Privacy Policy

Saddleridge is a western and farmhouse home decor store operated by OUT WEST BOUTIQUE, LLC, a Florida Limited Liability Company, from 2710 Blanding Boulevard, Suite 8, Middleburg, Florida 32068, United States. In this policy “we”, “us” and “our” mean OUT WEST BOUTIQUE, LLC, and “you” means anyone who visits outwestboutique.shop, contacts us, or places an order.

We are the business responsible for the personal information described here. For California privacy law we act as a “business”; where the GDPR applies to a visitor in the EEA or UK, we act as a “controller”.

Information you give us

• —Order and delivery details — name, email address, phone number, shipping address, and the contents of your order.
• —Enquiry details — anything you type into the contact or room styling forms, including room dimensions, colours and free-text notes.
• —Marketing preferences — your email address if you choose to join the styling notes list, and whether you have unsubscribed.

Information collected automatically

• —Essential storage — your bag contents and your cookie choice, held in your own browser’s local storage.
• —Technical data — IP address, browser and device type, referring page and pages viewed, held in standard server logs.
• —Analytics data — aggregate page and traffic statistics, only if you accept analytics cookies.

Information we do not collect

We do not ask for and do not want your Social Security number, driver licence number, passport number, precise geolocation, biometric data, health data, racial or ethnic origin, religious beliefs, sexual orientation, union membership, or the contents of your private communications. We do not store full payment card numbers on our own servers at any point.

We do not collect, use, sell or share sensitive personal information as that term is defined by the California Privacy Rights Act, and we do not use personal information to infer characteristics about you. Because we do not collect it, the CPRA right to limit the use of sensitive personal information does not arise — but you may still contact us to confirm this in writing.

• —To take, pack, ship and track your order, and to contact you about it.
• —To meet our obligation under the FTC Mail Order Rule to notify you of a shipping delay and offer you the choice of a refund.
• —To handle returns, refunds and warranty questions.
• —To answer contact and room styling enquiries.
• —To send styling notes by email, only if you have asked for them.
• —To detect and prevent fraud, abuse and card testing.
• —To keep the records that tax and consumer protection law requires us to keep.
• —To improve the store using aggregate, non-identifying statistics.

Under US state privacy law we use your information for the disclosed business purposes above, which are compatible with the context in which you provided it.

If you are in the EEA or the UK, our lawful bases are: performance of a contract (fulfilling your order); legitimate interests (answering enquiries, preventing fraud, running the store); consent (marketing email and analytics cookies, which you can withdraw at any time); and legal obligation (tax and record keeping).

We share personal information only with service providers who need it to do a job for us, under contracts that stop them using it for their own purposes:

• —Our web hosting and content delivery provider, which processes server logs.
• —Our database and storage provider, which holds order and enquiry records.
• —Our email delivery provider, which sends order and enquiry emails.
• —Our payment provider, which processes card details directly — we never receive your full card number.
• —Our shipping carriers, which receive the name, address and phone number needed to deliver.
• —Professional advisers, and law enforcement or regulators where we are legally required to disclose.

If the business is sold or merged, customer records may transfer to the buyer. We would tell you before that happened and the buyer would remain bound by this policy.

Saddleridge does not sell personal information and does not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months, and we do not sell or share the personal information of any consumer we know to be under 16 years of age.

Because there is nothing to opt out of, there is no “Do Not Sell or Share” toggle that would do anything. If you would like written confirmation of this for your own records, email support@outwestboutique.shop and we will send it within 15 business days.

We honour the Global Privacy Control signal. If your browser sends GPC, we treat it as an instruction to opt out of any sale or sharing, and as an instruction to disable analytics cookies.

California (CCPA/CPRA) and other US state laws

If you are a resident of California, and in substance also if you are a resident of Colorado, Connecticut, Virginia, Utah, Oregon, Texas, Montana, Delaware or another state with a comprehensive privacy law, you have the right to:

• —Know what personal information we have collected about you, where it came from, why we collected it and who we disclosed it to.
• —Obtain a portable copy of that information.
• —Correct inaccurate personal information.
• —Delete personal information, subject to the exceptions the law allows (for example, records we must keep for tax purposes).
• —Opt out of sale or sharing — noting that we do neither.
• —Not be discriminated against for exercising any of these rights. We will not refuse service, change prices or reduce quality because you made a request.

EEA and UK visitors

If the GDPR applies to you, you additionally have the right to restrict or object to processing, to withdraw consent at any time, and to lodge a complaint with your local supervisory authority.

How to make a request

Email support@outwestboutique.shop or call +1 8990892938 with the words “privacy request” and tell us which right you want to exercise. We will confirm receipt within 10 business days and respond substantively within 45 calendar days, extendable once by a further 45 days if the request is complex — we will tell you if that happens.

We verify requests by matching the email address or order details you give us against our records. If we cannot verify you to a reasonable degree of certainty we will say so rather than release data to the wrong person. An authorised agent may act for you with written permission, which we will ask to see.

• —Order records — 7 years from the order date, because tax and accounting rules require it.
• —Enquiry and styling records — 24 months from your last contact, then deleted.
• —Marketing list — until you unsubscribe, plus a suppression record so we do not email you again by accident.
• —Server logs — 90 days.
• —Analytics — 14 months, in aggregate form.

This store is intended for adults. We do not knowingly collect personal information from anyone under 13 years of age, in line with the Children’s Online Privacy Protection Act. Customers aged 13 to 17 may use the site only with the involvement of a parent or guardian, and orders must be placed by someone 18 or older. If you believe a child under 13 has given us personal information, email support@outwestboutique.shop and we will delete it promptly.

The site is served entirely over HTTPS. Card details are entered with a PCI DSS compliant payment provider and are never stored on our own servers. Access to order and enquiry records is limited to the people who need it, and administrative access requires a password. No system is perfectly secure, so if a breach affects your personal information we will notify you and the relevant authorities as required by law.

We are based in the United States and our service providers process data in the United States. If you order from outside the US, your information will be transferred there. Where we transfer personal data out of the EEA or the UK we rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum with our providers.

Full detail is in our Cookie Policy. In short: essential storage keeps your bag and your cookie choice working and cannot be switched off; analytics cookies are off until you accept them and can be turned off again at any time; we run no advertising or cross-site tracking cookies.

If we change this policy materially we will update the effective date at the top and, where the change affects how we use information you have already given us, email anyone on our records at least 14 days before it takes effect. Previous versions are available on request.