Privacy policy
📅 Effective Date: 1 January 2026 (Updated)
Being Gurkha operates this store and website, including related information, content, features, tools, products and services (the “Services”). Our store runs on Shopify, which powers the ecommerce platform behind the Services. This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you visit, interact with, purchase from, or otherwise use the Services.
If this Privacy Policy conflicts with our Terms of Service on matters of personal information, this Privacy Policy controls.
By using or accessing the Services, you acknowledge you have read and understood this Privacy Policy.
🧭 SECTION 1 – SCOPE & WHO WE ARE
Being Gurkha (referred to as “Being Gurkha”, “we”, “us”, “our”) is the data controller for personal information described in this Policy (except where Shopify acts as an independent controller for its own described purposes).
Registered contact:
Being Gurkha
27 Greenview Terrace, Palmview, QLD 4553, Australia
Email: info@beinggurkha.com
This Policy applies to personal information collected online (our website/store) and offline (e.g., customer support communications), and to information collected through Shopify-powered services used in our store.
🧾 SECTION 2 – DEFINITIONS
-
“Personal information”: information that identifies, relates to, describes, or can reasonably be linked to an individual.
-
“Processing”: any operation performed on personal information (collection, storage, use, disclosure, etc.).
-
“Controller / Processor”: the organization deciding purposes and means of processing / processing on behalf of a controller.
-
“Sensitive information”: certain categories defined by law (e.g., precise geolocation, health data) where applicable.
🧰 SECTION 3 – CATEGORIES OF PERSONAL INFORMATION WE COLLECT/PROCESS
Depending on how you interact with the Services and local law, we may collect or process the following categories (including inferences):
-
Contact details: name, email, phone, billing/shipping address.
-
Account data: username, password, security Q&A, user preferences.
-
Transaction & order data: items viewed/added/purchased/returned; order history; cart/wishlist activity.
-
Payment & financial data: payment card type, last 4 digits/token, payment confirmation, transaction details (card numbers are handled by compliant processors—see Section 10).
-
Communications: emails, messages, customer support tickets, and your responses.
-
Device & technical data: IP address, device/browser type, OS, network identifiers, session IDs.
-
Usage & analytics data: pages viewed, features used, timestamps, referral URLs, clickstream; cookie IDs and similar identifiers.
-
Marketing preferences: opt-ins/opt-outs, unsubscribes, channel choices.
-
Inferences: preferences or interests derived from the above data to personalize your experience.
De-identified or aggregated data is not treated as personal information where it cannot reasonably identify you.
🔎 SECTION 4 – SOURCES OF PERSONAL INFORMATION
-
Directly from you: account creation, checkout, returns/exchanges, customer support, forms, reviews.
-
Automatically: via cookies, pixels, SDKs, and similar technologies when you access the Services.
-
Service providers: payment processing, hosting, fulfillment, analytics, advertising, anti-fraud, and support tools.
-
Business/marketing partners: where lawful and consistent with your choices.
-
Social media / integrations: when you connect or interact with widgets or single sign-on (SSO).
🎯 SECTION 5 – PURPOSES & LEGAL BASES FOR USING PERSONAL INFORMATION
We process personal information for the purposes below. Where the GDPR/UK GDPR applies, our legal bases include contract, legitimate interests, consent, and legal obligations.
-
Provide, tailor, and improve the Services (contract; legitimate interests)
-
Process orders and payments; ship; manage returns/exchanges; maintain your account; remember preferences; personalize browsing; recommend products; maintain and improve performance and UX.
-
-
Customer communications & support (contract; legitimate interests; consent where required)
-
Service notices, order updates, password resets, and responding to inquiries.
-
-
Marketing & advertising (consent where required; legitimate interests)
-
Send emails/SMS/postal promotions; run on-site and off-site ads; measure and optimize campaigns; build audiences from first-party data.
-
-
Security, fraud prevention & integrity (legitimate interests; legal obligations)
-
Authenticate accounts; detect/prevent fraud, abuse, or malicious activity; ensure platform security and integrity.
-
-
Compliance & legal (legal obligations; legitimate interests)
-
Comply with tax/audit/regulatory obligations; respond to lawful requests; enforce our Terms; defend legal claims.
-
🍪 SECTION 6 – COOKIES, PIXELS & SIMILAR TECHNOLOGIES
We and our partners use cookies, pixels, tags, SDKs, and similar tools to:
-
enable core site functionality (e.g., cart, checkout),
-
remember preferences,
-
analyze usage,
-
measure and personalize advertising.
Choices: You can manage cookies via your browser settings and any site-level cookie banners we provide. Note: disabling certain cookies may impair core features (cart/checkout, sign-in).
Global Privacy Control (GPC): If your browser sends a GPC signal, we will treat it as an opt-out of certain targeted advertising “sharing/sale” where required by law and to the extent we can recognize the device/account.
🔄 SECTION 7 – DISCLOSURE OF PERSONAL INFORMATION
We may disclose personal information in the following circumstances:
-
Shopify & service providers: platform hosting, checkout, payments, fraud prevention, fulfillment/shipping, CRM/support, cloud storage, analytics, and marketing technology. They process data under contracts consistent with this Policy.
-
Business/marketing partners: to deliver co-branded promotions, personalize ads, measure performance—subject to their privacy notices and your choices/opt-outs.
-
At your direction/with your consent: e.g., delivery partners, social media integrations, referral programs.
-
Affiliates & corporate group: for operations consistent with this Policy.
-
Legal/compliance: to comply with law, governmental or court requests; to protect rights, safety, and security; to enforce our Terms or investigate potential violations.
-
Business transactions: in connection with a merger, acquisition, financing, or sale of assets (your data may transfer as a business asset subject to this Policy).
We do not disclose sensitive information for purposes that would require your consent under applicable laws without obtaining it.
🛍️ SECTION 8 – RELATIONSHIP WITH SHOPIFY
The Services are hosted by Shopify. Shopify also processes personal information about your interactions with our Store (and other merchants using Shopify) to provide, secure, and improve platform features (including certain enhanced advertising or analytics features).
For those platform-level purposes, Shopify may act as an independent controller and is responsible for handling related privacy rights requests regarding its own processing.
Learn more and exercise Shopify-related rights via Shopify’s Consumer Privacy Policy and Privacy Portal (see Shopify’s official website).
🧒 SECTION 9 – CHILDREN’S DATA
The Services are not intended for children and we do not knowingly collect personal information from individuals under the age of majority in your jurisdiction. If you are a parent/guardian and believe a child provided personal information, contact us (Section 18) to request deletion.
As of the effective date, we do not have actual knowledge that we “sell” or “share” personal information of individuals under 16 years of age (as defined by applicable law).
🔐 SECTION 10 – SECURITY MEASURES
We implement administrative, technical, and physical safeguards designed to protect personal information (e.g., access controls, encryption in transit, network monitoring). No method is 100% secure, and transmission over the internet may carry risk.
Payments: Card data is processed by PCI-compliant payment processors (e.g., Shopify Payments). We do not store raw card numbers on our systems.
🗄️ SECTION 11 – RETENTION
We retain personal information for as long as necessary to:
-
provide the Services and fulfill transactions,
-
support your account/preferences,
-
comply with legal, tax, auditing, and regulatory obligations,
-
resolve disputes and enforce agreements.
When no longer needed, we take steps to delete, de-identify, or aggregate the data.
⚖️ SECTION 12 – YOUR PRIVACY RIGHTS & CHOICES
Your rights vary by region and may include:
-
Access/Know: request details about the personal information we hold about you.
-
Correction: request correction of inaccurate or incomplete data.
-
Deletion: request deletion of your personal information (subject to lawful exceptions).
-
Portability: request a copy of certain data and/or transfer to another provider.
-
Opt-out of targeted ads “sale/share”: in some regions, direct us not to “sell” or “share” personal information or to stop targeted advertising processing; GPC signals honored where required.
-
Manage marketing: unsubscribe via email footer/Account settings; we may still send transactional/operational emails.
-
Object/Restrict (EEA/UK): object to or request restriction of processing where applicable.
-
Withdraw consent (EEA/UK): where processing relies on consent, you may withdraw it at any time (without affecting prior lawful processing).
How to exercise:
-
Email: info@beinggurkha.com
-
If your request concerns Shopify’s independent processing, please use Shopify’s Privacy Portal.
We may verify your identity (and/or authorized agent authority) before acting on requests. We will respond within timeframes required by law. We do not discriminate for exercising rights.
🌍 SECTION 13 – INTERNATIONAL TRANSFERS
We may transfer, store, and process personal information outside your country (including to the EU/UK/US/Canada and other locations where Shopify and our providers operate).
Where required (e.g., EEA/UK), we rely on recognized transfer mechanisms such as the European Commission’s Standard Contractual Clauses or UK equivalents, and implement supplementary safeguards where appropriate.
🧭 SECTION 14 – REGION-SPECIFIC NOTICES
Australia (Privacy Act & APPs): You have rights to access and correct your personal information and to lodge complaints with the Office of the Australian Information Commissioner (OAIC). We handle complaints per Section 17.
EEA/UK (GDPR/UK GDPR):
-
Controller: Being Gurkha (see Section 1).
-
Legal bases: contract, legitimate interests (e.g., service improvement, security/fraud), consent (marketing/cookies where required), legal obligation.
-
Supervisory authority: you may lodge a complaint with your local DPA; contact details available via the European Data Protection Board or ICO (UK).
US State Privacy Laws (where applicable): You may have “sale/share/targeted advertising” opt-out rights and access/correct/delete/portability rights. We honor GPC signals where legally required.
📨 SECTION 15 – MARKETING CHOICES
-
Email/SMS/postal marketing: unsubscribe using the link in our messages or contact us.
-
Ads preferences: adjust cookie settings, device ad settings, or GPC; note that opting out may not stop all ads—only targeted ones.
-
Account settings (if available): manage preferences directly in your profile.
🧩 SECTION 16 – THIRD-PARTY WEBSITES & SOCIAL FEATURES
The Services may link to or embed third-party sites/features. Their privacy practices are governed by their own policies. We are not responsible for the accuracy, security, or privacy of third-party properties. Content you post publicly (including on social platforms connected to our Services) may be viewable by others.
🧨 SECTION 17 – COMPLAINTS & DISPUTE RESOLUTION
If you have concerns about our handling of personal information, contact us first (Section 18). We will investigate and respond consistent with applicable law.
You may also have the right to appeal our decision or lodge a complaint with your local authority (e.g., OAIC in Australia, or your EU/UK supervisory authority).
✏️ SECTION 18 – CONTACT US
Being Gurkha
Address: 27 Greenview Terrace, Palmview, QLD 4553, Australia
Email: info@beinggurkha.com
For Shopify’s independent processing and rights requests, please consult Shopify’s Consumer Privacy Policy and Privacy Portal on Shopify’s official site.
🔐 Privacy Policy for "Try On" Feature
📅 Effective Date: 1 January 2026
This Privacy Policy explains how data is handled when the Fitting Room virtual try-on feature is used on a Shopify store.
Fitting Room is a Shopify theme app extension and Instagram integration that provides virtual try-on functionality and AI-powered customer support tools for merchants.
Being Gurkha uses Fitting Room to offer customers a virtual try-on experience.
🏪 Merchant & Platform Roles
-
🧩 Fitting Room
Operates the virtual try-on technology, image processing, temporary storage, and automated support features. -
🛍️ Being Gurkha
Uses Fitting Room to provide the try-on feature and does not store, retain, or reuse any original try-on photos uploaded by customers.
All try-on image handling is performed by Fitting Room in accordance with this Privacy Policy.
📦 Information Collected
Fitting Room processes only the minimum data required to operate the service:
📸 User-Uploaded Images
Photos voluntarily uploaded by shoppers for the sole purpose of generating a virtual try-on preview.
👕 Product Images
Clothing product images retrieved directly from the merchant’s Shopify product pages.
🏬 Store Information
Basic store details such as store name, store email address, and store domain, required for app functionality.
🧾 Order & Customer Data
Limited order-related data including order ID, order status, customer name, email address, and purchased items, accessed only to support try-on experiences, automated customer support, and analytics.
📊 Usage Data
Anonymous, non-identifiable data used for performance monitoring, feature usage tracking, and service improvement.
⚙️ How the Information Is Used
Data processed through Fitting Room is used to:
-
🪞 Generate real-time virtual try-on previews
-
💬 Deliver a lightweight try-on widget and Instagram DM experience
-
🤖 Power AI-driven customer support (such as answering order or product questions on behalf of merchants)
-
📈 Provide merchants with anonymized analytics and usage insights
-
🛠️ Maintain, secure, and troubleshoot the service
-
🚀 Improve features using anonymized usage data
🔒 Data Storage & Security
Fitting Room applies strict security and data minimization practices:
-
🔐 All data transmissions use industry-standard encryption
-
🗑️ User-uploaded images and product images are deleted immediately after each try-on session
-
🕒 Generated try-on images are stored temporarily and automatically purged at the end of each calendar month
-
🧠 Order and customer data is accessed only when required and not stored longer than necessary
-
🚫 Identifiable user, customer, or merchant data is never sold, rented, or shared
🔄 Data Sharing
-
❌ Personal or identifiable data is not shared with third parties
-
📉 Anonymized, aggregated metrics (e.g., try-on counts or conversion data) may be used for analytics
-
⚖️ Data may only be disclosed if required by law or legal process
🗃️ Data Retention
-
📷 User-uploaded images and clothing product images are deleted immediately after each try-on session
-
🖼️ Generated try-on images are retained temporarily and purged monthly
-
📁 Order and customer data is retained only as long as required for analytics or customer support
📨 Data deletion requests may be submitted to:
martin@fittingroomofficial.com
🧑⚖️ Your Rights
Users and merchants have the right to:
-
👁️ Request access to or correction of relevant data
-
🗑️ Request deletion of retained try-on or order-related data
-
🔕 Withdraw consent for data processing where applicable
Requests can be sent to martin@fittingroomofficial.com.
🔄 Policy Updates
This Privacy Policy may be updated periodically to reflect changes in legal requirements or service functionality. Updates take effect upon publication. Continued use of Fitting Room constitutes acceptance of the updated policy.