Website Compliance Audit

The audit reviewed the public homepage, Products, About, Shipping Information, Wholesale, Contact and Privacy Policy pages, together with the visible cookie-banner wording and Shopify's current merchant-cookie documentation. It did not place an order, enter payment details or access the Shopify administration area.

Finding: The visible banner wording offers an Accept route. The public Privacy Policy, however, states that visitors can accept, reject or manage optional cookies. This mismatch creates both a compliance issue and a customer-trust issue.

Required implementation

• First layer buttons: Accept all, Reject non-essential and Manage preferences, with comparable prominence.
• Second layer categories: Necessary, Functional, Analytics, Advertising and Social Media, with all optional categories off by default.
• Block Google Analytics, Google Ads, Meta Pixel, TikTok Pixel and other non-essential app scripts until the relevant consent is recorded.
• Retain a permanent Cookie Settings link or icon in the footer so choices can be changed at any time.
• Record consent evidence, including timestamp, region, policy/version and category choices.
• Re-request consent when purposes or material vendor use changes. Do not repeatedly prompt people who have rejected cookies merely to obtain a different answer.

The corrected Cookie Policy contains Shopify's currently documented merchant-storefront cookies, plus conditional rows for Google, Meta and TikTok because those providers are declared in the site's Privacy Policy. A browser-level scan should be run after the consent manager is corrected because Shopify apps, pixels and checkout settings can add or remove identifiers.

• Use the legal controller name consistently: Stateside Distribution Limited, trading as Gummi Popz UK.
• Use company number 14244985.
• Use the address supplied for the site: Unit L2, Troon Way Business Centre, Humberstone Lane, Leicester, LE4 9HA, United Kingdom.
• Use info@gummipopz.co.uk as the privacy contact unless a dedicated privacy mailbox is created.
• Keep one clear Privacy Policy and one separate Cookie Policy. Avoid duplicating UK GDPR rights sections inside the Cookie Policy.
• Do not make contacting Stateside a condition of complaining to the ICO; invite contact while preserving the direct complaint right.

Add a short notice immediately beside each form submission button. Marketing consent should not be bundled into customer-service or wholesale enquiries. If a separate marketing opt-in is offered, use an unticked box and identify the channel and sender.

• Correct visible product spacing errors such as "A mazing", "S weet" and "S our".
• Use descriptive alternative text for product and lifestyle images instead of generic "Image" labels.
• Use one heading hierarchy per page and descriptive link labels rather than repeated generic calls to action where possible.
• Ensure colour contrast, keyboard focus, form labels and validation messages work on mobile and desktop.
• Add meaningful page titles and meta descriptions for Products, Wholesale, Stockists and Shipping Information.
• Check that decorative imagery has empty alt text and that informative imagery describes the product or content shown.

The product, mystery-toy concept and colourful social-led branding may be attractive to children. The site should document whether it is likely to be accessed by under-18s and, if so, complete a Children's Code assessment.

• Maintain high privacy by default and do not use nudges to encourage children to enable tracking.
• Avoid behavioural advertising based on known or inferred child data.
• Do not collect date of birth or age unless there is a defined, proportionate purpose.
• Make competition, user-generated-content and influencer mechanics age appropriate and use parental consent where required.
• Keep product purchase and marketing terms clear that orders and consent choices are to be made by adults.

The linked Terms & Conditions page was not fully tested through checkout during this review. Before taking consumer orders, verify:

• Full trader identity, contact details, total price, delivery charges and delivery restrictions are shown before purchase.
• The cancellation and refund position correctly accounts for sealed food or hygiene-sensitive goods and does not remove statutory rights more broadly than permitted.
• Product pages display accurate ingredients, allergens, net quantity, storage instructions, responsible food business details and any required warnings before checkout.
• Mystery-toy products clearly describe what is included, age suitability and applicable toy-safety warnings without making misleading size or assortment representations.
• Promotional claims, countdowns, scarcity statements, customer reviews and influencer endorsements are genuine, supportable and appropriately disclosed.

This was a public-facing website and policy review. It did not inspect the Shopify administration area, consent logs, tag-manager configuration, server-side tracking, checkout payment flows, app settings or browser storage through developer tools. Those items must be technically validated before describing the implementation as compliant. This report is a practical compliance review and not a substitute for advice from a solicitor or data-protection specialist.