Legal
Privacy policy
Last updated: [DATE]
This policy explains what personal data [LEGAL NAME LTD] collects when you shop with us, why we hold it, and the rights you have over it under UK data-protection law.
1. Who we are
[LEGAL NAME LTD] ("we", "us", "our") trades as [BRAND] and operates [WEBSITE]. We are the data controller for the personal data described here.
- Registered address: [LEGAL ADDRESS]
- Company number: [COMPANY NUMBER]
- Privacy contact: [EMAIL]
- By phone: [PHONE]
2. What data we collect
- Identity and contact data — your name, billing and delivery address, email and phone number.
- Order and payment data — the items you order, your order history and payment confirmation. Card details are handled by our payment provider; we never store full card numbers.
- Technical data — IP address, device and browser type, and cookie data.
- Communications — anything you send us by email or through a contact form.
- Marketing preferences — whether you've chosen to hear from us.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Processing and delivering your order and managing your account | Performance of a contract |
| Answering enquiries and providing support | Legitimate interests / contract |
| Sending marketing emails | Consent (or soft opt-in for existing customers) |
| Fraud prevention and site security | Legitimate interests |
| Analytics to improve the website | Consent (via cookies) |
| Meeting legal and tax obligations | Legal obligation |
4. Who we share it with
We share data only with the partners who help us run the shop — our payment processor, delivery and courier partners, our website and hosting platform, our email tools and our analytics provider. Each handles your data under contract and only for the purpose we set.
We may also disclose data where the law requires it, such as a court order or a request from a tax authority. We do not sell your personal data.
5. International transfers
Where a provider stores data outside the UK, we make sure it is protected either by an adequacy decision or by appropriate safeguards, such as the UK International Data Transfer Agreement or the Addendum to the EU Standard Contractual Clauses.
6. How long we keep it
- Order and transaction records: 6 years, to meet UK tax and accounting rules.
- Account data: while your account is active, then 12 months after you close it.
- Marketing data: until you unsubscribe.
- Support messages: 24 months.
7. Your rights
Under UK GDPR you can ask us to give you access to your data, correct it, erase it, restrict or object to how we use it, port it elsewhere, and withdraw consent at any time. To exercise any of these, email [EMAIL]. We'll reply within one month and may first ask you to confirm your identity.
8. Complaints
If you're unhappy with how we've handled your data, please tell us first at [EMAIL] so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
9. Cookies
Our website uses cookies. Non-essential cookies — analytics and advertising — are only set once you agree through our cookie banner. You can change your choice at any time from the same banner.
10. Changes to this policy
We may update this policy from time to time; the "last updated" date above always shows the current version. If we make a material change, we'll flag it on this page.