What this policy covers

This page sets out what we collect as you browse and buy, why we collect it, how we use it, how long we keep it, and what rights you have over it. We have tried to write it in ordinary language rather than legal jargon, but every line here is something we actually do.

If anything is still unclear, the contact details are at the bottom of the page. Ask. If a paragraph is vague, tell us and we will rewrite it.

What we collect

Some of it you give us: the recipient's name, address, phone number and email at checkout; a username and password if you open an account, with the password stored encrypted so that we never see it in plain text; and whatever you send us in a support conversation — order numbers, photographs, descriptions.

Some of it is generated by the transaction: the items on an order, the amount, payment status, tracking number, refund records. Card numbers, expiry dates and verification codes are handled directly by the payment provider. We do not receive them, and we do not store full card details.

Some is collected automatically: IP address, browser type, device type, which pages you look at, how long you stay, which link brought you here. We use this to measure traffic and improve pages, generally in aggregate rather than tied to an individual.

Finally, cookies and similar technologies, used to keep you signed in, remember your basket, store language and currency preferences, and measure visits. You can clear or block them in your browser settings, though the basket and signing in may then stop working.

Together, that is the whole of what we hold about you.

How we use it

Mostly to complete orders: taking payment, arranging dispatch, providing tracking, handling returns and after-sales. Accounts and support take a share too — answering questions, checking orders, resolving disputes. The rest goes on improving the service: seeing which pages are read, where things go wrong, and adjusting accordingly.

With your consent we may send order notices, delivery reminders or news about new pieces. You can unsubscribe at any time, by the link in the email or by writing to us. Transactional messages — order confirmation, dispatch notice — are part of fulfilling the order and are not affected by your subscription settings.

We do not use your personal information for automated decision-making, and we do not set prices differently according to who you are.

Who we share it with

Completing an order means giving a few parties what they need: the payment provider, to process payment and refunds; the carrier, which needs the recipient's name, address and phone number for delivery and customs; technical providers such as hosting and email delivery. Each of them may use it only within the service they provide.

Cross-border delivery and customs clearance also require the recipient details to go to carriers and customs authorities in the destination country or region. Data protection requirements differ from country to country; we choose partners with basic compliance capability and require them to use the information for delivery only.

Beyond that, we do not sell, rent or hand your personal information to unrelated third parties. Where a law, a court or a regulator requires it, we will provide what is necessary and tell you where the law allows.

How long we keep it

Order and transaction records are kept as tax and consumer protection rules require, usually several years after the transaction. Account information is deleted or anonymised when an account is closed, though what is needed to meet legal obligations or resolve an open dispute may be kept longer.

Support correspondence is kept for a period after a case is closed, for review and dispute handling. Marketing subscriptions stop being used once you unsubscribe and are removed from the active list within a reasonable period.

We do not keep records out of reluctance to delete them. Tax and consumer protection rules require it, and deleting early tends to cause more problems than it solves.

Once the retention period has passed, information is deleted or irreversibly anonymised.

How we protect it

Measures include encryption in transit (HTTPS), one-way encryption of passwords, access rights minimised by role, audit trails on back-office actions, and periodic checks for unusual sign-ins. Staff and contractors sign confidentiality obligations and see only what an order requires.

Access is cut fine by role: you get what the job needs, and very few people can see every order at once.

That said, no system can guarantee absolute security. If a data incident occurs that could affect your rights, we will tell you as soon as we have confirmed it, with the scope and what we suggest you do.

Your rights

You can ask what we hold about you; ask us to correct anything inaccurate; ask for deletion where the law allows; withdraw consent you gave earlier, such as for marketing email; and ask for a copy of what you provided in a common format.

These rights are not decorative. Use them as set out below; there is no need to go round the houses.

To exercise them, contact us using the details at the foot of the page and say what you want. To confirm the request comes from you, we may ask for an order number or email verification. We reply within a reasonable period, usually no more than 30 days.

If you think we have handled something badly, you can complain to your local data protection authority. You can also talk to us first; where we can settle it internally, we would rather do that.

Children

This site is for adult customers and does not knowingly collect personal information from children. There is no exception to that. If a guardian finds that a child has submitted information without consent, contact us and we will delete it once verified.

Third-party links

Pages may link to other sites — a payment channel, a tracking lookup. Once you follow one, the domain in the address bar changes and this policy no longer applies. Those sites have their own privacy policies, which we neither control nor write, and it is worth reading them before you use the site.

Changes to this policy

If our scope of business, our partners or the law change, this policy may be updated. The new version is published on this page with the date of revision. Significant changes will be flagged on the site or by email.

Continuing to use the site means accepting the updated policy. If you do not accept it, you can stop using the site and contact us about your account and information.

Contact us

For anything to do with personal information, email the shop; we reply within 1 business day. Mark it "privacy" and it goes to the right person first.

We collect only what an order needs and use it only where this page says. If we fall short somewhere, say so and we will fix it.

What our cookies do

Essential cookies keep you signed in, hold the contents of your basket and stop a form being submitted twice. With them off, buying and signing in do not work properly. Functional cookies remember your language and currency, so you do not have to set them again on every visit. Analytics cookies count visits and where they came from, which tells us what is useful; that data is presented in aggregate.

Blocking analytics does not stop you ordering. It only means we cannot see how pages perform, and we have less to go on when we redesign.

We do not use cross-site tracking cookies for advertising. If we introduce such tools, this policy will say so and offer a way to turn them off. They will not be on by default.

Where your data goes

We sell across borders, so order details may be passed to logistics and customs organisations in the destination country or region. We try to choose partners with local compliance credentials and require them to use the information for delivery and clearance only. If your region has particular rules on data leaving the country, write to us and we will explain how we handle it.

We do not send data to third countries unconnected with fulfilling an order. Where a transfer crosses borders, we keep the necessary agreements and records, and can produce them if we need to explain our basis for processing.