Privacy policy

This policy explains what personal data we collect, why, and what rights you have. It is written to meet the UK GDPR and the Data Protection Act 2018.

Who is the data controller

[COMPANY NAME], [REGISTERED ADDRESS]. Contact for any privacy question: [SUPPORT EMAIL].

What we collect

• Order data — name, delivery address, email, phone number, order contents. Needed to fulfil your order (contractual necessity).
• Payment data — handled by our payment providers. We receive a confirmation and the last four digits, never your full card number.
• Account data — if you create an account, your login details and order history.
• Marketing data — your email address, only if you opt in (consent). You can withdraw at any time from any email.
• Technical data — IP address, browser, pages viewed, through cookies and analytics (consent, except for strictly necessary cookies).

Why we use it

To process and deliver your order, to provide customer support, to prevent fraud, to meet our legal accounting obligations, and — where you have agreed to it — to send you offers.

Who we share it with

Only with the parties needed to run the shop: Shopify (our store platform), our payment providers, our delivery carriers, and our email tool. They act on our instructions and may not use your data for their own purposes. We never sell your data.

How long we keep it

Order and invoice data: 6 years, as required for tax purposes. Marketing data: until you unsubscribe. Account data: until you ask us to delete the account.

Your rights

You have the right to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. Write to [SUPPORT EMAIL] and we will answer within one month. If you are not satisfied, you can complain to the Information Commissioner’s Office (ico.org.uk).

Cookies

We use strictly necessary cookies to make the basket and checkout work, and — with your consent — analytics and advertising cookies. You can change your choice at any time through the cookie banner.

Transfers outside the UK

Some of our providers process data outside the UK. Where that happens, the transfer is covered by an adequacy decision or by standard contractual clauses.

Last updated: [DATE]