Privacy Policy

Socks in a Box ("we", "us", "our") operates socksinabox.us and sells sock gift boxes worldwide. For data protection purposes we act as the data controller for the personal data described in this policy. Questions? Email hello@socksinabox.us.

• Order and contact details you provide: name, email, shipping and billing address, phone number, gift messages.
• Payment information processed by our payment providers. We never see or store full card numbers.
• Usage and device data: IP address, browser type, pages viewed, referring site, and interactions collected through cookies and similar technologies.
• Communications: messages you send us and your marketing preferences.

• To process, fulfil, ship and support your orders.
• To handle returns, refunds and customer service requests.
• To prevent fraud, abuse and to keep the store secure.
• To send marketing emails where you have opted in (you can unsubscribe any time).
• To measure and improve our site, products and advertising.
• To meet legal, tax and accounting obligations.

Where GDPR or UK GDPR applies, we rely on: contract (to fulfil your order), legitimate interests (site security, fraud prevention, service improvement), consent (non-essential cookies and marketing), and legal obligation (tax and records).

We share personal data only with service providers who help us run the business, under contracts that limit their use of it: our e-commerce and checkout platform, payment processors, shipping and fulfilment partners, email and support tools, and analytics and advertising providers (including Google Analytics and Meta). We may also disclose data where required by law or in connection with a business transfer. We do not sell your personal information for money.

We use essential cookies to run the cart and checkout, plus analytics and advertising cookies (Google Analytics 4 and the Meta pixel) to understand traffic and measure campaigns. You can control cookies in your browser settings, opt out of Google Analytics via the Google opt-out add-on, and adjust ad preferences in your Meta and Google accounts. We honour Global Privacy Control (GPC) signals where legally required.

We are a US company, so your data may be processed in the United States and other countries. Where data leaves the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK Addendum.

We keep order records for as long as needed to provide the service and to comply with tax and accounting requirements (typically up to 7 years). Marketing data is kept until you unsubscribe. Analytics data is retained on a rolling basis, generally no longer than 26 months.

Depending on where you live, you may have the right to access, correct, delete, port or restrict processing of your personal data, to object to processing, to withdraw consent, and to opt out of targeted advertising or the "sale"/"sharing" of personal information under US state laws such as the CCPA/CPRA. We will not discriminate against you for exercising these rights.

To make a request, email hello@socksinabox.us. We respond within 30 days (or 45 days where the law allows an extension) and may need to verify your identity. EEA and UK residents may also lodge a complaint with their local supervisory authority.

Our store is not directed to children under 16 and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

We use encrypted connections (TLS), reputable PCI-DSS compliant payment providers, and access controls to protect your data. No method of transmission is perfectly secure, but we work hard to protect what you share with us.

We may update this policy from time to time. Material changes will be posted here with a new "last updated" date.