Cookies & Tracking Policy

Cookies & Tracking Policy – Your Hair And Wig
Your Hair And Wig · Policy Center

Cookies & Tracking Policy

A fully transparent, detailed account of every cookie, pixel, and tracking technology used on yourhairandwig.com — what each one does, why we use it, and exactly how you can control or opt out of every category, wherever in the world you're shopping from.

USA · Canada · UK · Ireland · Australia · New Zealand CCPA / CPRA Compliant PIPEDA / CASL Compliant UK GDPR / PECR Compliant EU GDPR / ePrivacy Compliant Australian Privacy Act 1988 Compliant NZ Privacy Act 2020 Compliant Effective: September 9, 2026
4
Cookie Categories
1
Strictly Necessary (No Opt-Out)
3
Optional (Opt-In or Opt-Out, by Region)
6
Countries Covered
Policy Overview

What This Policy Covers

This Cookies & Tracking Policy explains how Your Hair And Wig ("we," "our," or "us") uses cookies, pixels, web beacons, local storage, and other tracking technologies on our website at yourhairandwig.com (the "Site"). We are based in the United States and sell wigs, lace front wigs, hair extensions, weaves, closures, frontals, and hair care products. We currently ship to customers in the United States, Canada, Australia, Ireland, New Zealand, and the United Kingdom.

Because we offer goods to residents of Ireland and the United Kingdom, our cookie and tracking practices are also governed by EU and UK data protection law even though we have no physical establishment in either territory — a point of law explained further in the "EU & UK Representatives" box on this page. When you browse our product pages, add items to your cart, proceed through checkout, or interact with any feature of our Site, various tracking technologies may be activated. This policy tells you precisely which technologies are used, what data they collect, how long that data is retained, who it is shared with, and how you can exercise your rights to limit or stop tracking entirely — using the consent standard that applies in your own country.

This policy forms part of our overall Privacy Policy and should be read alongside our Terms of Service. If you have any questions about how we use cookies on our Site, please contact us at info@yourhairandwig.com or call us at +1 561-810-0428.

Governing Legal Framework

Applicable Laws & Standards

Our cookie and tracking practices are governed by the following primary legal authorities across the six countries we ship to:

  • United States: CCPA/CPRA (Cal. Civ. Code § 1798.100 et seq.), FTC Act § 5, COPPA, plus state laws in VA, CO, CT, TX and others
  • Canada: PIPEDA (S.C. 2000, c. 5), CASL (S.C. 2010, c. 23), Quebec Law 25, Alberta & BC PIPA
  • United Kingdom: UK GDPR, Data Protection Act 2018, PECR (as amended by the Data (Use and Access) Act 2025)
  • Ireland & EU: EU GDPR (Regulation (EU) 2016/679), Irish Data Protection Act 2018, ePrivacy Regulations 2011 (S.I. No. 336 of 2011)
  • Australia: Privacy Act 1988 (Cth) & the Australian Privacy Principles, Privacy and Other Legislation Amendment Act 2024, Spam Act 2003
  • New Zealand: Privacy Act 2020 (13 Information Privacy Principles), Unsolicited Electronic Messages Act 2007
Technology Basics

What Are Cookies & Tracking Technologies?

Before describing which specific technologies we use, it is important to understand what these tools are and how they work on your device.

HTTP Cookies

Cookies are small text files placed on your browser or device when you visit a website. They allow the website to remember information about your visit — such as your preferred language, your shopping cart contents, or whether you have already logged in. Cookies cannot execute programs or deliver viruses to your device; they simply store text data that your browser sends back to the originating website on your next visit.

Cookies are classified as either session cookies (deleted automatically when you close your browser) or persistent cookies (remain on your device for a defined period even after your browser is closed). We use both types on this Site.

Pixels & Web Beacons

A pixel (also called a web beacon or tracking pixel) is a tiny, invisible 1×1 image embedded in a webpage or email. When your browser loads the page or email, it sends an HTTP request to the server hosting that image, and that request can include information such as your IP address, browser type, the time of the request, and the URL of the page where the pixel is embedded.

We use pixels placed by Meta (Facebook), TikTok, and our Shopify analytics platform. These pixels help us understand whether our advertising campaigns are reaching the right audiences across all six of the countries we ship to.

Local Storage & Session Storage

HTML5 local storage and session storage are browser-based storage mechanisms that allow websites to save data directly in your browser without using cookies. Unlike cookies, local storage data is never automatically sent to our servers with each HTTP request — it is stored entirely in your browser. We use these technologies through Shopify's platform primarily to maintain your shopping cart state, remember your recently viewed products, and preserve your preferences during a browsing session.

First-Party vs. Third-Party Cookies

A first-party cookie is set directly by our website (yourhairandwig.com) and can only be read by our Site. A third-party cookie is set by an external domain — for example, Meta, TikTok, or another service provider — and can be read by that external service across other websites you may visit. We use both types, and all third-party cookie providers are listed explicitly in this policy.

How Shopify Processes Tracking Data

Our website is hosted and operated on the Shopify e-commerce platform. Shopify itself places certain cookies and tracking technologies as part of the core store infrastructure. When you interact with our checkout, cart, or payment processing systems, you are interacting with Shopify's infrastructure. Shopify is certified under SOC 2 Type II and PCI DSS Level 1, and maintains its own Data Processing Addendum covering transfers of EU, UK, Australian, and New Zealand customer data.

Data We Do NOT Collect Through Cookies

Our cookies and tracking technologies do not collect or store your payment card numbers, full social security or national insurance numbers, or government-issued identification numbers. Payment processing is handled entirely by Shopify Payments and other PCI-compliant third-party payment processors, which use their own secure tokenization systems independent of cookies.

Cookie Categories

The Four Categories of Cookies We Use

We classify every cookie and tracking technology used on yourhairandwig.com into one of the following four categories. The first category is strictly necessary and cannot be disabled without breaking core website functionality. The remaining three categories are optional — but how we obtain your permission for them depends on where you are visiting from. See the "How We Obtain Consent, by Region" section below for the exact standard that applies to you.

Category 1: Strictly Necessary Cookies

Cannot Be Disabled

Strictly necessary cookies are essential for yourhairandwig.com to function as an e-commerce store. Without these cookies, core features such as your shopping cart, secure checkout, login sessions, fraud prevention, and payment processing would not work. Because they are essential to the operation of the Site, these cookies are exempt from consent requirements under PECR, the ePrivacy Regulations, the Australian Spam Act, and equivalent US/Canadian rules, and are activated automatically. You can block these cookies at the browser level, but doing so will prevent you from completing a purchase.

Cookie Name Set By Purpose Duration Category
_shopify_y Shopify Anonymous visitor identifier used for statistical analysis and to distinguish visitors 1 year Strictly Necessary
_shopify_s Shopify Session tracking for analytics; records how long you stay on the Site during a single visit 30 minutes Strictly Necessary
_shopify_sa_t Shopify Attribution tracking for marketing analytics (used internally by Shopify to manage referral attribution) 30 minutes Strictly Necessary
_shopify_sa_p Shopify Attribution tracking for pages visited in the session used for internal analytics 30 minutes Strictly Necessary
cart Shopify Maintains the contents of your shopping cart so items are not lost when you navigate between pages or return to the Site 2 weeks Strictly Necessary
cart_sig Shopify Verifies the integrity and security of your cart contents to prevent tampering Session Strictly Necessary
cart_ts Shopify Timestamp used to track when the cart was last modified; prevents cart conflicts Session Strictly Necessary
checkout_token Shopify Unique token that securely identifies your checkout session; required for payment processing 1 year Strictly Necessary
secure_customer_sig Shopify Authenticates returning customer accounts; keeps you logged in securely 20 years Strictly Necessary
storefront_digest Shopify Used when the store is password-protected; verifies access authorization Session Strictly Necessary
_cmp_a Shopify Stores consent management preferences for visitors in regions with applicable privacy laws 30 days Strictly Necessary
_orig_referrer Shopify Tracks which external source (referring website, search engine, etc.) directed you to our Site; used for order attribution 2 weeks Strictly Necessary

Category 2: Functional / Preference Cookies

Optional — Consent Required in UK, Ireland & EU

Functional cookies allow our website to remember choices you have made — such as your preferred currency, your delivery country (out of the six we ship to), recently viewed products, and other settings that make browsing more convenient. If you disable functional cookies, our Site will continue to work but some personalized features will reset each visit.

Cookie Name Set By Purpose Duration Category
_landing_page Shopify Tracks which page on our Site a visitor first landed on in their current session; used to improve navigation and content relevance 2 weeks Functional
_shopify_fs Shopify Records first-session data; used to distinguish visitors who are visiting for the first time from returning visitors 30 minutes Functional
localization Shopify Stores your selected country and currency preference to display correct pricing and shipping options 1 year Functional
recently_viewed_products Shopify Stores the identifiers of products you have recently viewed so we can display a "Recently Viewed" section on product and collection pages 2 weeks Functional
preferred_currency Shopify Saves your selected currency (USD, CAD, AUD, EUR, NZD, or GBP) so prices are displayed consistently across your session and return visits Session Functional

Category 3: Analytics & Performance Cookies

Optional — Consent Required in UK, Ireland & EU

Analytics cookies help us understand how visitors interact with our website — which pages are visited most often, where visitors drop off during checkout, and whether our site performs well across devices. We use Shopify's built-in analytics platform. The data collected is not sold to any third party and is not used to identify you personally.

UK Note — Data (Use and Access) Act 2025 Analytics Exemption

Since 5 February 2026, UK law (PECR as amended by the Data (Use and Access) Act 2025) exempts cookies used solely for first-party aggregate statistical purposes from the consent requirement, provided strict conditions are met (the data is not used for advertising, is not shared outside our organization, and users are informed and can opt out). Because our Shopify analytics cookies are cross-referenced with order and attribution data and are not purely first-party aggregate statistics, we continue to treat them as requiring consent for UK visitors to stay on the safe side of this exemption.

Cookie Name Set By Purpose Duration Category
_shopify_evids Shopify Analytics Tracks page view events during a browsing session to generate session-level analytics; no personal identifiers are stored Session Analytics
_shopify_ga Shopify Analytics Integrates Shopify sales and traffic data with analytics reporting; used to correlate sessions with order outcomes 1 day Analytics
_tracking_consent Shopify Records the tracking consent decisions you have made, including which analytics and marketing cookie categories you have accepted or rejected 1 year Analytics
shopify_pay Shopify Identifies whether Shop Pay is available and used for payment acceleration analytics in the checkout flow 1 year Analytics
shopify_pay_redirect Shopify Tracks which checkout flow was used (standard checkout vs. Shop Pay) for performance and conversion analysis 30 minutes Analytics

Category 4: Marketing & Advertising Cookies

Optional — Consent/Opt-In Required in All Six Countries

Marketing and advertising cookies are used to deliver advertisements relevant to your interests — including advertisements for our wig, hair extension, weave, and hair care products on platforms such as Facebook, Instagram, and TikTok. These cookies track your activity on our Site and share that information with our advertising partners so they can build a profile of your interests and show you relevant ads. You can opt out of marketing cookies at any time through your browser settings, platform-specific opt-out tools listed in this policy, or by contacting us directly.

Under the CCPA/CPRA, sharing data with advertising platforms may constitute a "sale" or "sharing" of personal information. Under UK GDPR, EU GDPR, and the Irish ePrivacy Regulations, placing marketing cookies requires your prior opt-in consent. Under Australia's Spam Act 2003 and Privacy Act 1988, and New Zealand's Unsolicited Electronic Messages Act 2007, using cookie data to send or target commercial electronic messages likewise requires consent. See "Your Rights" below for jurisdiction-specific detail.

Cookie / Pixel Name Set By Purpose Duration Category
_fbp Meta (Facebook/Instagram) Meta's browser ID cookie; identifies your browser across visits to our Site and to other websites that use Meta Pixel; used to measure, optimize, and build audiences for advertising campaigns 90 days Marketing
_fbc Meta (Facebook/Instagram) Stores your last click attribution on a Meta (Facebook or Instagram) ad; connects your ad click to a purchase or other conversion event on our Site 90 days Marketing
fr Meta (Facebook) Meta's primary advertising cookie; delivers and measures targeted advertising to Facebook and Instagram users; can be used to re-target you with ads for products you viewed on our Site 90 days Marketing
tt_pixel_session_index TikTok Pixel TikTok's session-level pixel cookie; tracks page views and add-to-cart events during your session for TikTok advertising measurement Session Marketing
_ttp TikTok Pixel TikTok's persistent pixel cookie; identifies your browser across visits and ties your behavior on our Site to TikTok ad campaigns; used for conversion attribution 1 year Marketing
Meta Pixel (Server-Side) Meta Conversions API Server-side event data (add to cart, purchase, page view) sent directly from Shopify's servers to Meta's Conversions API; transmits hashed order and browsing data to Meta for ad measurement purposes N/A (server-side) Marketing

Meta Conversions API — Server-Side Data Sharing Notice

In addition to the client-side Meta Pixel, our Shopify store uses Meta's Conversions API (CAPI) to send certain conversion events directly from our server to Meta. This server-side integration means that even if your browser blocks the Meta Pixel cookie, some event data may still be transmitted to Meta in hashed form. This includes your hashed email address, hashed phone number, IP address, browser user agent, and details of the product purchased, used solely for advertising measurement and conversion optimization. You can opt out by contacting us at info@yourhairandwig.com.

Consent Management

How We Obtain & Manage Your Consent, By Region

The legal standard for cookie consent is not the same in every country we ship to. We apply the strictest applicable standard to each visitor based on their location.

When you first visit yourhairandwig.com, a cookie consent banner is displayed at the bottom of your screen. This banner explains the four categories of cookies we use, provides a brief description of each category's purpose, and gives you clear controls to accept all cookies, customize your preferences by category, or reject all optional cookies.

Opt-In (Prior Consent) Model — UK, Ireland & EU Visitors

For visitors in the United Kingdom and Ireland, functional, analytics, and marketing cookies are not activated until you affirmatively opt in through our consent banner, as required by UK GDPR, EU GDPR, PECR, and the Irish ePrivacy Regulations 2011 (S.I. No. 336 of 2011). Consent must be freely given, specific, informed, and unambiguous — pre-ticked boxes or "continuing to browse" are never treated as valid consent. You may accept some categories and reject others.

Opt-Out Model — United States & Canada

For US and Canadian visitors, functional and analytics cookies may load on your first visit under a legitimate-interest or implied-consent basis, and our banner gives you the ability to reject them going forward. Marketing/advertising cookies are treated as requiring express consent for Canadian visitors under CASL and Quebec Law 25, and as subject to an opt-out right for US visitors under CCPA/CPRA and other state privacy laws.

Active/Opt-In Consent — Australia & New Zealand

Australia's Privacy Act 1988 and Spam Act 2003, and New Zealand's Privacy Act 2020 and Unsolicited Electronic Messages Act 2007, require clear and active consent before using cookie data to send commercial electronic messages or targeted advertising, and current OAIC and Privacy Commissioner guidance favors clear "Accept" / "Manage Preferences" choices over implied consent. As a matter of policy, we present the same opt-in banner to Australian and New Zealand visitors as we do to UK, Irish, and EU visitors.

Withdrawing Consent

You may withdraw your consent at any time by clearing your browser's cookies, using your browser's cookie management controls, updating your preferences through our banner, or contacting us directly. Withdrawing consent does not affect the lawfulness of any tracking that occurred prior to your withdrawal. We process withdrawal requests within 15 business days (US/Canada) or without undue delay and in any case within one month (UK/Ireland/EU), consistent with the timelines in the "Your Rights" section below.

Children's Data — Age Thresholds by Country

Our website is not directed at children. The age below which parental consent applies to data collection differs by country: United States — under 13 (COPPA); United Kingdom — under 13 (UK GDPR); Ireland/EU — under 16 (Irish Data Protection Act 2018, Section 31, exercising the GDPR Article 8 member-state option); Canada — PIPEDA has no fixed statutory age but treats consent from anyone who cannot meaningfully understand the consequences of consent as invalid; Australia — the Privacy Act does not set a fixed age, though OAIC guidance and the forthcoming Children's Online Privacy Code (due by 10 December 2026) will introduce specific protections; New Zealand — the Privacy Act 2020 applies regardless of age, with the Privacy Commissioner recommending organizations assess a child's maturity. We do not knowingly collect personal information from or set advertising cookies for anyone under these applicable thresholds. If you believe a child has provided personal information to our Site, contact us immediately at info@yourhairandwig.com so we can delete it.

What our cookie consent banner looks like:

Cookie Preferences — Your Hair And Wig

We use cookies and similar tracking technologies to improve your browsing experience, analyze site traffic, and personalize content and advertising. Choose to accept all cookies, customize your preferences by category, or reject all optional cookies. Strictly necessary cookies cannot be disabled.

How to Reset Your Consent Preferences

You may: (1) clear your browser's cookies for this domain, which will cause the consent banner to reappear on your next visit; (2) use your browser's privacy or incognito mode; or (3) contact us at info@yourhairandwig.com to request manual removal of your stored preference from our records.

Third-Party Services

Third-Party Services That Place Cookies on Our Site

We work with a limited number of trusted third-party service providers who may place cookies or tracking technologies on your device. Data these providers collect may be transferred to and processed in the United States — see "Cross-Border Data Transfers" below for the safeguards that apply to UK, Irish, Australian, and New Zealand visitors.

Shopify Inc.

Role: E-commerce platform provider and data processor. Shopify hosts our store, processes our checkout, and provides analytics infrastructure.

Data Collected: Browsing session data, cart contents, checkout information, order history, IP address, device type, browser information.

Data Location: Primarily the United States and Canada. Shopify is certified under SOC 2 Type II and PCI DSS Level 1, and maintains Standard Contractual Clauses covering EU, UK, Australian, and New Zealand merchants.

Further Information: Shopify Privacy Policy

Meta Platforms, Inc. (Facebook & Instagram)

Role: Advertising and audience measurement across all six countries we ship to.

Data Collected: Page views, add-to-cart events, checkout initiations, purchase events, your IP address, browser information, hashed email/phone (via Conversions API).

Notice: Sharing data with Meta may constitute a "sale"/"sharing" under CCPA and requires opt-in consent under UK/EU/Irish law and Australian/NZ law.

Opt-Out: Meta Cookie Policy · Meta Ad Preferences

TikTok Inc. (TikTok Pixel)

Role: Advertising and conversion tracking. We use the TikTok Pixel to measure whether visitors who see our TikTok ads subsequently visit our website and make purchases.

Data Collected: Page views, add-to-cart events, purchase events, your IP address (truncated), browser type, pixel session data.

Notice: Sharing behavioral data with TikTok may constitute a "sale"/"sharing" under CCPA and requires opt-in consent under UK/EU/Irish and Australian/NZ law.

Opt-Out: TikTok Privacy Policy · Turn off TikTok Pixel in your browser cookie settings

YouTube (Google LLC)

Role: Embedded video content from our YouTube channel (@YOURHAIRWIG). When embedded videos load and you interact with them, YouTube may set its own cookies.

Data Collected: IP address, device information, and viewing behavior, governed by Google's Privacy Policy.

Opt-Out: Google Privacy Policy · Google Account Privacy Controls

Jurisdiction-Specific Compliance

Legal Compliance for Cookies & Tracking, By Country

Because we ship to the United States, Canada, Australia, Ireland, New Zealand, and the United Kingdom, our cookie and tracking practices must comply with the specific legal frameworks of all six countries. Below is a detailed country-by-country breakdown.

United States
  • CCPA & CPRA — Cal. Civ. Code § 1798.100: Right to know, right to opt out of "sale"/"sharing," right to delete, right to non-discrimination. We provide a "Do Not Sell or Share My Personal Information" mechanism.
  • FTC Act § 5 (15 U.S.C. § 45): Prohibits unfair or deceptive cookie disclosures. This policy is our full and accurate disclosure.
  • COPPA (15 U.S.C. § 6501 et seq.): Our Site is not directed at children under 13; we do not place advertising cookies on their devices.
  • Other State Laws (VA CDPA, CO CPA, CT CTDPA, TX TDPSA): We extend opt-out and deletion rights for cookie-based tracking to residents of all states with enacted comprehensive privacy laws.
  • Global Privacy Control (GPC): Recognized as a valid opt-out signal under CCPA/CPRA.
Canada
  • PIPEDA (S.C. 2000, c. 5): Cookies must be collected with knowledge and consent, used only for disclosed purposes, and retained no longer than necessary.
  • CASL (S.C. 2010, c. 23): Non-essential cookies are treated as requiring express consent before being placed on a Canadian visitor's device.
  • Quebec Law 25 (in force since September 2023): Requires disclosure of technologies used, purposes, and third parties, plus express consent before non-essential cookies are placed.
  • Alberta PIPA & British Columbia PIPA: Provincial private-sector laws with consent and transparency requirements substantially similar to PIPEDA.
  • OPC Guidance: We follow the Office of the Privacy Commissioner of Canada's published guidance on meaningful consent for online tracking.
United Kingdom
  • UK GDPR & Data Protection Act 2018: Requires a lawful basis for processing personal data collected via cookies; consent is our lawful basis for functional, analytics, and marketing cookies.
  • PECR, as amended by the Data (Use and Access) Act 2025: Requires prior opt-in consent before placing non-essential cookies. Since 5 February 2026, narrow exemptions exist for purely first-party aggregate statistics and appearance/preference cookies, which we do not currently rely on (see the note in the "Cookie Categories" section above).
  • ICO Guidance: Our banner gives "Reject" equal prominence to "Accept," and non-essential cookies do not fire before you make a choice, consistent with ICO expectations.
  • UK GDPR Article 27 Representative: As a US company with no UK establishment that offers goods to UK residents, we maintain a UK representative for data protection purposes (see the box below).
Ireland & EU
  • EU General Data Protection Regulation (Regulation (EU) 2016/679): Applies to us under Article 3(2) because we offer goods to individuals in Ireland/the EU. Consent, transparency, and data subject rights obligations apply in full.
  • Irish Data Protection Act 2018: Sets Ireland's digital age of consent at 16 and establishes the Data Protection Commission (DPC) as the supervisory authority.
  • ePrivacy Regulations 2011 (S.I. No. 336 of 2011): Ireland's implementation of the ePrivacy Directive; requires clear, specific, prior consent before storing or accessing information on an Irish user's device, except for strictly necessary cookies.
  • GDPR Article 27 Representative: As a US company with no EU establishment that offers goods to EU residents, we maintain an EU representative for data protection purposes (see the box below).
Australia
  • Privacy Act 1988 (Cth) & Australian Privacy Principles (APPs): Governs collection, use, and disclosure of personal information, including via cookies. APP 6 limits use of information collected for one purpose (e.g., site function) to a new purpose (e.g., advertising) without consent.
  • Privacy and Other Legislation Amendment Act 2024: Introduced a statutory tort for serious invasions of privacy (in force since June 2025), a Children's Online Privacy Code (due by 10 December 2026), and new transparency requirements for automated decision-making (in force 10 December 2026) that will apply to any automated ad-targeting decisions we make using cookie data.
  • Spam Act 2003: Requires consent before sending commercial electronic messages and before using tracking data to build marketing audiences for such messages.
  • OAIC Enforcement: The Office of the Australian Information Commissioner is the regulator for Privacy Act and Spam Act compliance.
New Zealand
  • Privacy Act 2020 — 13 Information Privacy Principles (IPPs): Applies to us because we offer goods to individuals in New Zealand. IPP 1–4 govern purpose, collection, and manner of collecting cookie data; IPP 10–11 restrict using or disclosing it for unrelated purposes without consent.
  • IPP 12 — Cross-Border Disclosure: Restricts sending New Zealand personal data overseas unless the recipient is subject to comparable privacy safeguards or the individual has been informed and has authorized the transfer (see "Cross-Border Data Transfers" below).
  • Unsolicited Electronic Messages Act 2007: Requires consent before sending commercial electronic messages, relevant to how we use marketing-cookie data for retargeting and email/SMS campaigns.
  • Office of the Privacy Commissioner (OPC) Guidance: We follow published OPC guidance on cookie transparency and honor the Do Not Track browser signal where technically supported.

EU & UK Representatives — GDPR / UK GDPR Article 27

Because Your Hair And Wig has no physical office, subsidiary, or establishment in the European Union or the United Kingdom but offers goods to residents of Ireland and the UK, both the EU GDPR and the UK GDPR require us, subject to limited exemptions, to designate a representative in each territory that data subjects and regulators can contact in addition to us directly. We are in the process of formalizing these appointments; in the meantime, EU and UK data subjects may direct any GDPR-related inquiry to info@yourhairandwig.com, and we will respond within the statutory timeframes set out in "Your Rights" below. We will publish the appointed representatives' contact details on this page once finalized.

Do Not Sell or Share My Personal Information — California, Colorado, Virginia & Other State Residents

Residents of California and other US states with enacted comprehensive privacy laws have the right to opt out of the "sale" or "sharing" of their personal information with third parties for cross-context behavioral advertising. Our use of Meta Pixel, TikTok Pixel, and Meta Conversions API to share your browsing and purchase behavior with advertising platforms may constitute a "sale" or "sharing" under applicable state law. To exercise this right, contact us at info@yourhairandwig.com with the subject line "Do Not Sell or Share My Personal Information," or call +1 561-810-0428. We will process your request within 15 business days and will not discriminate against you for exercising this right.

Your Privacy Rights

Your Rights Regarding Cookies & Tracking Data

Depending on which of the six countries you are visiting from, you may have one or more of the following rights with respect to personal information collected about you through cookies. We honor all applicable rights without requiring you to create an account or pay any fee.

Right to Know / Access

Available in all six countries. You may request a copy of the categories of personal information collected through cookies, why it was collected, and who it was shared with (US, Canada, UK/EU/Ireland, Australia, New Zealand).

Right to Delete / Erasure

Available under CCPA/CPRA, PIPEDA, UK/EU GDPR ("right to be forgotten"), and honored as best practice under the Australian Privacy Act and NZ Privacy Act. We will instruct Shopify, Meta, and TikTok to delete your data where technically feasible.

Right to Opt Out / Object

US/state law: opt out of "sale"/"sharing." Canada/CASL: withdraw express consent. UK/EU/Ireland: object to processing based on legitimate interest and withdraw consent at any time. Australia/NZ: opt out of direct marketing and targeted advertising under the Spam Act, Privacy Act, and Unsolicited Electronic Messages Act.

Right to Rectification & Correction

UK/EU/Ireland GDPR right to have inaccurate data corrected; PIPEDA and Australian/NZ privacy law give equivalent correction rights over any personal information tied to your cookie data.

Right to Data Portability

UK/EU/Ireland GDPR right to receive personal information you provided to us, in a structured, commonly used format, and to have it transmitted to another controller where technically feasible.

Right to Restrict Processing

UK/EU/Ireland GDPR right to request that we limit how we use your data while a dispute about its accuracy or lawfulness is resolved.

Rights Related to Automated Decision-Making

UK/EU/Ireland GDPR Article 22 gives you the right not to be subject to a decision based solely on automated processing (including certain ad-profiling) that produces legal or similarly significant effects. Australia's forthcoming automated decision-making disclosure requirement (effective 10 December 2026) will apply similarly.

Right to Lodge a Complaint

In addition to contacting us, you may lodge a complaint with your national data protection authority at any time — see the "Supervisory Authorities" table in the Contact section below.

Response Timelines for Privacy Rights Requests

We acknowledge privacy rights requests within 3 business days of receipt and provide a substantive response within: CCPA/CPRA (California): 45 days, extendable by 45 days. PIPEDA (Canada): 30 days, extendable by 30 days. Quebec Law 25: 30 days. UK GDPR & EU GDPR (UK/Ireland): one month, extendable by a further two months for complex requests. Australia (Privacy Act 1988): the Act does not set a fixed statutory deadline but requires a response within a "reasonable period"; we aim to respond within 30 days. New Zealand (Privacy Act 2020): 20 working days for access and correction requests, extendable in limited circumstances. All requests should be submitted to info@yourhairandwig.com with the subject line "Privacy Rights Request."

Opt-Out Methods

How to Opt Out of Cookies & Tracking

You have several ways to opt out of non-essential cookies and tracking on yourhairandwig.com, wherever you are shopping from.

01

Browser Cookie Settings

Every major browser provides built-in controls to block, delete, or manage cookies. Please note that blocking strictly necessary cookies will prevent our checkout and cart features from functioning. Direct links to cookie management instructions:

02

Platform-Level & Regulator Opt-Outs

Opt out of advertising tracking directly through the platforms and industry bodies we work with — these opt-outs affect how those platforms use your data across all websites, not just ours:

03

Contact Us Directly

To opt out of specific tracking technologies, exercise your rights under any applicable law, or request manual deletion of cookie-derived data, contact us:

Global Privacy Control (GPC) & Do Not Track Signals

We support the Global Privacy Control (GPC) browser signal as a valid opt-out of the "sale"/"sharing" of personal information under CCPA/CPRA, and we honor it for all visitors as a matter of policy, including in the UK, Ireland, Australia, and New Zealand, where it is treated as equivalent to withdrawing consent for marketing cookies. Where your browser sends a legacy "Do Not Track" signal, we treat it the same way, consistent with guidance published by the UK ICO and the New Zealand Office of the Privacy Commissioner.

International Data Transfers

Cross-Border Data Transfers

Because we are based in the United States and our service providers (Shopify, Meta, TikTok) process data primarily in the US, personal information collected via cookies from visitors in Canada, the UK, Ireland, Australia, and New Zealand is transferred internationally. The safeguards that apply depend on your country.

UK & Ireland/EU → United States

Transfers of personal data from the EU to US organizations can rely on the EU-U.S. Data Privacy Framework (DPF) where the US recipient is self-certified, and transfers from the UK can rely on the UK Extension to the DPF (the "UK-US Data Bridge"). Where a service provider is not DPF-certified, we rely on the European Commission's Standard Contractual Clauses (SCCs), with the UK International Data Transfer Addendum for UK transfers, as our transfer mechanism. We are working with our service providers to confirm and document the specific mechanism relied upon for each transfer.

Ongoing Legal Developments

The EU-U.S. DPF's adequacy decision has been challenged in EU courts (commentators refer to this as a potential "Schrems III" case); as of this policy's effective date the framework remains valid, but the challenge is pending on appeal before the Court of Justice of the European Union. We monitor developments and will update our transfer mechanisms and this policy if the DPF or the UK-US Data Bridge is suspended, invalidated, or replaced.

Australia & New Zealand → United States

Under APP 8 of the Australian Privacy Act 1988, before disclosing personal information overseas we must take reasonable steps to ensure the overseas recipient does not breach the APPs in relation to that information, or another APP 8.2 exception must apply; we address this through contractual commitments with Shopify, Meta, and TikTok. Under IPP 12 of the New Zealand Privacy Act 2020, cross-border disclosure requires that the recipient be subject to comparable privacy safeguards (whether by law or contract), or that you have been expressly informed the receiving country may not offer equivalent protection and have authorized the disclosure on that basis — which this policy, read together with our consent banner, is intended to provide.

Canada → United States

PIPEDA permits transfers to processors outside Canada provided we remain accountable for the data and use contractual or other means to provide comparable protection. Quebec Law 25 requires a privacy impact assessment before certain cross-border transfers of Quebec residents' personal information, which we conduct for new service-provider integrations that process cookie data.

Data Retention

How Long We Retain Cookie Data

The data collected through cookies and tracking technologies is retained for varying periods depending on the purpose of the tracking and the specific cookie involved. Individual cookie durations are listed in the tables above. In general, we apply the following principles:

  • Session Data

    Data stored in session cookies and browser session storage is deleted automatically when you close your browser or tab.

  • Persistent Cookie Data on Your Device

    Persistent cookies remain on your device until their individual expiration dates (ranging from 30 minutes to 20 years, as specified above) or until you manually delete them.

  • Analytics Data on Our Servers

    Aggregated analytics data derived from cookie tracking is retained in our Shopify analytics dashboard for up to 36 months. This data is statistical and aggregated, not individually identifiable.

  • Third-Party Platform Retention

    Data shared with Meta and TikTok is retained according to those platforms' own retention policies, which we do not control. See their privacy policies linked in the "Third-Party Services" section.

Data Security

How We Protect Cookie Data

Our Site is served over HTTPS (TLS 1.2 or higher), encrypting all data transmitted between your browser and our server, including cookie identifiers. Shopify cookies that reference your customer account or checkout session are marked with the Secure and HttpOnly flags where applicable.

We conduct periodic reviews of the cookies active on our Site to ensure all listed cookies are current across all six markets and no unauthorized tracking technologies have been introduced through third-party scripts or app integrations.

Storage Duration Minimization

Where a jurisdiction's law recommends or requires a maximum cookie lifetime (for example, CNIL/EU regulator guidance suggesting 13 months for non-essential cookies), we review our cookie durations periodically and adjust marketing and analytics cookie lifetimes for EU, UK, and Irish visitors where appropriate.

Contact & Privacy Requests

Contact Your Hair And Wig

To submit a privacy rights request, exercise your opt-out rights, or ask any question about this Cookies & Tracking Policy, please use any of the contact methods below.

  • Business Address1501 Corporate Dr, Suite 100 #1047
    Boynton Beach, Florida 33426, United States
  • Phone+1 561-810-0428
  • Emailinfo@yourhairandwig.com
  • Live ChatAvailable on our website during business hours
  • Business HoursMonday – Saturday: 9:00 AM – 6:00 PM
    (GMT-05:00) Eastern Standard Time

Supervisory Authorities — Where You Can Also Complain

Country Authority
United States Federal Trade Commission (FTC); California Privacy Protection Agency (CPPA) for CA residents
Canada Office of the Privacy Commissioner of Canada (OPC); Commission d'accès à l'information (Quebec)
United Kingdom Information Commissioner's Office (ICO)
Ireland / EU Data Protection Commission (DPC), Ireland — or your own EU member state authority
Australia Office of the Australian Information Commissioner (OAIC)
New Zealand Office of the Privacy Commissioner (OPC), New Zealand

Policy Updates

We review and update this Cookies & Tracking Policy at minimum once per year, and more frequently whenever we add or remove a cookie or tracking technology, when applicable law changes in any of the six countries we ship to, or when our advertising platform integrations change materially. When we update this policy, we change the effective date shown at the bottom of this page. If you have questions about any update, please contact us at info@yourhairandwig.com.

Stay Connected

Follow Us on Social Media

See real customer looks, wig styling tutorials, and new arrivals across our social channels. Please note that when you visit our social media pages, those platforms apply their own cookies and tracking policies.

Shop with Full Transparency

We believe you deserve to know exactly how our website works and what data is collected when you shop — wherever in the world you're shopping from. Browse our full collection of wigs, lace fronts, weaves, and hair care products with confidence.

Shop All Products Read Our Privacy Policy
Last Updated & Effective Date: September 9, 2026 · yourhairandwig.com · Privacy Policy · Terms of Service · Shipping Policy · Refund Policy · Billing & Payment Policy