Privacy Policy

2. Information We Collect

• Identity and contact details: name, email address, phone number, billing and delivery addresses
• Order details: products bought, order history, returns and correspondence
• Payment information: the details needed to take your payment by phone [TO CONFIRM: how phone payments are taken, e.g. bank transfer details given by phone or a payment link sent by email — taking card numbers by phone conflicts with the privacy policy's promise never to ask for a CVV]
• Account details: login email and password (stored in hashed form)
• Technical data: IP address, browser type, device information and pages visited, via essential cookies and server logs

3. How We Use Your Data and Our Lawful Bases

• To process and deliver your orders, handle returns and provide customer service — performance of a contract
• To take payment and prevent fraud — performance of a contract and our legitimate interests in preventing fraud
• To keep accounting and tax records — legal obligation
• To run and secure the website — our legitimate interests
• To send marketing emails, where you have opted in — consent, which you can withdraw at any time

4. Who We Share Your Data With

We share personal data only as needed with:

• Delivery and courier companies, to deliver your order
• Our hosting and IT service providers
• Professional advisers, and authorities where required by law

We do not sell your personal data.

5. International Transfers

Some of our service providers are located in India. Our servers and database are hosted in Germany. Where personal data is transferred outside the UK to a country without UK adequacy regulations, we use appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. [TO CONFIRM: the safeguard actually in place.] You can contact us for more information.

6. Cookies

We use cookies that are strictly necessary for the site to work, such as keeping your basket and keeping you signed in. We do not use analytics or marketing cookies.

7. How Long We Keep Your Data

We keep order and transaction records for 6 years to meet tax and accounting requirements. Account data is kept while your account is open and deleted or anonymised 6 years after you close it, unless we need to keep it for legal reasons.

8. Your Rights

Under UK data protection law you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Have your data erased in certain circumstances
• Restrict or object to our processing in certain circumstances
• Data portability
• Withdraw consent at any time where we rely on consent
• Object to direct marketing at any time

To exercise any of these rights, contact us using the details in section 1. We will respond within one month.

9. Security

We use appropriate technical and organisational measures to protect your personal data, including encrypted connections (HTTPS) and access controls.

10. Children

Our site is not intended for children under 18, and we do not knowingly collect their personal data.

11. Complaints to the ICO

If you are unhappy with how we have handled your personal data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or 0303 123 1113.

12. Changes to This Policy

We may update this policy from time to time. The "Last Updated" date above shows when it was last changed, and we will tell you about significant changes.