Privacy policy
Last updated: 16 July 2026
1. Who we are
[LEGAL NAME LTD], trading as [BRAND] ("we", "us", "our"), operates [WEBSITE]. We are the data controller for the personal data described in this policy.
- Registered address: [LEGAL ADDRESS]
- Company number: [COMPANY NUMBER]
- Contact for privacy matters: [EMAIL]
- Phone: [PHONE]
2. What data we collect
We collect:
- Identity & contact data: name, billing/delivery address, email, phone number.
- Order & payment data: items ordered, order history, and payment confirmation. Card details are handled by our payment providers — we do not store full card numbers.
- Technical data: IP address and device/browser type, collected by our hosting provider's standard server logs.
- Communications: messages you send us by email or through our contact form.
- Marketing preferences: whether you've opted in to marketing.
3. Why we use it and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Processing and delivering your order, managing your account | Performance of a contract |
| Responding to enquiries and providing support | Legitimate interests / contract |
| Sending marketing emails | Consent (or soft opt-in for existing customers) |
| Fraud prevention and site security | Legitimate interests |
| Meeting legal/tax obligations | Legal obligation |
4. Who we share it with
We share data only with parties who help us run the business, including:
- Payment processors: Stripe and PayPal
- Delivery/courier partners: Royal Mail and DPD
- Website hosting provider
- Email/marketing tools: Mailchimp (only if you opt in to marketing)
We may also disclose data where legally required (for example, a court order or a request from a tax authority). We do not sell your personal data.
5. International transfers
Where a provider stores data outside the UK, we ensure it's protected by an adequate-country decision or appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
6. How long we keep it
- Order & transaction records: 6 years (to meet UK tax and accounting rules).
- Account data: while your account is active, then 24 months after closure.
- Marketing data: until you unsubscribe.
- Support messages: 24 months.
7. Your rights
Under UK GDPR you have the right to: access your data; correct it; erase it; restrict or object to processing; data portability; and withdraw consent at any time.
To exercise any right, contact us at [EMAIL]. We'll respond within one month. We may ask you to verify your identity first.
8. Complaints
If you're unhappy with how we handle your data, you can complain to us directly at [EMAIL] and we'll investigate. You also have the right to complain to the Information Commissioner's Office (ICO) — ico.org.uk, or 0303 123 1113.
9. Cookies and local storage
Our website does not set non-essential cookies and does not use analytics or advertising cookies. The only thing stored in your browser is a single strictly-necessary local-storage entry that remembers your currency choice (EUR or GBP). You can clear it at any time through your browser settings. If we introduce non-essential cookies in future, they will only be set with your consent via a cookie banner.
10. Changes to this policy
We may update this policy from time to time. The "last updated" date shows the latest version. Material changes will be notified on this page.