1. Who handles your information
SOLEYA Consulting Ltd is responsible for Krokus platform operations, central accounts, security, platform order administration, credit records and any advertising we arrange. Contact us at [email protected] for privacy questions or requests.
An independently operated store is responsible for its products, customer service and its own uses of customer information. We provide store-management and hosting services and process information to support those services. Depending on the activity and applicable law, Krokus and the store may have separate responsibilities, or we may process information on the store's instructions. A store's additional privacy notice may explain its practices; it cannot remove rights you have under applicable law.
This policy covers Krokus services on changing store subdomains and connected custom domains. External websites, payment providers, delivery providers and embedded services have their own privacy practices.
2. Information we collect
Please provide only information needed for the transaction. Do not include card security codes, account passwords, unnecessary identity documents, health information or other sensitive information in order notes or support messages. Payment information collected by an external payment provider is governed by that provider's notice; we may receive transaction identifiers, payment status or supporting payment evidence.
- Account and business information: names, email addresses, telephone numbers, sign-in or verification details, business and store names, domains, subscription information and account preferences that you provide.
- Order and delivery information: products and variations, quantities, prices, delivery addresses, contact details, selected payment and delivery methods, payment references and confirmation status, order notes, cancellations, fulfilment discrepancies, refunds, store credit and gift-card activity.
- Store content and administration: product descriptions, photos, pages, uploaded files, settings, authorised administrator actions and records needed to manage a store.
- Technical information: IP address, browser and device information, requested pages, timestamps, session and cart identifiers, error reports and security or access logs generated when services are used.
- Communications: messages and supporting information you send to us or a store concerning support, a complaint, an order or a privacy request.
3. How and why information is used
We use information to provide accounts and storefronts, maintain carts, process and administer orders, communicate service updates, coordinate payment and delivery, resolve disputes, maintain credit balances, prevent fraud and abuse, secure and troubleshoot the service, and meet legal or accounting obligations.
Where the applicable law requires a legal basis, processing may be necessary to perform a contract or take steps you request before a contract; comply with a legal obligation; pursue legitimate interests such as secure operation and fraud prevention, taking account of your rights; or follow consent where required. Optional marketing and advertising consent are separate from essential service communications. You may withdraw consent for future consent-based processing without affecting processing already lawfully carried out.
6. Google advertising and your choices
Krokus may display labelled Google AdSense advertisements in customer-store product listings, according to the store's subscription tier and platform configuration. Advertising is disabled until configured and enabled. Publishing an ads.txt ownership-verification file does not itself display advertisements. The Krokus platform homepage has no configured advertising placements.
When Google advertising is enabled, Google and other third-party advertising vendors may place or read cookies and use web beacons, IP addresses, device identifiers and page or interaction information to deliver, measure and protect advertising. Advertising cookies can support personalised ads based on earlier visits to this and other websites. Other participating advertising vendors may also use these technologies, subject to the applicable consent choices.
Use Google's My Ad Center to manage personalised advertising and the Digital Advertising Alliance's choices page for participating third parties. These choices may apply only to a particular browser or account and do not necessarily remove all ads. Google's partner-data page explains its collection and use. Where a consent message is provided, use its controls to review the participating vendors and change your choices. Required regional consent arrangements must be in place before relevant advertising is activated.
How Google uses information from sites or apps that use its services
Google My Ad Center: personalised advertising choices
7. External content and international processing
Store pages may contain links or embedded content, including YouTube videos. Loading an embed can send information such as your IP address, browser information and page context to that provider, which may use its own cookies or storage. External font, icon and other content services can also receive technical connection information when their resources load. Their notices and controls apply to their own processing.
Krokus uses hosting and other service providers that may process information outside Trinidad and Tobago or outside your home country. Privacy laws may differ between countries. Where required, appropriate contractual or other recognised safeguards must support the transfer. Contact us for information about the providers or safeguards relevant to your request.
8. Retention, account closure and backups
We retain information for the purposes described here, taking account of an active account or order, service needs, accounting and legal obligations, fraud prevention, disputes and the need to explain credit and payment activity. Different categories have different retention needs; this policy does not promise that closing an account immediately erases every record.
Business-account deletion and store-database deletion are separate operations. An account closure can disable routes while preserving the database, uploaded files, backups and necessary order or credit audit records for controlled administration, recovery or legal needs. Preserved information must remain protected and must not be made public merely because the account is closed. Database reassignment requires an authorised, lawful transfer and consideration of the personal information it contains.
Backups may retain deleted information until they are rotated or safely removed; any retained copies remain subject to appropriate restrictions. If you request deletion, we will assess what can be removed and explain relevant retention exceptions. You can request more information about the retention applicable to your records.
9. Security
We use access controls and technical and organisational measures intended to protect information, including protected credentials, restricted administration and operational backups. No website or transmission method is completely secure. Protect your devices, verification codes and credentials, use appropriate access permissions, and contact us promptly if you suspect unauthorised access. Where legally required, we will notify affected people or authorities about a personal-data breach.
10. Your requests and rights
Depending on applicable law and your circumstances, you may request access to your personal information, correction, deletion, restriction, portability, information about sharing, or object to certain processing. You may withdraw consent where processing depends on it. These rights can be subject to exceptions, identity checks and the rights of other people. We will not promise a particular legal right or response period where it does not apply.
Send requests to [email protected] and identify the relevant store, account or order without sending passwords or full payment-card details. We may request proportionate information to confirm your identity. For a store's independent records or marketing, contact that store as well; we will help identify the appropriate recipient where possible. You may also raise a concern with the authority competent under the law that applies to you.
11. Children
Krokus is not directed to children under 13. Business-account holders must be adults able to enter into contracts. A younger person who cannot independently enter a purchase contract must act through a parent or guardian. Do not knowingly submit a child's information beyond what is necessary and lawful. If you believe a child's information was improperly collected, contact us so we can investigate and take appropriate action.
12. Changes and contact
We will update this policy when practices change, identify the new effective date, and provide additional notice or obtain consent where required. A policy update does not retrospectively authorise a materially different use of information that requires fresh consent or another lawful basis.
Privacy and policy contact: SOLEYA Consulting Ltd, operator of Krokus, [email protected].