Privacy Policy

Last updated: October 4, 2026

This Privacy Policy explains how Halloween Day's collects, uses and protects your personal data when you visit our store or buy from us.

1. Who is responsible

The controller of your personal data is Orryx LLC, 30 N Gould St, Sheridan, WY 82801, United States. Email: officialorryx@gmail.com.

2. What data we collect

Contact and order details: name, email, phone number (if given), billing and shipping address, the items you order, and any charity donation or Shipping Protection you add.
Payment details: payments are processed by our checkout and payment providers. We don't see or store your full card number.
Communications: what you send us by email, for example about returns or questions.
Device and usage data: IP address, browser and device type, pages viewed, items added to your cart, and similar information collected through cookies and similar technologies.

3. Why we use your data, and the legal basis

To process and deliver your order, handle returns and send order emails. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
To meet legal obligations, such as keeping tax and accounting records. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
To keep the store secure and prevent fraud, and to make the store work properly. Legal basis: our legitimate interests (Art. 6(1)(f) GDPR).
To email charity donors after Halloween to confirm the donation was made. Legal basis: performance of what we promised when you donated (Art. 6(1)(b) GDPR).
Marketing emails and analytics or advertising cookies, only if you've agreed. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

4. Who we share your data with

We only share data where it's needed for the purposes above:

Shopify, which hosts our store, checkout and order system. Learn more in the Shopify Privacy Policy.
Payment providers shown at checkout, to process your payment.
Our fulfilment partner and shipping carriers, who receive your name, address and order contents so they can ship your parcel.
Authorities, where we're legally required to.

We don't sell your personal data. We don't share donor details with the charity.

5. International transfers

Some of these providers, and Orryx LLC itself, are located outside the European Economic Area, for example in the United States. Where data is transferred outside the EEA, it's protected by an adequacy decision (such as the EU–US Data Privacy Framework, where the recipient is certified) or by the European Commission's Standard Contractual Clauses.

6. Cookies

We use cookies that are needed for the store to work, such as keeping items in your cart. With your consent, we and our partners may also use analytics and marketing cookies. You can accept or decline these in the cookie banner and change your choice at any time.

7. How long we keep your data

We keep order data for as long as needed to fulfil your order and handle returns and warranty claims, and then for as long as tax and commercial law requires (usually up to 10 years for accounting records). Marketing data is kept until you unsubscribe or withdraw consent.

8. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data deleted, where we no longer need it or have no legal basis to keep it;
restrict how we use your data;
receive your data in a portable format;
object to processing based on our legitimate interests; and
withdraw your consent at any time, without affecting processing before the withdrawal.

To use any of these rights, email us at officialorryx@gmail.com. You also have the right to complain to a data protection supervisory authority, for example in the EU country where you live. A list is available on the European Data Protection Board website.