Last updated: 2026-09-23 · Version: 2.0
1. Who is responsible for your data
JustForPetStore (“we”, “us”, “the Platform”) operates an online wholesale marketplace for pet supplies at justforpetstore.com, offering three programmes: Wholesale, Dropship (membership-based) and curated KITs, plus Local Stock — a service where members publish inventory available in their own country for other members to collect locally.
Data controller
| Field | Value |
|---|---|
| Legal entity name | Global Pet Index Inc (a Wyoming profit corporation) |
| Registered office | c/o Registered Agents Inc, 30 N Gould St Ste R, Sheridan, WY 82801, United States |
| Company registration no. | 2026-002040222 (Wyoming Secretary of State, filed 26 July 2026) |
| VAT ID (if any) | Not applicable (US entity) |
| Email for privacy requests | sinopetin@gmail.com |
| EU/EEA representative (Art. 27) | Not appointed — not required for our processing activities (see the note below) |
Note on the Art. 27 representative: Global Pet Index Inc has no establishment in the EU/EEA, and we have assessed that we are not required to appoint a representative under Art. 27 GDPR. That obligation applies only where the Art. 3(2) conditions are met and the processing is not occasional, involves special categories of data on a large scale, or is likely to result in a high risk to the rights of individuals. The personal data we process about EU users is limited to ordinary business-account data (contact details, order and billing records) processed occasionally in the course of providing the Platform services. We therefore operate without a designated EU/EEA representative.
We keep this assessment under review. If our EU-related processing ever meets an Art. 27 trigger, we will appoint a representative and update this section before that processing begins. In the meantime, EU users can exercise all of their rights via the contact address above.
2. Who uses the Platform
We serve three groups, and process different data for each:
- Buyers — independent retailers, pet shops, and dropsellers purchasing stock.
- Suppliers / Vendors — factories and distributors listing products, including via the Supplier Portal and Supplier Dashboard.
- Visitors — anyone browsing anonymously.
- Members — buyers or suppliers holding an approved Dropship account (no monthly fee; 6% commission on settled orders).
3. What we collect, and why
3.1 Data you give us
| Category | Examples | When |
|---|---|---|
| Account data | Name, email, password (hashed), company name, role (buyer / supplier) | Registration, My Account |
| Contact & address | Billing/shipping address, city, postcode, country, phone | Checkout, profile |
| Business profile | Company details, tax/VAT number, warehouse locations, categories supplied | Supplier application, Supplier Portal |
| Membership data | Tier, subscription period start/end, listing quota used, credit line used | Membership purchase and renewal |
| Wallet & credit data | Wallet balance, deposits, top-ups, transaction history | Wallet / deposit flows |
| Order data | Products, quantities, prices, MOQ metadata, shipping choice | Checkout |
| RFQ content | Specifications, target volumes, target prices, deadlines, attachments | Request-a-Quote |
| Local Stock content | Exact country / state / city, quantity, unit price, quantity-discount tiers, inventory age, packaging state, resale notes, brand and authorisation status, offered logistics, delivery coverage, validity window | Publishing a Local Stock offer |
| Correspondence | Messages exchanged through the Platform, support tickets | Contact forms, account messaging |
3.2 Data collected automatically
| Category | Examples |
|---|---|
| Technical | IP address, browser type and version, device type, operating system, referring URL |
| Usage | Pages viewed, on-site clicks, search terms, view counts of your Local Stock offers |
| Cookies / similar | See the separate Cookie Policy |
| Fraud & security | Signals used to detect automated abuse, including our origin-protection layer |
We use self-hosted Matomo analytics (matomo.podpaws.com), which we configure to respect Do-Not-Track and can be operated without cookies. Analytics cookies are only set after you give consent.
3.3 Data from third parties
Payment status and limited card metadata from Stripe and WooCommerce Payments (we never store full card numbers), and, if you use it, PayPal. We may also receive delivery status updates from carriers.
3.4 The iOS app
The Just For Pet Store iOS app is a client for this website; it does not run a separate service or a separate database.
When you sign in, the app exchanges your email address and account password for a revocable WordPress Application Password.
That Application Password, not your account password, is what the app stores, inside the iOS Keychain, and it is the only
credential held on the device. You can revoke it at any time from your account page on the website, which immediately breaks
the app’s access.
The app also stores your chosen role (Buyer, Supplier or Admin) in iOS system storage so the app reopens on the screen you
last used. This is device-local and is not transmitted to us.
If you turn on location services and use the Local Stock feature, your coordinates are sent once to our server to find stock
near you. Coordinates are not written to our database and are not retained after the lookup. Declining the location prompt
leaves every other part of the app fully usable.
Payments made in the app are processed by Stripe, including the Apple Pay sheet described in section 3.3. Membership
subscriptions purchased through Apple’s App Store are billed by Apple and are subject to Apple’s privacy policy as well as
this one.
4. Legal bases for processing (GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Creating and running your account; fulfilling orders; delivering products | Art. 6(1)(b) — performance of a contract |
| Managing your Dropship membership, quotas, credit line and Local Stock entitlements | Art. 6(1)(b) — performance of a contract |
| Taking payment, invoicing, accounting records | Art. 6(1)(b) and (c) — contract and legal obligation |
| Publishing your Local Stock offer and showing it to other members | Art. 6(1)(b) — contract; the publication itself is the service |
| Showing other members’ contact route so a transaction can be concluded | Art. 6(1)(b) and (f) — contract and legitimate interest |
| Supplier verification, fraud prevention, platform integrity, chargeback defence | Art. 6(1)(f) — legitimate interests |
| Website analytics (Matomo), product improvement | Art. 6(1)(a) — consent (withdrawable at any time) |
| Marketing emails about our own services | Art. 6(1)(a) — consent (opt-in); soft opt-in for existing customers where permitted |
| Responding to lawful requests from authorities; tax and consumer-law retention | Art. 6(1)(c) — legal obligation |
You may withdraw consent at any time; withdrawal does not affect processing already carried out.
5. Who receives your data
We do not sell personal data. We disclose it only to:
| Recipient type | Purpose | Safeguard |
|---|---|---|
| Stripe / WooCommerce Payments (and PayPal if selected) | Payment authorisation, payouts, refunds, chargebacks | PCI-DSS processor; acting as independent controller for fraud prevention |
| Hostinger (hosting, hCDN, LiteSpeed Cache) | Running the site and delivering content | Data processing agreement |
| Matomo (self-hosted instance) | Website analytics | Cookieless configuration available; IP anonymisation |
| Email delivery provider | Account and transactional emails [ PROVIDER NAME ] | DPA |
| Carriers / logistics partners | Delivery of orders you place | Only the data needed for shipment |
| Other members — only what you choose to publish | So counterparties can transact | Your exact street address is never published; Local Stock shows only country / state / city, and initial contact takes place through the Platform |
| Professional advisers, auditors, authorities | Legal compliance | Bound by law or contract |
5.1 Transfers outside the EEA
Hosting and payment infrastructure may be located in the United States. Where personal data leaves the EEA we rely on: (i) an adequacy decision where available, (ii) European Commission Standard Contractual Clauses, supported by a transfer impact assessment and technical measures (encryption in transit, access control, data minimisation), or (iii) another Art. 46 safeguard. You may request a copy of the relevant safeguards at the contact address in section 1.
6. How long we keep it
| Data | Retention |
|---|---|
| Account and profile | While the account is active, then up to 24 months after closure for dispute purposes |
| Orders, invoices, payments | 7 years as required for US federal/state accounting and tax purposes |
| Membership and billing records | Contract term + statutory accounting period |
| Wallet / credit transactions | 7 years (same as accounting records) |
| RFQ submissions | 24 months from last activity |
| Local Stock offers | Until the validity date you set, or withdrawal; removed from public view immediately, retained 12 months then deleted |
| Support correspondence | 24 months |
| Analytics (consent-based) | 13 months maximum, then aggregated/anonymised |
| Marketing consent evidence | Until consent withdrawn + 3 years |
7. Cookies and similar technologies
Covered in detail in our Cookie Policy. In short: strictly necessary cookies run without consent; statistics and marketing cookies run only after you consent, and you can refuse or withdraw them without any loss of core functionality.
8. Your rights
Under GDPR you may:
- Access a copy of the personal data we hold about you (Art. 15);
- Rectify inaccurate or incomplete data (Art. 16);
- Erase your data where no overriding legal ground applies (Art. 17);
- Restrict processing while a dispute is resolved (Art. 18);
- Receive your data in a structured, machine-readable format, or have it transmitted elsewhere (Art. 20);
- Object to processing based on legitimate interests, and object to direct marketing absolutely (Art. 21);
- Withdraw consent at any time for analytics and marketing (Art. 7(3));
- Not be subject to a decision based solely on automated processing with legal or similarly significant effects (Art. 22) —
we do not make such decisions; pricing and entitlement are set by the published membership rules, not by automated profiling;
- Complain to a supervisory authority, e.g. your national data protection authority, or the authority of your habitual
residence or place of work (Art. 77).
To exercise any right, email sinopetin@gmail.com (section 1). We respond within one month, extendable by two further months for complex requests, and we will tell you if that happens. We may need to verify your identity first.
9. Children
The Platform is a B2B service intended for people aged 18 and over acting in a business capacity. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.
10. Security
We use TLS encryption in transit, hashed and salted passwords, role-based access control separating buyers from supplier administration, least-privilege access to production databases, activity logging, backups, and an origin-protection layer against automated abuse. No online system can be guaranteed absolutely secure; please use a strong, unique password and tell us immediately at sinopetin@gmail.com if you suspect unauthorised access.
11. Breach notification
Where a personal data breach is likely to result in a risk to your rights and freedoms we notify the competent supervisory authority within 72 hours of becoming aware (Art. 33), and notify affected users without undue delay where the risk is high (Art. 34).
12. Changes
We will post any change to this Policy here with an updated “Last updated” date. Material changes will be notified by email to registered business users or by an on-site notice at least 30 days before taking effect.