Privacy
we collect what we need to send you a parcel and keep a record of the sale. we do not build a profile of you, we do not sell anything about you, and there is no advertising or analytics tracking on this site at all.
What we collect
when you place an order:
- your name and delivery address, because a parcel needs somewhere to go;
- your email address, because that is how we confirm the order and tell you it has been sent;
- what you bought, what you paid and when, because that is the record of a sale and we are required to keep it;
- a payment reference from our payment provider. we never see your card number. it goes from you to the provider and never touches this site.
your basket is not on this list, because it is not ours until you check out. it is stored in your own browser and never reaches our server until you place the order. clearing your browser data clears it, and we would never know it existed.
What we do not do
no analytics. no advertising pixels. no third-party scripts of any kind. the site is configured to refuse to load them, so this is not a promise about intent but about what the code will permit.
the only cookies in play are the ones needed to make a purchase work. there is no consent banner because there is nothing to consent to.
Why we are allowed to hold it
- to perform our contract with you — your name, address, email and order. without these there is no way to fulfil an order.
- because the law requires it — sales and vat records, which hmrc requires us to keep.
we do not rely on legitimate interests to justify holding anything about you, because we do not hold anything that would need it.
Who else sees it
- our payment provider, to take the payment. they see what they need to; we see only their reference.
- the carrier, who gets your name, address and usually your email so they can tell you when your parcel is arriving.
- our hosting and email providers, who process data on our instructions and are not permitted to use it for anything of their own.
that is the whole list. nobody buys this data from us, because we do not sell it.
Where it is held
in the uk and the european economic area. where a provider moves data outside that, it is covered by the safeguards uk data protection law requires, such as the uk international data transfer agreement.
How long we keep it
- order and vat records: six years after the end of the relevant financial year. this one is not our choice.
- correspondence about an order: two years, so we can pick up a returns conversation where it left off.
after that it is deleted.
Your rights
under uk gdpr you can ask us to:
- tell you what we hold about you, and give you a copy;
- correct anything that is wrong;
- delete it, where we are not required to keep it;
- restrict what we do with it while a disagreement is sorted out;
- hand it to you, or to someone else, in a portable format;
- object to a particular use of it.
the one limit worth stating plainly: we cannot delete a completed sale from our vat records on request, because we are legally required to keep them. everything around that record can go.
Asking
email us. we answer within one month, and it costs you nothing. we will ask you to confirm who you are first, which is a protection for you rather than an obstacle.
if you are not satisfied with how we have handled it, you can complain to the Information Commissioner’s Office at ico.org.uk. we would rather you came to us first.
Changes to this page
if what we collect changes, this page changes before the collection starts, not after. the date it was last written is in the notice at the top.
what happens to your order once it is placed is set out on the delivery and returns pages.