Privacy Policy

1. Who We Are and How to Contact Us

We are the data controller for the personal data we collect through this website. Our contact details are on the Contact page. For data protection enquiries, please use the same contact route and specify "Privacy" or "Data Protection".

2. What Data We Collect

We may collect and process the following categories of personal data:

• Identity and contact: name, email address, phone number, billing and delivery address.
• Transaction: order history, payment information (processed by our payment providers; we do not store full card numbers).
• Account: login credentials, preferences, wishlist, and any information you provide in your account or when contacting us.
• Technical and usage: IP address, device type, browser type, pages visited, and cookie data (see our Cookie & GDPR Policy).
• Marketing: if you opt in, your email and preferences for newsletters and promotions.

3. How We Use Your Data and Legal Basis

We process your data only where we have a lawful basis:

• Contract: to process and deliver orders, manage your account, and provide customer support. Necessary for performing our contract with you.
• Legal obligation: to comply with tax, accounting, and regulatory requirements (e.g. retaining transaction records).
• Legitimate interests: to improve our site, prevent fraud, enforce our terms, and run our business (e.g. analytics, security), where these interests are not overridden by your rights.
• Consent: for marketing communications and, where required by law, for non-essential cookies. You can withdraw consent at any time.

4. Who We Share Data With

We may share your data with: (a) payment processors to complete transactions; (b) delivery partners (e.g. Royal Mail) to fulfil orders; (c) IT and hosting providers that support our website; (d) professional advisers where necessary; and (e) authorities when required by law. We do not sell your personal data. Third parties we use are required to protect your data and use it only for the purposes we specify.

5. International Transfers

Your data may be processed in the UK and, where we use services based elsewhere (e.g. in the EU or USA), we ensure appropriate safeguards are in place (such as adequacy decisions, standard contractual clauses, or other approved mechanisms) so that your data is protected in line with UK and, where applicable, EU data protection law.

6. Data Retention

We keep your data only for as long as necessary: (a) for the purposes for which it was collected; (b) to satisfy legal, accounting, or regulatory requirements (e.g. we may retain order data for up to six years for tax purposes); and (c) to resolve disputes and enforce our agreements. When data is no longer needed, we delete or anonymise it securely.

7. Your Rights (UK/EU/EEA)

If you are in the United Kingdom, European Union, or European Economic Area, you have the following rights under UK GDPR and/or the EU General Data Protection Regulation:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of your data where there is no compelling reason for us to keep it.
• Restrict processing: request that we limit how we use your data in certain circumstances.
• Data portability: request a copy of your data in a structured, machine-readable format where applicable.
• Object: object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: where we rely on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

To exercise any of these rights, contact us via the Contact page. You also have the right to lodge a complaint with a supervisory authority (in the UK, the Information Commissioner's Office, ico.org.uk).

8. Global Customers (e.g. USA, CCPA)

If you are in a jurisdiction with additional privacy laws (for example, California under the CCPA), you may have extra rights such as the right to know what personal information we collect, the right to delete, and the right to opt out of the "sale" of personal information. We do not sell personal information as defined under the CCPA. For requests under such laws, please contact us and we will respond in accordance with the applicable law.

9. Security

We use appropriate technical and organisational measures to protect your data against unauthorised access, loss, or alteration. No method of transmission or storage is 100% secure; we cannot guarantee absolute security but we take your privacy seriously.

10. Children

Our site is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The current version will be posted here with an updated date. We encourage you to review it periodically. Significant changes may be communicated by email or a notice on the site where appropriate.