Last updated: 04 July 2026

Dunce Twice Ltd ("Dunce Twice," "we," "us," or "our") operates this website (the "Site") and the products and services made available through it (together, the "Services"). Our storefront is built on Framer; checkout, payment, and fulfilment are handled by Shopify and our fulfilment partner, Tapstitch, which process your information independently for that purpose. This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase or other transaction using the Services, or otherwise communicate with us.

If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described below.

Personal Information We Collect or Process

When we use the term "personal information," we are referring to information that identifies or can reasonably be linked to you or another person. Personal information does not include information that is collected anonymously or that has been de-identified, so that it cannot identify or be reasonably linked to you. Depending on how you interact with the Services, we may collect or process the following categories of personal information, including inferences drawn from this information:

• Contact details — your name, address, billing address, shipping address, phone number, and email address.

• Financial information — credit card, debit card, and other financial account numbers, payment card information, transaction details, form of payment, and payment confirmation. Payment information is collected and processed directly by Shopify and its payment processors; we do not store full card details ourselves.

• Account information — username, password, security questions, preferences, and settings, where account functionality is used.

• Transaction information — items you view, add to your cart, add to a wishlist, or purchase, return, exchange, or cancel, and your past order history.

• Communications with us — information you include when contacting us, for example through a customer support enquiry or email.

• Device information — information about your device, browser, or network connection, your IP address, and other unique identifiers, collected through the Site.

• Usage information — information about how and when you interact with or navigate the Site, including pages viewed and links clicked.

Personal Information Sources

We may collect personal information from the following sources:

• Directly from you — when you browse the Site, create an account, place an order, communicate with us, or otherwise provide us with information.

• Automatically through the Site — from your device and browser as you use the Services, including through cookies and similar technologies (see "Cookies and Tracking Technologies" below).

• From our service providers — including Shopify (cart, checkout, and payment processing), Tapstitch (order fulfillment and shipping), and Klaviyo (email marketing), each of whom processes certain personal information on our behalf.

• From our partners or other third parties — for example, if we engage advertising or analytics partners in the future.

How We Use Your Personal Information

Depending on how you interact with us or which of the Services you use, we may use personal information for the following purposes:

Provide, Tailor, and Improve the Services. We use your personal information to perform our contract with you, process payments, fulfil and ship orders, remember your preferences, send account- and order-related notifications, process returns and exchanges, and otherwise provide a functional shopping experience.

Marketing and Communications. We currently promote Dunce Twice and its products organically through our own social media channels (such as TikTok and Instagram) and through email marketing via Klaviyo, for which we obtain your consent through our cookie and marketing preference settings before any non-essential tracking or marketing communication occurs. We do not currently run paid or sponsored third-party advertising. We may do so in the future, in which case we will update this Privacy Policy and seek any consents required by applicable law before doing so. You can opt out of marketing emails at any time using the unsubscribe link included in those emails.

Security and Fraud Prevention. We use your personal information to authenticate accounts, support a secure payment and shopping experience, and detect, investigate, or take action regarding fraudulent, illegal, unsafe, or malicious activity. If you register an account, you are responsible for keeping your login credentials confidential.

Communicating with You. We use your personal information to provide customer support, respond to enquiries, and otherwise maintain our relationship with you.

Legal Reasons. We use your personal information to comply with applicable law, respond to valid legal process (including requests from law enforcement or government authorities), investigate or participate in legal proceedings, and enforce our policies.

Cookies and Tracking Technologies

We use cookies and similar technologies on the Site to support core functionality (such as your cart), to understand how visitors use the Site, and, where you consent, for marketing purposes. This includes tools such as Google Tag Manager, which governs whether marketing and analytics tags (including those used by Klaviyo) are permitted to run, based on the cookie preferences you set through our consent banner. Non-essential cookies will not fire until you provide consent. You can manage or withdraw your cookie preferences at any time through the consent settings available on the Site.

How We Disclose Personal Information

We may disclose your personal information to third parties for the following purposes:

• With Shopify, who processes cart, checkout, and payment information on our behalf, and with Tapstitch, who processes order and shipping information to fulfil your purchase.

• With Klaviyo, who processes contact and engagement information on our behalf to send marketing communications you have consented to receive.

• With other vendors and service providers who perform services on our behalf, such as IT management, analytics, customer support, or cloud storage.

• With business or marketing partners, only if and when we begin running paid advertising or similar marketing partnerships; we will update this Privacy Policy in advance of any such change.

• When you direct or consent to disclosure, such as through social media widgets or login integrations.

• With our affiliates or otherwise within our corporate group.

• In connection with a business transaction (such as a merger, acquisition, or sale of assets), to comply with legal obligations (including subpoenas or court orders), to enforce our terms or policies, or to protect the rights, property, or safety of Dunce Twice, our users, or others.

Third-Party Websites and Links

The Site may link to websites or platforms operated by third parties. If you follow a link to a site we don't control, you should review that site's own privacy and security practices. We are not responsible for the privacy or security practices of third-party sites, and inclusion of a link does not imply endorsement.

Children's Data

The Services are not directed to, and we do not knowingly collect personal information from, children under the age of 13 (or the relevant age of digital consent in your jurisdiction). While some of our content is shared through platforms such as YouTube and may be viewed by a general audience, our Services and product purchases are intended for adults and those old enough to transact independently or with parental involvement. If you are a parent or guardian and believe your child has provided us with personal information, please contact us using the details below so we can delete it.

Security and Retention of Your Information

We use reasonable measures to protect your personal information, but no method of transmission or storage is completely secure, and we cannot guarantee absolute security. We recommend against sending sensitive information to us through unsecure channels. We retain personal information for as long as needed to provide the Services, comply with legal and tax obligations (including UK record-keeping requirements), resolve disputes, and enforce our agreements.

Your Rights and Choices

If you are based in the UK or the European Economic Area, you have the following rights in relation to your personal information, subject to certain exceptions:

• Right to Access / Know — request access to the personal information we hold about you.

• Right to Delete — request that we delete personal information we hold about you.

• Right to Correct — request correction of inaccurate personal information.

• Right of Portability — request a copy of your personal information, or that we transfer it to a third party, in certain circumstances.

• Right to Object or Restrict Processing — ask us to stop or limit certain processing of your personal information.

• Right to Withdraw Consent — where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

• Managing Marketing Preferences — opt out of marketing emails at any time via the unsubscribe link, or adjust your cookie consent settings on the Site.

We will not discriminate against you for exercising these rights. We may need to verify your identity before processing certain requests. You can exercise these rights by contacting us using the details below.

Complaints

If you have concerns about how we process your personal information, please contact us first using the details below. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or with your local data protection authority if you are based in the EEA.

International Transfers

We may transfer, store, and process your personal information outside the country in which you live, including where our service providers (such as Shopify, Tapstitch, and Klaviyo) operate or store data internationally. Where we transfer personal information out of the UK or EEA, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement or the European Commission's Standard Contractual Clauses, unless transferring to a country recognised as providing an adequate level of protection.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or operational reasons. We will post the revised policy on the Site and update the "Last updated" date above.

Contact

If you have questions about this Privacy Policy or wish to exercise any of your rights, please contact us at:

Email: privacy@duncetwice.com (for privacy and data rights requests) or dunce@duncetwice.com (for general enquiries)

For the purposes of applicable data protection law, Dunce Twice Ltd is the data controller of your personal information.