MULKWORKS — PRIVACY POLICY
Last updated: 16 October 2026
1. Introduction
Mulkworks respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, disclose and protect personal data when you visit our website, place an order, contact us or otherwise interact with our online store.
Mulkworks operates an online store selling car accessories through a dropshipping business model. Our website is hosted on Wix, and we accept payments through PayPal and card payment services.
We process personal data in accordance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, the General Data Protection Regulation (EU) 2016/679 (EU GDPR).
By using our website, you acknowledge that you have had the opportunity to read this Privacy Policy. Where consent is legally required, we will request it separately. Using our website does not, by itself, constitute consent to optional cookies or marketing.
2. Who Is Responsible for Your Personal Data?
Mulkworks is responsible for determining how and why your personal data is processed, subject to applicable data protection laws.
Business name: Mulkworks
Country of establishment: England, United Kingdom
Business address: [Insert your full business address]
Privacy contact email: sheriffaltshe@gmail.com
Website: [Insert your published Mulkworks website URL]
Please contact us using the email address above for questions about this Privacy Policy or to exercise your data protection rights.
As Mulkworks is established in the United Kingdom and offers goods or services to individuals in the European Union, we will assess whether Article 27 of the EU GDPR requires us to appoint an EU representative. If required, the representative’s contact details will be provided in this Privacy Policy.
3. Personal Data We Collect
Depending on how you interact with our store, we may collect the following categories of personal data.
3.1. Identity and contact information
This may include your name, email address, telephone number, billing address and delivery address.
3.2. Order and transaction information
When you purchase car accessories, we may collect information about the products you order, order numbers, purchase dates, order values, delivery preferences, shipping status, returns, refunds and customer service requests.
3.3. Payment information
Payments are processed through PayPal and/or the card payment provider available at checkout. We may receive transaction references, payment status, limited payment details, billing information and fraud-prevention information necessary to manage your order.
We do not intentionally store full payment card numbers or card security codes (CVV/CVC) on our own systems. Payment details are handled by the relevant payment service provider in accordance with its security and privacy practices.
3.4. Technical and usage information
When you visit our website, certain information may be collected automatically, including your IP address, browser type, device information, operating system, referring website, pages viewed, access times, approximate location derived from your IP address and interactions with our website.
The information collected depends on the Wix features, security tools, cookies and other integrations enabled on our website.
3.5. Communications and customer support
If you contact us, we may collect your name, email address, order details and the contents of your message or other information you choose to provide. We use this information to respond to enquiries and resolve issues.
3.6. Marketing preferences
If you subscribe to marketing communications, we may collect your email address, subscription status, consent records and preferences concerning promotional messages.
You can unsubscribe from marketing emails at any time using the unsubscribe link or by contacting us.
We do not intentionally request sensitive personal data unless it is necessary for a specific lawful purpose.
4. How We Collect Personal Data
We collect personal data through the following methods:
Directly from you: When you place an order, complete a form, subscribe to marketing communications or contact customer support.
Automatically: Through website functionality, server logs, security tools and, where permitted, cookies and similar technologies.
Through service providers: Such as Wix, PayPal, card payment processors, shipping providers and dropshipping suppliers, when they provide information needed to process orders, confirm payments or deliver products.
Through transaction and fraud-prevention services: Where necessary to verify payments, prevent fraudulent activity and protect our business and customers.
We aim to collect only the personal data reasonably necessary for the purposes described in this policy.
5. Why We Use Your Personal Data and Our Legal Bases
We process personal data only where a lawful basis under the applicable data protection law applies.
PurposeLegal basisProcessing orders, arranging delivery and managing purchasesPerformance of a contractHandling payments, refunds, returns and order enquiriesPerformance of a contractResponding to customer support requestsContract performance or legitimate interests, depending on the enquiryMaintaining accounting, tax and other legally required recordsCompliance with a legal obligationProtecting our website, preventing fraud and investigating misuseLegitimate interests, where appropriateMaintaining and improving website performanceLegitimate interests or consent, depending on the technology and applicable lawSending promotional emailsConsent or another lawful basis where expressly permitted by applicable lawUsing non-essential cookies and similar tracking technologiesConsent, where required by applicable lawEstablishing, exercising or defending legal claimsLegitimate interests or another applicable legal basis
Where we rely on legitimate interests, we consider those interests against your rights and freedoms. You may object to processing based on legitimate interests in accordance with applicable law.
Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
If you do not provide information necessary to complete a purchase, we may be unable to accept or fulfil your order.
6. Dropshipping, Suppliers and Order Fulfilment
Mulkworks uses a dropshipping model, which means that products may be shipped directly to you by an independent supplier, manufacturer, warehouse or fulfilment partner rather than from premises operated by Mulkworks.
To fulfil your order, we may share the information necessary for delivery and customer service with the relevant supplier or fulfilment partner. This may include:
Your name.
Your delivery address.
Your telephone number, where required by the carrier.
The products ordered and quantities.
Order references and delivery instructions.
Other information reasonably necessary to dispatch and deliver your purchase.
We aim to share only the information necessary to fulfil your order.
Where a supplier processes personal data on our behalf, we will put appropriate contractual data protection arrangements in place. Some suppliers may act as independent data controllers for particular activities and may have their own privacy obligations.
We do not authorise suppliers to use customer information for unrelated marketing purposes on our behalf.
7. Third-Party Service Providers
We use third-party providers to operate our online store and deliver our services. The providers involved depend on the services enabled on our website.
7.1. Wix
Our online store is hosted on Wix. Wix may process personal data to provide website hosting, online store functionality, order management, security, technical support and related services.
Wix may also use infrastructure partners and other service providers to deliver its services.
Wix privacy information: https://www.wix.com/about/privacy
7.2. PayPal
We accept payments through PayPal. When you choose PayPal at checkout, the information necessary to process the payment may be transmitted to PayPal.
PayPal may process personal data for payment processing, account management, fraud prevention, regulatory compliance and other purposes described in its privacy statement. Depending on the processing activity, PayPal may act as an independent data controller.
PayPal privacy information: https://www.paypal.com/privacy
7.3. Card payment processors
Card payments are handled by the payment processor configured for our Wix checkout. This provider may process payment details, transaction information, billing information and security-related data to authorise payments, prevent fraud, issue refunds and comply with legal requirements.
The specific card payment provider depends on our active checkout configuration. Its applicable privacy notice should be consulted for further details.
7.4. Shipping and logistics providers
We may share necessary delivery information with couriers, postal operators, tracking platforms and logistics partners so that products can be shipped, tracked and delivered.
7.5. Analytics, advertising and other website applications
If enabled, analytics tools, advertising platforms, customer communication services or other third-party applications may process certain website or customer data.
We will disclose such processing through appropriate notices and cookie controls where required. Non-essential tracking technologies will not be activated before consent where consent is required.
We do not sell customers’ personal data in exchange for money. We may share data with service providers as necessary to operate our business, subject to applicable legal requirements.
8. Cookies and Similar Technologies
Our website may use cookies, pixels, local storage and similar technologies to operate the store, maintain security, remember preferences and understand website usage.
Cookies are small files stored on your device when you visit a website.
8.1. Types of cookies
Strictly necessary cookies
These cookies are required for essential website functions, such as security, session management, shopping cart functionality and checkout. They cannot generally be disabled through our website without affecting essential features.
Functional cookies
These cookies remember choices such as preferences and settings. Where required by law, we will obtain your consent before placing non-essential functional cookies.
Analytics and performance cookies
If enabled, these cookies help us understand how visitors use our website and identify opportunities to improve its performance. They will be used only in accordance with applicable consent requirements.
Advertising and targeting cookies
If enabled, these technologies may be used to measure advertising effectiveness or deliver more relevant advertising. Where consent is required, they will be activated only after you have given consent.
8.2. Managing cookie preferences
Where required, our website will display a cookie consent banner allowing you to accept or reject non-essential cookies and manage your preferences.
You can change or withdraw your cookie consent through the cookie settings available on our website, where implemented. You can also manage cookies through your browser settings. Blocking certain cookies may affect website functionality.
Withdrawing cookie consent does not automatically delete information already collected before withdrawal.
8.3. Cookie details
The exact cookies and similar technologies used on our website depend on the Wix features and third-party applications we have enabled. Their names, providers, purposes and lifespans should be listed in our cookie settings or cookie notice after the live website has been checked.
We will not represent optional analytics or advertising cookies as active unless they are actually used on our website.
9. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, including fulfilling orders, providing customer support, meeting legal obligations and resolving disputes.
Our retention periods depend on the type of data and the applicable legal requirements.
Data categoryRetention approachOrder and transaction recordsFor the period required by applicable accounting, tax and commercial lawsCustomer contact and support recordsFor as long as needed to resolve enquiries and maintain relevant recordsDelivery and fulfilment informationFor as long as necessary to fulfil orders, manage returns and resolve delivery disputesPayment and fraud-prevention recordsAs required by payment providers, applicable law and legitimate fraud-prevention needsMarketing subscription dataUntil you unsubscribe or withdraw consent, subject to limited records needed to demonstrate compliance or maintain suppression listsCookie and consent recordsFor the period reasonably necessary to demonstrate consent choices and comply with applicable requirementsTechnical and security logsFor a period appropriate to security, troubleshooting and incident investigation needs
Where no specific retention period is prescribed by law, we determine an appropriate period based on the purpose of processing, the sensitivity of the data and the risk of retaining it.
When personal data is no longer needed, we will securely delete it, anonymise it or otherwise dispose of it appropriately, unless we are legally required to retain it.
A request for deletion may be subject to legal retention obligations or other lawful exceptions.
10. International Data Transfers
As Mulkworks is established in the United Kingdom and uses third-party services, personal data may be processed in the UK, the European Economic Area or other countries where Wix, payment processors, suppliers or logistics partners operate.
Some countries may not provide a level of data protection recognised as adequate under the applicable data protection regime.
Where personal data is transferred internationally, we will ensure that an appropriate transfer mechanism applies under the relevant law. Depending on the destination and circumstances, this may include:
An applicable adequacy decision or adequacy regulation.
Standard Contractual Clauses approved by the European Commission, where required under EU GDPR.
The UK International Data Transfer Agreement or UK Addendum to the European Commission's Standard Contractual Clauses, where required under UK GDPR.
Additional safeguards where necessary following an assessment of the transfer.
Another valid transfer mechanism or derogation permitted by applicable law, where appropriate.
We will take reasonable steps to ensure that transferred personal data receives an appropriate level of protection and that any required safeguards are implemented.
You may contact us at sheriffaltshe@gmail.com to request further information about relevant international transfers and the safeguards used, subject to applicable legal restrictions.
11. Data Security
We implement appropriate technical and organisational measures designed to protect personal data against accidental loss, destruction, alteration, unauthorised disclosure and unauthorised access.
Depending on the circumstances, these measures may include access controls, secure account management, platform security features, restricted access to customer information and the use of reputable payment service providers.
We take reasonable steps to select service providers that offer appropriate security and data protection measures.
However, no method of transmission over the internet or electronic storage can be guaranteed to be completely secure.
If a personal data breach occurs, we will assess the incident and notify the relevant supervisory authority and affected individuals where required by applicable law.
12. Your Rights Under Data Protection Law
Depending on the applicable law and circumstances, you may have the following rights concerning your personal data.
Right to be informed: To receive clear information about how your personal data is collected and used.
Right of access: To request confirmation of whether we process your personal data and obtain a copy of that data.
Right to rectification: To request correction of inaccurate or incomplete personal data.
Right to erasure: To request deletion of your personal data where the legal conditions are satisfied.
Right to restriction: To request that we restrict the processing of your personal data in certain circumstances.
Right to data portability: To receive certain personal data you have provided to us in a structured, commonly used and machine-readable format, and to request its transfer to another controller where the legal conditions apply.
Right to object: To object to processing based on legitimate interests on grounds relating to your particular situation. You have an unconditional right to object to processing for direct marketing purposes.
Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
Rights concerning automated decision-making: Where applicable, you may have rights relating to decisions based solely on automated processing that produce legal effects or similarly significant effects on you.
These rights are not absolute in every circumstance. For example, we may need to retain certain transaction records to comply with tax or accounting requirements, or refuse a request where a lawful exception applies.
12.1. How to exercise your rights
To exercise your rights, contact us at:
Email: sheriffaltshe@gmail.com
Subject: GDPR Data Request
Please describe your request and provide sufficient information for us to identify the relevant records. We may request reasonable additional information to verify your identity before disclosing or changing personal data.
We will respond without undue delay and, in general, within one month of receiving your request. Where permitted by applicable law, this period may be extended by up to two additional months for complex or numerous requests. We will inform you of any extension and the reasons for it within the initial one-month period.
Requests are generally handled free of charge. We may charge a reasonable fee or refuse to act on a request where applicable law permits this, such as for manifestly unfounded or excessive requests.
13. Right to Lodge a Complaint with a Supervisory Authority
If you believe that we have processed your personal data in violation of applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority.
13.1. United Kingdom
If you are in the United Kingdom, you may contact the Information Commissioner's Office (ICO):
Website: https://ico.org.uk/make-a-complaint/
The ICO is the UK's independent data protection regulator.
13.2. European Union
If the EU GDPR applies to our processing of your personal data, you may generally lodge a complaint with the data protection supervisory authority in the EU Member State where you habitually reside, where you work, or where the alleged infringement occurred, subject to applicable rules.
You can find the relevant national data protection authority through the European Data Protection Board's website:
https://www.edpb.europa.eu/about-edpb/about-edpb/members_en
You do not need to contact Mulkworks before lodging a complaint, although you may contact us first if you would like us to address your concern directly.
You may also have the right to seek an effective judicial remedy in accordance with applicable law.
14. Children's Privacy
Our online store is intended for individuals who are legally able to make purchases under the laws applicable to them. We do not knowingly collect personal data from children in circumstances where consent or other processing requirements applicable to children have not been satisfied.
If you believe that a child has provided personal data to us unlawfully, please contact us so that we can assess the matter and take appropriate action.
15. Direct Marketing
We may send promotional emails where we have obtained your consent or where another lawful basis and any applicable electronic marketing rules permit us to do so.
You may unsubscribe at any time by using the unsubscribe link in a marketing email or by contacting us at sheriffaltshe@gmail.com.
Even if you opt out of marketing, we may continue sending non-promotional communications necessary to process your order, provide customer support, manage a return or refund, or meet our legal obligations.
16. Links to Third-Party Websites
Our website may contain links to websites operated by third parties, including PayPal, payment providers, suppliers or shipping services.
We do not control the privacy practices of external websites. When you access those websites, their own privacy policies and terms may apply. We encourage you to review those policies before providing personal data.
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our business, website functionality, service providers or applicable legal requirements.
The latest version will be published on our website with an updated “Last updated” date. Where required by law, we will provide additional notice or seek consent for material changes affecting consent-based processing.
18. Contact Us
If you have questions about this Privacy Policy, how Mulkworks handles personal data or how to exercise your data protection rights, please contact us.
Mulkworks
Country of establishment: England, United Kingdom
Email: sheriffaltshe@gmail.com

We will review your enquiry and respond in accordance with applicable data protection law.