Privacy policy
Last updated: 25 October 2026
This policy explains the personal information used by How to Deal with Pain when you browse this Shopify store, place an order, use an optional customer account or contact us.
1. Who is responsible
Damian Stanica, trading as How to Deal with Pain
Heath Grange, Houghton le Spring, Tyne and Wear, DH5 8BQ, United Kingdom
Email: howtodealwithpain@gmail.com
Damian Stanica is the controller for the business processing described here. Shopify and payment providers may have their own responsibilities for processing that they carry out independently. Their notices explain those activities.
2. Information involved
We use information you provide, including your name, email address, billing/contact address, order details and support messages. An optional account may involve account identifiers and preferences. Do not send your password to us.
Shopify and payment providers process payment and transaction information. We can receive payment status and transaction references; do not send card details by email. Technical information can include IP address, browser/device details, security logs, privacy preferences, pages or products accessed and order/download activity, depending on the service and your choices.
Books and topic choices can reveal sensitive interests. Buying or reading a title does not establish a diagnosis. We do not require you to explain a health condition to browse or buy. Please do not send completed crisis plans or private medical histories.
3. Purposes and lawful bases
| Purpose | Information used | Basis |
|---|---|---|
| Take payment, supply files and administer orders | Contact, billing, order and transaction information | Contract and steps requested before a contract |
| Answer enquiries and resolve access problems | Contact details, messages, order references and relevant technical information | Contract where linked to an order; otherwise legitimate interests in responding and running the business |
| Accounting, tax and required records | Order, payment and business correspondence records | Legal obligations |
| Security, fraud prevention and legal claims | Relevant technical, transaction and correspondence records | Legitimate interests in protecting customers and the business, and legal obligations where applicable |
| Optional marketing or non-essential tracking | Contact details, preferences and applicable device/activity data | Consent where required; only the specific permissions and lawful grounds applicable to that activity |
Where we rely on legitimate interests, we consider whether the activity is necessary and whether your rights outweigh those interests. You can object as described below. We do not rely on a purchase as blanket consent to marketing.
Ordinary customer service does not require health data. If you send sensitive information unexpectedly, we limit its use to addressing the message where a lawful basis and any required additional condition exist, and remove information we do not need. We do not offer clinical assessment or diagnosis.
4. Shopify, files, payments and email
Shopify hosts the store and checkout. Shopify Digital Products stores and delivers purchased files and may record delivery/download information. Payment providers process the payment method you select. We use the business email inbox for customer messages. Service providers receive information needed for their roles, subject to applicable contractual and legal arrangements.
Shopify Network Intelligence is currently enabled for this store. Shopify uses customer data with data from other Shopify merchants to improve products, ad targeting and personalisation. Shopify also processes information for its own services, such as Shop, Shop Pay and security. The operation depends on the services used, settings, consent and applicable opt-outs. For its enhanced services, Shopify is responsible for the processing it carries out, including relevant privacy-rights requests. Read the Shopify Consumer Privacy Policy and use the Shopify Privacy Portal for Shopify-controlled processing.
We may disclose relevant records to professional advisers, authorities or other parties where necessary for a legal obligation, a lawful request, fraud prevention or establishing/defending claims. We do not sell customer lists for money. Some platform data disclosures can nevertheless count as “sale”, “sharing” or targeted advertising under particular US laws; use the privacy choices below where applicable.
Checkout validation: BoomGate by Code57
We use BoomGate by Code57 to apply checkout rules, including checking for the digital-supply consent marker. Depending on the rule and Shopify permissions, this can involve cart and product information, checkout attributes and customer contact or address information available through Shopify. The installed app has permission to view customer and product information and manage checkout validations. These permissions describe access, not a claim that every field is stored by Code57.
We use this service to administer requested purchases and to support compliance with digital-supply requirements. Our bases are steps requested before a contract and performance of the contract, applicable legal obligations, and legitimate interests in maintaining reliable checkout and evidence of customer choices. We record the digital-supply statements, wording version and recorded time with the order. These choices are separate from marketing consent. We do not use BoomGate to request completed crisis plans or medical histories. Contact howtodealwithpain@gmail.com for questions about this processing or to exercise your data rights.
5. Your browsing and marketing choices
The topic finder is optional and its selections are held only in the page’s memory while it is open. It is not an assessment or diagnosis. Our custom finder does not create a saved health profile. This does not mean Shopify receives no ordinary technical or browsing data when pages load.
No newsletter sign-up is required to use the shop. If marketing is offered, it must have a separate choice and an unsubscribe route. Order and download emails are service messages and are separate from marketing. See Cookies and privacy choices for tracking controls. We do not create condition-based advertising audiences from the finder selections.
6. International processing
Our business is based in the UK. Shopify and other providers may process information in other countries. Where UK or EEA transfer safeguards are required, processing must use an applicable adequacy arrangement or recognised contractual safeguards, as appropriate to the transfer. Contact us for information about the safeguards relevant to business-controlled processing. Shopify explains its own arrangements in its privacy materials.
7. Retention and security
We retain order and accounting records for the period needed to meet applicable tax, accounting and legal requirements. Our working retention approach is up to six years after the relevant accounting/tax year, with longer retention only where a legal requirement, unresolved dispute or other justified need applies. We review support correspondence and normally remove it when no longer needed, generally within 24 months after resolution unless it forms part of a required business record or ongoing claim.
Optional account records are retained while the account is used and as needed for lawful record-keeping. Provider security logs, backups and delivery records follow the relevant provider arrangements and legal requirements. Deletion requests are assessed against those obligations; no promise is made that every backup disappears immediately.
We use reasonable access controls and rely on providers’ security measures for hosting and payments. No online service can guarantee absolute security. Keep download links and account credentials private.
8. Rights and requests
Depending on your location and the applicable law, you can request access, correction, deletion, restriction or portability, object to certain processing, withdraw consent and exercise applicable US sale/sharing or targeted-advertising opt-outs. These rights have conditions and exceptions. Withdrawing consent does not invalidate earlier lawful processing.
Email howtodealwithpain@gmail.com. We may ask for proportionate information to confirm identity, but do not send identification documents unless requested through an appropriate secure route. We will respond within the applicable legal period. You can use an authorised representative where the law allows. We do not penalise you for exercising a right.
Where relevant, use Your privacy choices / data-sharing opt-out, your browser’s supported privacy signal, and Shopify’s Privacy Portal. The effect of a choice depends on applicable law and the platform feature.
9. Children, external links and complaints
The shop is intended for adults. We do not knowingly invite children to create accounts or submit health information. Contact us if a child has supplied information so we can assess and address it. External websites have their own privacy arrangements.
You can complain to us first, without losing the right to approach a regulator. UK complaints can be made to the Information Commissioner’s Office. EEA residents may contact their local data protection authority. US residents may have additional complaint or appeal routes under the law that applies to them.
10. Changes
We will update this notice when practices materially change and show the latest revision date. Where the law requires notice or renewed consent, an updated web page alone will not substitute for those steps.