Privacy policy.

My Store is the data controller for the personal information described in this policy. That means we decide why and how it is used, and we are accountable for keeping it safe.

For anything in this policy, write to our contact page.

• Identity and contact details — your name, email address, delivery and billing address, and phone number when you provide one.
• Order information — the items you buy, order value, delivery choice and order history.
• Payment information — handled directly by our payment provider. We receive a confirmation of payment and the last digits and card type; we never see or store full card numbers.
• Account information — your email address and an encrypted password if you choose to create an account, plus saved addresses.
• Messages — anything you send us through the contact form, by email or about a return.
• Technical and usage data — IP address, device and browser type, and how you move through the site. Analytics data of this kind is only collected once you accept analytics cookies.

Performance of a contract

Taking and fulfilling your order, arranging delivery, handling returns, exchanges and refunds, and answering questions about an order.

Legal obligation

Keeping sales and tax records as required by law, and responding to lawful requests from authorities.

Legitimate interests

Preventing and investigating fraud, keeping the site secure and working, and improving our products and service — balanced against your rights.

Consent

Marketing emails and non-essential cookies. You can withdraw consent at any time, without affecting anything done before you withdrew it.

We do not sell your personal information, and we do not share it for anyone else’s marketing. We do share it with the service providers we need to run the shop, and only with what they need to do their job:

• Payment providers, to take payment securely and screen transactions for fraud.
• Delivery carriers, to deliver your parcel and let you track it.
• Hosting, email and IT providers that operate the website and send order notifications.
• Analytics providers, where you have accepted analytics cookies.
• Professional advisers and authorities, where we are required to disclose information by law.

Some of our providers process data outside the United Kingdom. Where that happens, we rely on an adequacy decision for the destination country, or on approved contractual safeguards such as the UK International Data Transfer Agreement or Addendum, so your information keeps the same level of protection.

• Order and transaction records: six years after the end of the tax year they relate to, because tax law requires it.
• Account data: for as long as your account is open, and deleted on request.
• Marketing consent and preferences: until you withdraw consent, plus a short record that you did so.
• Contact messages: up to two years, so we can follow up on a returning issue.

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you;
• have inaccurate information corrected;
• ask us to delete information we no longer need to keep;
• restrict or object to how we use it, including profiling for marketing;
• receive the data you gave us in a portable format, or have it sent to another provider;
• withdraw consent to marketing or non-essential cookies at any time.

To use any of these rights, contact us at our contact page. We answer within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you came to us first.

The site runs over an encrypted connection, payment details are handled on our provider’s systems rather than ours, and access to order data is limited to the people who need it. No method of transmission is completely secure, so we also keep what we collect to what we actually need.

Cookies and similar technologies are covered separately in our Cookie Policy, which also explains how to change your choice at any time.

Our shop is intended for adults. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us their details, contact us and we will delete them.

We update this policy when our practices or the law change. The current version is always on this page, with its date shown above.