The small-business exemption and its exceptions must be assessed against actual turnover and activities rather than assumed.

12.5 China

China’s Personal Information Protection Law may apply to processing of personal information of individuals located in China, including certain processing by organisations outside China when offering products or services to individuals in China or analysing their behaviour. Where applicable, we will meet the relevant notice, lawful-processing, individual-rights, security, and cross-border transfer requirements. Requirements governing information exported from China must be distinguished from the separate question of information originating elsewhere and being disclosed to a China-based supplier.

12.6 Singapore and Japan

Where applicable, Singapore’s Personal Data Protection Act 2012 and Japan’s Act on the Protection of Personal Information may impose requirements concerning notification, consent or other permitted grounds, access and correction, security, retention, and overseas disclosures. The applicable statutory scope and any country-specific transfer conditions will be assessed for the relevant activity.

12.7 India

India’s Digital Personal Data Protection Act 2023 and the Digital Personal Data Protection Rules, 2025 have phased commencement provisions. We will apply the provisions that are in force and applicable to the relevant processing, and will update this Policy and our procedures as additional provisions take effect. This wording does not represent that every substantive provision or right under the framework is already in force.

12.8 Bangladesh

Bangladesh privacy and data-protection requirements in force from time to time may apply to processing connected with Bangladesh, including the company’s operations and relevant data flows. We will apply the requirements that are legally effective and applicable to the processing, including any required notices, lawful-processing conditions, security measures, individual rights and rules governing disclosures or cross-border transfers.

12.9 Other Asia-Pacific Markets

There is no single privacy statute governing the entire Asia-Pacific region. Depending on the destination and the company’s activities, additional national or subnational requirements may apply, including in Malaysia, Indonesia, the Philippines, Thailand, Vietnam, and other markets. We will assess the law of each market in which we actively target customers or process personal information in a manner that brings the activity within that law.

13. Children’s Privacy

Our website is intended for adults purchasing products for pets and is not directed to children. We do not knowingly seek to collect personal information directly from children where doing so is prohibited by applicable law. If we become aware that personal information has been collected from a child in circumstances requiring parental consent or deletion, we will take the steps required by applicable law.

14. Marketing Communications

Operational messages concerning an order, payment, delivery, security issue, or customer-support matter are service communications and may be sent where necessary to administer the customer’s transaction.

Promotional marketing will be sent only where permitted by applicable law and after obtaining consent where required. Each promotional electronic message will include an effective unsubscribe method where required. An opt-out from promotional marketing will not prevent essential service communications.

15. Automated Processing and Profiling

Payment and security providers may use automated tools to assess payment authorisation, transaction risk, or suspected fraud. Mishkatmann may confirm with the providers’ actual use of automated decision-making and whether any decision is made solely by automated means and produces legal or similarly significant effects.

Where applicable law requires information about automated decision-making, meaningful information about the logic involved, the significance and envisaged consequences, or rights to obtain human intervention, express a view, or contest a decision, we will provide that information and those rights. If automated systems are used for a materially different purpose, this Policy will be updated before or when required by law.

16. Third-Party Services and External Links

Our website may contain links to, or integrations with, third-party websites and services, including payment, delivery, social-media, analytics, and customer-support providers. Their independent processing is governed by their own privacy notices and terms. We encourage customers to review those notices before providing information directly to a third party.

17. Contact and Privacy Requests

For privacy questions, requests, or complaints concerning Mishkatmann’s handling of personal information, contact:

Mishkatmann LLC
Email: support.customer@mishkatmann.llc
Customer care: +1 877 367 0139
Website: https://mishkatmann.llc
Registered in: State of New Mexico, United States
Registered address: 1209 MOUNTAIN ROAD, PL NE STE R, ALBUQUERQUE, NM 87110, United States

Please use the subject line “Privacy Request.” Do not send payment-card numbers, card security codes, passwords, or unnecessary sensitive information by email.

Customer support and privacy contact: support.customer@mishkatmann.llc | +1 877 367 0139. Written correspondence may also be sent to the registered business address stated above.

18. Changes to this Policy

We may revise this Policy to reflect changes in our services, website technologies, suppliers, fulfilment arrangements, data practices, or applicable law. The current version will be published with its revision date. Where required by law, we will provide additional notice or obtain consent before a material change takes effect. A revised Policy will not retrospectively remove rights or protections attached to earlier processing where doing so would be unlawful.