Effective Date: 1 March 2026
Applies to: trestlecart.com and all Trestle Cart services
Contents
- Who We Are
- Information We Collect
- How We Use Your Information
- Legal Bases for Processing
- Cookies & Tracking Technologies
- Third-Party Services
- Data Sharing & Disclosure
- International Data Transfers
- Data Retention
- Your Rights
- Data Security
- Children’s Privacy
- California Privacy Rights (CCPA)
- Changes to This Policy
- Contact Us
At Trestle Cart, we believe the trust you place in us with your personal information is foundational to the partnerships we build. This Privacy Policy explains clearly and transparently how we collect, use, store, protect, and share your personal data when you visit our website, engage with our services, or communicate with our team.
We encourage you to read this policy in full. If you have any questions, you can reach us at any time at privacy@trestlecart.com.
1. Who We Are
Trestle Cart is an international eCommerce growth partner providing strategy, design, development, and growth services to eCommerce brands worldwide. We operate from two offices:
Trestle Cart — Headquarters
Suite 401, Business Bay, Shahrah-e-Faisal
Karachi 75400, Pakistan
Trestle Cart — United Kingdom
71-75 Shelton Street, Covent Garden
London WC2H 9JQ, United Kingdom
Data Protection Contact: privacy@trestlecart.com
For the purposes of applicable data protection laws, Trestle Cart is the data controller responsible for your personal information collected through trestlecart.com and our service engagements.
2. Information We Collect
2.1 Information You Provide Directly
When you interact with us, you may voluntarily provide the following information:
| Data Type | When Collected | Examples |
|---|---|---|
| Contact Information | Contact form, emails, calls | Full name, email address, phone number |
| Business Information | Contact form, strategy calls | Company name, website URL, business stage, revenue range |
| Service Preferences | Contact form, consultations | Package interest, project requirements, timelines |
| Communication Content | Email, chat, video calls | Messages, feedback, project briefs, approvals |
| Payment Information | Service engagement | Billing address, payment method (processed by Stripe — we do not store card numbers) |
| Account Credentials | Client onboarding | Platform access credentials shared for service delivery (stored encrypted) |
2.2 Information Collected Automatically
When you visit trestlecart.com, certain technical information is collected automatically through cookies and similar technologies:
| Data Type | Technology | Purpose |
|---|---|---|
| Device Information | Server logs | Browser type, operating system, screen resolution, device type |
| Usage Data | Google Analytics 4 | Pages viewed, time on site, scroll depth, click patterns, referral source |
| Network Data | Server logs | IP address (anonymised in analytics), approximate geographic location |
| Interaction Data | Meta Pixel, GTM | Form submissions, button clicks, page conversions |
2.3 Information From Third Parties
We may receive limited information about you from third-party sources, including referral partners who introduce you to our services, publicly available business information from your website or LinkedIn for the purpose of tailoring our proposals, and analytics platforms that provide aggregated demographic data about our website visitors.
3. How We Use Your Information
We use the information we collect for the following specific purposes:
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Respond to enquiries and provide requested information about our services | Contact and business information | Legitimate interest |
| Deliver services under agreed engagements (strategy, design, development, growth) | All information relevant to the project scope | Contractual necessity |
| Process payments and manage billing | Payment and billing information | Contractual necessity |
| Send service communications — project updates, deliverables, invoices | Contact information | Contractual necessity |
| Send marketing communications — insights, case studies, service updates | Email address | Consent |
| Improve our website — analyse traffic patterns, optimise user experience | Automatically collected data | Legitimate interest |
| Measure advertising effectiveness and optimise campaigns | Interaction data via Meta Pixel | Consent |
| Prevent fraud and abuse | IP address, device information | Legitimate interest |
| Comply with legal obligations | As required | Legal obligation |
We will never sell your personal data. We do not use your data for automated decision-making or profiling that produces legal effects concerning you.
4. Legal Bases for Processing (GDPR)
For visitors and clients in the European Economic Area (EEA), United Kingdom, and other jurisdictions that require a legal basis for processing personal data, we rely on the following:
Consent — For marketing emails, non-essential cookies (analytics and advertising), and the Meta Pixel. You may withdraw consent at any time by clicking “unsubscribe” in any marketing email or updating your cookie preferences.
Contractual Necessity — For processing data required to deliver our services, manage your project, send invoices, and communicate about active engagements.
Legitimate Interest — For responding to enquiries, improving our website, preventing fraud, and conducting business development. We balance our interests against your rights and only process data where the impact on you is minimal and expected.
Legal Obligation — For retaining financial records, responding to lawful requests from authorities, and meeting tax reporting requirements.
5. Cookies & Tracking Technologies
Our website uses cookies — small text files placed on your device — and similar tracking technologies. On your first visit, a consent banner allows you to accept or decline non-essential cookies. Your preference is stored for 365 days.
5.1 Essential Cookies
These are required for the website to function and cannot be disabled. They include the cookie consent preference cookie (tc_consent) and session management cookies if applicable. These do not track you across sites.
5.2 Analytics Cookies
We use Google Analytics 4 (operated by Google LLC) to understand how visitors interact with our website. GA4 collects anonymised usage data including pages visited, session duration, traffic sources, and user flow. IP addresses are anonymised. GA4 data is retained for 14 months. You can opt out at any time by declining analytics cookies via our consent banner or by installing the Google Analytics Opt-Out Browser Add-On.
5.3 Marketing Cookies
We use the Meta Pixel (operated by Meta Platforms, Inc.) to measure the effectiveness of our advertising on Facebook and Instagram. The pixel tracks page views and form submissions to help us understand which ads lead to enquiries. This data is shared with Meta under their data processing terms. You can manage Meta’s use of your data through Facebook Ad Preferences.
5.4 Tag Management
We use Google Tag Manager (operated by Google LLC) to manage the deployment of analytics and marketing tags on our website. GTM itself does not collect personal data, but it facilitates the loading of other tags that may.
5.5 Consent Mode
We implement Google Consent Mode v2, which means that if you decline non-essential cookies, Google Analytics and the Meta Pixel are prevented from setting cookies or collecting identifiable data. Essential measurement functionality may still operate in a privacy-preserving, cookieless mode as permitted by your consent choice.
6. Third-Party Services
We use carefully selected third-party services to operate our website and deliver our services. Each processor is bound by data processing agreements and their own privacy policies:
| Service | Provider | Purpose | Data Processed |
|---|---|---|---|
| Website Analytics | Google LLC (US) | GA4 — traffic analysis | Anonymised usage data |
| Tag Management | Google LLC (US) | GTM — script management | Page load events |
| Advertising Analytics | Meta Platforms, Inc. (US) | Meta Pixel — ad measurement | Page views, conversions |
| Form Processing | Formspree, Inc. (US) | Contact form handling | Form field data (name, email, message) |
| Payment Processing | Stripe, Inc. (US) | Invoice and payment handling | Billing details, payment method |
| Email Communication | Google Workspace (US) | Business email | Email content and metadata |
| Web Hosting | 20i Ltd (UK) | Website hosting | Server logs, IP addresses |
| Content Delivery | Cloudflare, Inc. (US) | CDN and security (if enabled) | IP address, request data |
We do not use any third-party services for the purpose of selling or renting your data.
7. Data Sharing & Disclosure
We do not sell, rent, or trade your personal information. We may share your data only in the following circumstances:
Service Providers — With the third-party processors listed above, strictly for the purposes described and under data processing agreements.
Client Platform Access — When delivering services, we may access your eCommerce platform (Shopify, WooCommerce, etc.), analytics accounts, or advertising accounts. Access is limited to what is necessary for the engagement and is revoked upon completion.
Legal Requirements — If required to do so by law, regulation, legal process, or enforceable governmental request, we may disclose your information to the extent necessary to comply.
Business Transfers — In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity. We will notify you of any such transfer and any changes to this policy.
With Your Consent — For any purpose not described here, we will seek your explicit consent before sharing your data.
8. International Data Transfers
Trestle Cart operates internationally with offices in Pakistan and the United Kingdom, serving clients primarily in North America, Europe, and Australasia. Your data may be transferred to and processed in countries outside your own, including Pakistan, the United Kingdom, and the United States (where our third-party processors such as Google, Meta, Stripe, and Formspree are based).
For transfers from the EEA or UK to countries without an adequacy decision from the European Commission, we rely on Standard Contractual Clauses (SCCs) as adopted by the European Commission, the UK International Data Transfer Agreement (IDTA) where applicable, and processor certifications under the EU-US Data Privacy Framework where available.
Our UK office provides a point of contact within a jurisdiction recognised as having adequate data protection standards by the European Commission.
9. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:
| Data Category | Retention Period | Reason |
|---|---|---|
| Contact form submissions | 24 months from last interaction | Follow-up and business development |
| Client project data | Duration of engagement + 36 months | Portfolio, warranty, and dispute resolution |
| Financial records | 7 years | Tax and legal compliance |
| Marketing email subscribers | Until unsubscribe + 30 days | Processing unsubscribe request |
| Website analytics data | 14 months (GA4 default) | Traffic analysis |
| Server logs | 90 days | Security and debugging |
| Cookie consent records | 365 days | Compliance documentation |
When the retention period expires, data is securely deleted or anonymised so that it can no longer be associated with you.
10. Your Rights
Depending on your location, you may have the following rights regarding your personal data. We honour these rights regardless of your jurisdiction where technically feasible:
Right of Access — You can request a copy of all personal data we hold about you. We will respond within 30 days.
Right to Rectification — If any data we hold is inaccurate or incomplete, you can request correction.
Right to Erasure (“Right to be Forgotten”) — You can request deletion of your personal data. We will comply unless we have a legal obligation to retain it (such as financial records).
Right to Restrict Processing — You can ask us to limit how we use your data while a complaint or request is being resolved.
Right to Data Portability — You can request your data in a structured, commonly used, machine-readable format (such as CSV or JSON).
Right to Object — You can object to processing based on legitimate interest, including direct marketing. We will cease processing unless we have compelling legitimate grounds.
Right to Withdraw Consent — Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing that occurred before withdrawal.
Right to Lodge a Complaint — EEA residents may lodge a complaint with their local Data Protection Authority. UK residents may contact the Information Commissioner’s Office (ICO).
To exercise any of these rights, contact us at privacy@trestlecart.com. We will verify your identity before processing requests and respond within 30 days. Complex requests may take up to 60 days, in which case we will notify you of the extension.
11. Data Security
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:
Encryption in Transit — All data transmitted between your browser and our website is encrypted using TLS 1.2+ (HTTPS). Our SSL certificate is verified and maintained.
Encryption at Rest — Client credentials and sensitive project data shared with us are stored in encrypted systems.
Access Controls — Internal access to personal data is restricted to team members who require it for their role. We follow the principle of least privilege.
Secure Form Processing — Contact form submissions are processed through Formspree over encrypted connections and are not stored in our website’s database.
Payment Security — We do not store credit card numbers or payment credentials. All payment processing is handled by Stripe, which is PCI-DSS Level 1 certified — the highest level of security certification in the payments industry.
Regular Reviews — We periodically review our security practices and update them in line with industry standards.
While we take every reasonable precaution, no method of data transmission or storage is completely secure. If you believe your personal data has been compromised, please contact us immediately at privacy@trestlecart.com.
12. Children’s Privacy
Our website and services are designed for business professionals and are not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a minor, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at privacy@trestlecart.com.
13. California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
Right to Know — You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that data, the business purposes for collection, and the categories of third parties with whom we share it.
Right to Delete — You may request deletion of your personal information, subject to certain legal exceptions.
Right to Opt-Out of Sale — We do not sell personal information as defined by the CCPA. We do not share personal information for cross-context behavioural advertising.
Right to Non-Discrimination — We will not discriminate against you for exercising your CCPA rights.
To make a request, contact us at privacy@trestlecart.com with the subject line “California Privacy Request”.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or legal requirements. When we make material changes, we will update the “Last Updated” date at the top of this page and, where appropriate, notify you via email or a prominent notice on our website.
We encourage you to review this page periodically. Your continued use of our website or services after any changes constitutes acceptance of the updated policy.
15. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, we welcome you to reach out:
Privacy Enquiries
Email: privacy@trestlecart.com
General: hello@trestlecart.com
Website: trestlecart.com
Postal Address:
Trestle Cart — Privacy
Suite 401, Business Bay, Shahrah-e-Faisal
Karachi 75400, Pakistan
We aim to respond to all privacy-related enquiries within 5 business days.