Privacy
we collect what we need to send you a parcel and keep a record of the sale. we do not build a profile of you, we do not sell anything about you, and there is no advertising or analytics tracking on this site at all.
What we collect
when you place an order:
- your name and delivery address, because a parcel needs somewhere to go;
- your email address, because that is how we confirm the order and tell you it has been sent;
- what you bought, what you paid and when, because that is the record of a sale and we are required to keep it;
- a payment reference from our payment provider. we never see your card number. it goes from you to the provider and never touches this site.
your basket is not on this list, because it is not ours until you check out. it is stored in your own browser and never reaches our server until you place the order. clearing your browser data clears it, and we would never know it existed.
If you make an account
an account is optional. you can buy everything on this site as a guest, and nothing about the order is different if you do.
if you make one, we hold:
- your email address and your name, because that is what you sign in with and what we call you;
- your password, stored only as a one way hash. we cannot read it, and nobody here can tell you what it is;
- the delivery addresses you choose to save, so the checkout can fill itself in. saving one is your choice and you can remove it at any time;
- whether you asked us to email you about new pieces. that one is off unless you switch it on, and you can switch it back off from your account.
your order history is not a separate thing we keep for the account. the page simply shows the orders already placed on your email address, which is why an order you placed as a guest appears there once you confirm that address on an account.
confirming is the link in the email we send when the account is opened, and the history waits for it. anyone can type anyone’s address into a sign up form, so the account on its own is a claim; opening the link is what shows the inbox is yours. we also record the moment you did it, because it is the evidence that we were right to show you the orders.
we keep the account for as long as you want it. close it and the sign in, your name and your saved addresses are deleted.
Closing your account
sign in, open your account page, and use closing your account at the bottom. we ask for your password first, so that an open browser is not enough to do it. it takes effect immediately and it cannot be undone.
one thing survives it, and it is worth being plain about. closing your account does not delete orders you have already placed. those are sales and vat records, and the law requires us to keep them for six years, so they stay exactly as long as they would have if you had never made an account at all. what goes is the way in: the password, the name on the account, the saved addresses and the email preference. what stays is the record of what was sold, to which address, and for how much.
What we do not do
no analytics. no advertising pixels. no third-party scripts of any kind. the site is configured to refuse to load them, so this is not a promise about intent but about what the code will permit.
the only cookies in play are the ones needed to make a purchase work and, if you have an account, the one that keeps you signed in to it. both are strictly necessary, so there is no consent banner: there is nothing to consent to.
Why we are allowed to hold it
- to perform our contract with you — your name, address, email and order. without these there is no way to fulfil an order.
- because the law requires it — sales and vat records, which hmrc requires us to keep.
we do not rely on legitimate interests to justify holding anything about you, because we do not hold anything that would need it.
Who else sees it
- our payment provider, to take the payment. they see what they need to; we see only their reference.
- the carrier, who gets your name, address and usually your email so they can tell you when your parcel is arriving.
- our hosting and email providers, who process data on our instructions and are not permitted to use it for anything of their own.
that is the whole list. nobody buys this data from us, because we do not sell it.
Where it is held
in the uk and the european economic area. where a provider moves data outside that, it is covered by the safeguards uk data protection law requires, such as the uk international data transfer agreement.
How long we keep it
- order and vat records: six years after the end of the relevant financial year. this one is not our choice.
- correspondence about an order: two years, so we can pick up a returns conversation where it left off.
- an account: until you close it. the sign in, your name and your saved addresses go when it does.
after that it is deleted.
Your rights
under uk gdpr you can ask us to:
- tell you what we hold about you, and give you a copy;
- correct anything that is wrong;
- delete it, where we are not required to keep it;
- restrict what we do with it while a disagreement is sorted out;
- hand it to you, or to someone else, in a portable format;
- object to a particular use of it.
the one limit worth stating plainly: we cannot delete a completed sale from our vat records on request, because we are legally required to keep them. everything around that record can go.
Asking
email us. we answer within one month, and it costs you nothing. we will ask you to confirm who you are first, which is a protection for you rather than an obstacle.
if you are not satisfied with how we have handled it, you can complain to the Information Commissioner’s Office at ico.org.uk. we would rather you came to us first.
Changes to this page
if what we collect changes, this page changes before the collection starts, not after. the date it was last written is in the notice at the top.
what happens to your order once it is placed is set out on the delivery and returns pages.