Privacy policy
Last updated: 29 July 2026
Who we are
[LEGAL COMPANY NAME — TO BE COMPLETED], [REGISTERED ADDRESS — TO BE COMPLETED], [COUNTRY OF INCORPORATION — TO BE COMPLETED]. Company number [VAT / COMPANY NUMBER — TO BE COMPLETED]. We are the data controller for the information described here.
Questions about your data: [CONTACT EMAIL — TO BE COMPLETED]
What we collect, and why
We collect as little as we can get away with. Here is all of it.
When you buy something
| What | Why | Legal basis (GDPR) |
|---|---|---|
| Name, delivery address, email, phone | To ship the order and tell you where it is | Performance of a contract |
| Order contents and value | To fulfil the order and handle returns | Performance of a contract |
| Payment confirmation | To confirm you paid | Performance of a contract |
| Billing country | To apply the right tax | Legal obligation |
We keep order records for as long as tax and accounting law requires, typically six years.
We never see your card number. It goes straight from your browser to our payment processor. We receive a yes or no and the last four digits.
When you join our email list
Your email address, and only if you actively ask for it. We keep it until you unsubscribe. Every email has an unsubscribe link that works in one click. Consent is the legal basis, and you can withdraw it at any time.
When you visit the site
Our shop platform sets cookies that make the basics work — keeping your cart, keeping you logged in, keeping checkout secure. These cannot be switched off without breaking the site.
Anything beyond that — analytics, advertising — only runs if you agree to it in the cookie banner. Decline and nothing loads. You can change your mind whenever you like.
Who else touches your data
Only companies that need it to get your order to you:
- Shopify — runs the shop and stores order data
- Our payment providers — process the payment
- Our shipping carriers — deliver the parcel; they get your name, address and phone
- Our email provider — sends order updates and, if you asked for them, marketing emails
Each is bound by a contract to process your data only on our instructions.
We do not sell your data. We do not rent it. We do not trade it. There is no version of this business where that would be worth it to us.
Where your data goes
Some of these providers are outside the EU and UK. When data leaves, it is protected by either an adequacy decision from the European Commission or the Standard Contractual Clauses. If you want to know exactly which mechanism applies to a specific provider, ask us at [CONTACT EMAIL — TO BE COMPLETED] and we will tell you.
Your rights
Under the GDPR and the UK GDPR you can ask us to:
- Show you what we hold about you
- Correct anything wrong
- Delete it, where we are not legally required to keep it
- Stop or limit how we use it
- Hand it over in a portable format, to you or to another company
- Object to any processing based on legitimate interests
Write to [CONTACT EMAIL — TO BE COMPLETED]. We answer within one month, and it costs nothing.
If we get it wrong, you can complain to your national data protection authority. In the UK that is the Information Commissioner's Office at ico.org.uk. In the EU it is the authority in the country where you live.
Automated decisions
We do not make automated decisions that have a legal or similarly significant effect on you. No profiling, no scoring, no algorithm deciding what you get to see or pay.
Children
This site is for adults. We do not knowingly collect data from anyone under 16. If you believe a child has given us their data, write to [CONTACT EMAIL — TO BE COMPLETED] and we will delete it.
Security
Everything travels over an encrypted connection. Access to order data is limited to the people who need it to do their job. If a breach ever puts your rights at risk, we will tell you and the relevant authority within 72 hours, as the law requires.
Changes
If we change how we handle your data in any way that matters, we will update the date at the top and, where the law requires it, tell you directly.