Privacy Policy

Effective date: 8 September 2026

This Privacy Policy explains how we handle personal information in connection with our website, orders and customer service. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR), including applicable Cookie rules.

Personal information we collect

Depending on your interaction with us, we may collect identity and contact details; billing and delivery details; order, payment-status, refund and transaction records; account information; messages and customer-service records; device, browser, IP address and approximate location data; website usage, cart and checkout activity; Cookie identifiers; marketing preferences; and fraud or security signals. We do not receive or store complete payment-card numbers or card security codes.

Sources and purposes

We obtain information directly from you, automatically from your device and use of our website, and from Shopify, authorised payment providers, delivery and fulfilment providers, analytics providers, advertising providers, fraud-prevention services and customer-support services.

We use information to operate and secure our website; provide carts and checkout; take payment; accept, fulfil, track and deliver orders; manage cancellations, returns and refunds; answer enquiries; prevent fraud; keep tax, accounting and legal records; improve our services; measure performance; and, where permitted, provide marketing and advertising.

Lawful bases

Our lawful bases under the UK GDPR may include performance of a contract, taking steps at your request before entering a contract, compliance with a legal obligation, our legitimate interests where those interests are not overridden by your rights, and consent where consent is required. Where processing relies on consent, you may withdraw it at any time without affecting processing that was lawful before withdrawal.

Service providers and disclosures

Shopify hosts and supports our online store and processes data needed to operate it. Authorised payment providers process payment information. Delivery and fulfilment providers receive information needed to deliver orders. Analytics and advertising providers process data only where a lawful basis applies and, for non-essential Cookies or tracking, after valid consent where required. We may also disclose information to professional advisers, fraud-prevention providers, regulators or public authorities where legally required.

Cookies and tracking technologies

Strictly necessary Cookies used for the shopping cart, checkout, authentication, fraud prevention and security may be used without consent where the law permits. Non-essential analytics, advertising, personalisation and tracking Cookies or similar technologies are not placed or activated until we have obtained valid consent where PECR requires it. You may change or withdraw Cookie consent through available preference controls.

Retention

We retain personal data only for as long as reasonably necessary for the purpose collected, including providing an order or service, resolving disputes, preventing fraud and meeting legal, tax and accounting obligations. Retention periods vary by record type; when data is no longer required, it is deleted or anonymised unless the law requires continued retention.

Security

We use reasonable technical and organisational measures designed to protect personal data, including access controls, secure communications, service-provider safeguards, monitoring and procedures for responding to security incidents. No system is completely secure.

International transfers

Shopify or another service provider may process data outside the United Kingdom when necessary to provide its services. Where a restricted international transfer occurs, we use an appropriate UK GDPR transfer mechanism, such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to standard contractual clauses, or another lawful safeguard, and apply supplementary measures where appropriate.

Your UK data-protection rights

Subject to legal conditions and exceptions, you may request access, correction, deletion, restriction of processing and data portability, and may object to processing. You may also withdraw consent at any time where consent is the lawful basis. We may need to verify your identity before responding.

You have the right to complain to the UK Information Commissioner's Office (ICO). We encourage you to contact us first so we can try to resolve the concern, but this does not affect your right to contact the ICO.

Children

Our website is not directed to children, and we do not knowingly use children's personal data for behavioural advertising.