Privacy Policy
Last updated
Who we are
This store is the data controller for the personal data described here. Our contact details are on the contact page.
What we collect and why
To fulfil your order. Your name, email address, delivery address, billing address and telephone number. We need these to take payment, ship your parcel and contact you if something goes wrong. The lawful basis is performance of a contract.
To take payment. Card details are entered directly into Stripe's hosted payment fields and are never sent to or stored on our servers. We receive only the card brand, the last four digits and whether the payment succeeded.
To keep your cart. A cart identifier stored in a strictly necessary cookie, so your basket survives a refresh. No consent is required for this and it carries no marketing data.
To send marketing. Your email address, if and only if you have explicitly opted in. The lawful basis is consent, and you can withdraw it at any time from the link at the bottom of every marketing email.
To detect fraud and abuse. A salted hash of the IP address used to place an order, and your browser's user agent string. We do not store raw IP addresses against orders. The lawful basis is our legitimate interest in preventing fraudulent transactions.
Analytics
If you accept analytics cookies, we use Google Analytics 4 and, where configured, Meta Pixel to understand how the site is used. Product and order values are shared with those services; your name, email address and postal address are not. Decline analytics cookies and no analytics scripts are loaded at all.
Who we share data with
- Stripe — payment processing.
- Our email provider — order confirmations and other transactional email.
- Our carriers — name, address and telephone number, to deliver your parcel.
- Supabase — our database and file hosting provider.
We do not sell personal data, and we do not share it with anyone else for their own marketing.
How long we keep it
Order records are retained for seven years to meet tax and accounting obligations. Marketing consent records are kept until you withdraw consent and for two years afterwards, so we can demonstrate that you did. Abandoned cart data is deleted after 30 days.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict how we use it, or to receive it in a portable format. You can object to processing based on legitimate interests. Email us and we will respond within one month. If you are not satisfied, you may complain to your national data protection authority.