Established to solve real kitchen challenges, Zistir combines smart design with everyday functionality. Our products are built for those who love cooking and value simplicity, durability, and style.
Privacy Policy
Zoya Innovations – Data Protection Policy
1. About This Policy
1.1 Everyone has rights concerning the way their personal data is handled. During the course of its business activities, Zoya Innovations collects, stores, and processes personal data about customers, users, partners, suppliers, and all staff.
1.2 Zoya Innovations recognises that the lawful and correct treatment of personal data is essential to maintaining the trust of those we deal with and for the success of our operations.
1.3 All staff and associates are required to comply with this policy when processing personal data. Any breach may result in disciplinary or legal action.
1.4 This policy outlines our responsibilities under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018. It defines the conditions under which personal data is collected, processed, stored, and disclosed.
2. Who This Policy Applies To
This policy applies to all employees, contractors, temporary staff, consultants, agency workers, courier services, and any third parties who handle personal data on behalf of Zoya Innovations.
3. Responsibility for This Policy
3.1 Zoya Innovations' directors hold overall responsibility for data protection compliance.
3.2 Day-to-day management and implementation of this policy are delegated to the Data Protection Officer (DPO), Muhammad Khan.
3.3 Questions or suggestions regarding this policy should be directed to the DPO.
4. Definitions
Personal Data: Information relating to an identifiable individual.
Data Subject: A living individual about whom we hold personal data.
Data Controller: Zoya Innovations, which determines how and why personal data is processed.
Data Processor: Any third party processing data on behalf of Zoya Innovations.
Processing: Any operation performed on personal data (for example collection, use, storage, transfer).
Special Category Data: Sensitive data (for example health, religious beliefs, racial or ethnic origin).
5. Data Protection Principles
Under the UK GDPR, Zoya Innovations commits to ensuring that personal data is:
Lawful, fair, and transparent: Processed in a lawful, fair, and transparent manner.
Purpose-limited: Collected for specified, explicit, and legitimate purposes.
Data minimised: Adequate, relevant, and limited to what is necessary.
Accurate: Accurate and kept up to date.
Storage-limited: Not kept longer than necessary.
Secure: Processed securely.
Accountable: Handled with accountability and documented compliance.
6. Fair and Lawful Processing
We only process personal data when:
Consent: Given by the individual.
Contractual necessity: Required to fulfil a contract.
Legal obligation: Required to comply with laws.
Legitimate interests: Necessary for business interests.
Vital interests/legal claims: Required for vital interests or legal claims.
7. Purpose of Data Processing
Order fulfilment: Process and deliver customer orders.
Customer support: Provide service and assistance.
Marketplace management: Manage and deliver products via online marketplaces.
Payments: Process secure online payments via PayPal.
Marketing: Communicate promotional offers (with consent).
Compliance: Meet tax, legal, and contractual obligations.
8. Platforms and Data Collection Channels
Platforms: Company website (ecommerce), TikTok Shop, Amazon, eBay, Shopify.
Collection: Data may be collected directly or transferred securely via APIs for processing.
9. Data Storage
Security: Data is stored in encrypted, access-controlled cloud infrastructure compliant with UK GDPR and international standards.
Third-party data: We may receive data from analytics providers or advertising partners, in compliance with laws.
Shopify hosting: Shopify may collect and process data. See Shopify’s Privacy Policy for details.
Data sharing: Data may be shared with Shopify, trusted service providers, legal authorities, or transferred during business transactions, with safeguards in place.
10. Data Accuracy and Retention
Accuracy: Data is accurate and up to date at collection.
Review: Regularly updated as necessary.
Retention: Kept only as long as necessary (for example 6 years for transactional records).
11. Data Security
Measures: Encrypted cloud storage, secure PayPal payments (card data not stored), controlled access, device-level encryption, and secure record destruction.
Training: All staff are trained in safe data handling.
12. Data Subject Rights
Under UK GDPR, individuals have the right to:
Access: Request their personal data.
Rectification: Correct inaccurate or incomplete data.
Erasure: Request deletion of data.
Restriction: Limit processing of data.
Objection: Object to processing.
Portability: Request transfer of their data.
Consent withdrawal: Withdraw consent at any time.
Requests should be submitted to the DPO at: info@zoyainnovations.co.uk
13. Cookies and Tracking Technologies
Functionality: Enable core features such as shopping cart and login.
Analytics: Collect anonymised usage data.
Marketing: Support promotional campaigns.
Users can manage preferences via browser settings or our Cookie Policy [Insert Link].
14. International Transfers
Transfers: Only made to countries with adequate laws or covered by safeguards such as Standard Contractual Clauses (SCCs).
Compliance: All partners and providers must comply with UK GDPR.
15. Sharing and Disclosure of Data
Third parties: Data may be shared with PayPal, delivery services, Amazon, eBay, Shopify, TikTok, marketing providers (with consent), advisors, auditors, and regulators.
No selling: We never sell or lease personal data.
16. Subject Access Requests
Requests: Individuals may request access, correction, deletion, or data portability by emailing the DPO.
Response time: Within one calendar month in line with UK GDPR.
17. Data Breach Reporting
Reporting: Any suspected breach must be reported to the DPO immediately.
Response: We will investigate, contain, notify affected individuals if necessary, and report serious breaches to the ICO within 72 hours.
18. Changes to This Policy
This policy may be updated periodically. Updates will be posted on our website and, if appropriate, notified directly to data subjects.
19. Contact Information
Zoya Innovations
Company Registration Number: [15604184]
Email: admin@zoyainnovations.co.uk
Phone: +44 7429 144165
Data Protection Officer: Muhammad Khan