Privacy policy

Last updated: October 2026 This policy explains what personal information we collect when you visit or buy from this shop, why we collect it, who we share it with and what your rights are. We are the "data controller": we decide how your information is used. You can reach us at any time through the Contact page. WHAT WE COLLECT Orders: your name, email address, phone number, delivery and billing address, what you bought, the order total and the payment method used. We need these to take payment, deliver your order, send you receipts and invoices and answer questions about it. We never see or store your full card number; card and PayPal payments are handled by Stripe and PayPal. Customer account: if you create an account, your name, email address and a password. Your password is stored only as a one-way hash, so nobody (including us) can read it. We also send a one-time code to your email to confirm your address and when you sign in, to protect your account. Contact form: your name, email address and message, so we can reply. Marketing emails (newsletter): your email address, when you subscribe, and the date and source of your consent. We email you news and offers about our products. We also record whether a marketing email was delivered, and, if you allow images, whether you opened it or clicked a link, so we can see what is useful. You can unsubscribe at any time using the link in every email, and we will stop straight away. Technical information: your IP address, browser type and the pages requested are processed to run the website, prevent fraud and abuse and keep the site secure. We use your IP address to guess your country so we can show prices in the right currency (EUR, GBP or USD). Security logs, such as failed sign-in attempts, record the IP address and time. COOKIES We use one cookie, which is essential for the shop to work. It keeps your cart, your chosen currency and, if you sign in, your login. It is deleted automatically after 14 days at most, and it is not used for advertising or tracking. We do not use advertising or analytics cookies. Because the cookie is strictly necessary, no consent banner is needed for it. When you pay, PayPal and Stripe may set their own cookies on their pages under their own policies. Our contact and sign-up forms may use Cloudflare Turnstile, a privacy-friendly check that you are a person and not a robot; Cloudflare processes technical information about your browser for this purpose. WHY WE USE YOUR INFORMATION (LEGAL BASIS) To fulfil your order and manage your account: this is needed to carry out our contract with you. To keep accounts of our sales and meet tax and accounting law: this is a legal obligation. To protect the site from fraud and attacks, and to answer your messages: this is our legitimate interest in running a secure business. To send you marketing emails: this is your consent, which you can withdraw at any time. If you have bought from us before, we may email you about similar products under the "soft opt-in" rule, and you can always opt out. We do not sell your personal information and we do not use it for automated decisions that significantly affect you. WHO WE SHARE IT WITH Only service providers who help us run the shop, and only what they need: PayPal and Stripe, to process payments. Our email providers, to send order, account and marketing emails. Marketing emails are sent through Brevo (Sendinblue SAS, France), which only receives your email address and the content of the message. Delivery companies, who receive your name, address and phone number to deliver your parcel. Our hosting provider, which stores the shop's data. Cloudflare, for the Turnstile check on forms. Our accountant, and authorities such as HMRC where the law requires it. Some of these providers are located outside the UK, for example in the United States. Where this happens, we rely on safeguards such as the UK International Data Transfer Agreement or approved standard contractual clauses, or an adequacy decision. HOW LONG WE KEEP IT Order and invoice records: 6 years, as required for tax and accounting. Customer accounts: until you ask us to delete the account. Contact messages: for as long as needed to deal with your enquiry, normally no longer than 2 years. Marketing emails: until you unsubscribe. We then keep only your email address on a suppression list, so we do not email you again. Security logs: up to about 13 months. Backups: copies of the shop's data are kept for a short rolling period (about 14 days), so deleted information may remain in a backup for a short time before it is overwritten. HOW WE PROTECT IT Passwords are hashed. Payment keys and other secrets are encrypted in our database. The website uses HTTPS, our admin area is protected with two-factor authentication, and we keep activity logs and regular backups. No system is perfectly secure, but we take reasonable steps to protect your information, and we will tell you and the ICO about a breach where the law requires. YOUR RIGHTS Under UK data protection law (and the EU GDPR, where it applies to you), you have the right to: see the personal information we hold about you, have inaccurate information corrected, have your information deleted (except where we must keep it, such as invoices), restrict or object to some of our uses of it, receive your information in a portable format, withdraw consent at any time, for example by unsubscribing from the newsletter. To use any of these rights, contact us through the Contact page. We will respond within one month. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first. CHILDREN The shop is not aimed at children under 13 and we do not knowingly collect their information. If you think a child has given us information, please contact us and we will delete it. CHANGES TO THIS POLICY We may update this policy from time to time. The date at the top shows when it last changed. If we make important changes, we will say so on the website. CONTACT Questions about this policy or your information? Use the Contact page and mark your message "Privacy".