TERMS & CONDITIONS
Effective Date: June 2026
Table of Contents
- Who we are and what this notice covers
- What information do we collect?
- How do we process your information?
- What legal bases do we rely on?
- When and with whom do we share your information?
- Do we use cookies and tracking technologies?
- How do we handle your social logins?
- International data transfers
- How long do we keep your information?
- How do we keep your information safe?
- Do we collect information from minors?
- What are your privacy rights?
- Region-specific rights (EEA/UK/Switzerland · California · other regions)
- Controls for Do-Not-Track features
- Do we make updates to this notice?
- How can you contact us about this notice?
- How can you review, update, or delete your data?
1. Who We Are and What This Notice Covers
We are responsible for making decisions about how your personal information is processed (the “data controller”). We are:
[Company option] [LEGAL COMPANY NAME], a company registered in [COUNTRY / STATE] under company number [REGISTRATION NUMBER], with its registered office at [REGISTERED ADDRESS].
[Sole trader / freelancer option] [YOUR FULL NAME], trading as [TRADING / BRAND NAME], with a principal place of business at [BUSINESS ADDRESS].
In this notice, “we”, “us” and “our” refer to the controller above. This notice applies to the Services described at the top and should be read together with our Terms & Conditions and Cookie Notice. Where the mandatory privacy law of your country of residence gives you more rights than this notice describes, those rights apply.
2. What Information Do We Collect?
Personal information you disclose to us
In short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide when you register on the Services, express an interest in our products or Services, participate in activities on the Services, or otherwise contact us. This may include:
- names;
- phone numbers;
- email addresses;
- mailing and billing addresses;
- usernames and passwords;
- contact preferences;
- debit/credit card numbers; and
- contact or authentication data.
All personal information you provide must be true, complete and accurate, and you must notify us of any changes.
Sensitive information. We do not process sensitive information.
Payment data. We may collect data necessary to process your payment if you make a purchase, such as your payment-instrument number and its security code. All payment data is handled and stored by Stripe, Square and PayPal. You can review their privacy notices here: https://stripe.com/gb/privacy , https://squareup.com/gb/en/legal/general/privacy , and https://www.paypal.com/uk/legalhub/paypal/privacy-full . [Update these providers and links if your store uses different ones.]
Social media login data. We may let you register or log in using an existing social media account (such as Facebook or X). If you do, we will receive certain profile information about you from that provider, as described in Section 7.
Information collected automatically
In short: Some information — such as your IP address and/or browser and device characteristics — is collected automatically when you visit our Services.
This information does not reveal your specific identity but may include:
- Log and usage data — service-related, diagnostic and performance information our servers collect, such as your IP address, device information, browser type and settings, and information about your activity (date/time stamps, pages and files viewed, searches, features used, and error reports).
- Device data — information about the computer, phone, tablet or other device you use, such as IP address, device identifiers, browser type, hardware model, internet/mobile carrier, and operating system.
- Location data — information about your device’s location, which can be precise or imprecise, derived from technologies such as your IP address. You can opt out by disabling location on your device, though some features may then not work.
3. How Do We Process Your Information?
In short: We process your information to provide, improve and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.
We may process your personal information to:
- facilitate account creation, authentication and management — so you can create, log in to, and maintain your account;
- fulfil and manage your orders — process purchases, payments, and deliveries;
- request feedback — contact you about your use of our Services;
- send marketing and promotional communications — in line with your preferences (you can opt out at any time; see Section 12);
- protect our Services — including fraud monitoring and prevention;
- identify usage trends — to understand how our Services are used so we can improve them;
- measure the effectiveness of our marketing — to provide campaigns relevant to you; and
- save or protect a person’s vital interests — such as to prevent harm.
4. What Legal Bases Do We Rely On?
In short: We only process your personal information when we have a valid legal reason to do so.
Where the EU/UK GDPR applies, we rely on the following legal bases:
- Consent — where you have given us permission to process your information for a specific purpose. You can withdraw consent at any time (see Section 12).
- Performance of a contract — where processing is necessary to provide the Services you have requested, such as creating your account and fulfilling your orders.
- Legitimate interests — where processing is reasonably necessary to achieve our legitimate business interests and those interests do not override your rights. For example, to send information about offers and discounts, analyse and improve the Services, support our marketing, and diagnose problems or prevent fraud.
- Legal obligations — where processing is necessary to comply with law, cooperate with law enforcement or regulators, or exercise or defend legal claims.
- Vital interests — where processing is necessary to protect your vital interests or those of another person.
Where we rely on legitimate interests, you can object at any time. Where we rely on consent, you can withdraw it at any time.
5. When and With Whom Do We Share Your Information?
In short: We may share information in specific situations and with specific categories of third parties.
Service providers. We may share your data with third-party vendors, service providers, contractors and agents who perform services for us and need access to do that work. The categories include:
- payment processors (Stripe, Square, PayPal);
- order fulfilment, delivery and shipping partners (couriers and postal services);
- website hosting and IT service providers;
- web and marketing analytics providers (such as Google Analytics);
- email, SMS and marketing-platform providers;
- social media platforms (where you use a social login or interact with us there);
- fraud-prevention and security providers;
- professional advisers (accountants, lawyers, auditors and insurers); and
- law enforcement, regulators, courts and government authorities, where we are required to disclose information by law or to protect our rights or the safety of others.
Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business.
We do not sell your personal information for money. Some laws (such as California’s) define “sale” or “sharing” broadly — see Section 13.2.
6. Do We Use Cookies and Tracking Technologies?
In short: We may use cookies and similar technologies to collect and store your information.
We use cookies and similar technologies (like web beacons and pixels) when you interact with our Services. Some are necessary to maintain security, prevent crashes, fix bugs, save your preferences, and support basic site functions. We also permit third parties and service providers to use tracking technologies for analytics and advertising — including to tailor ads to your interests or send abandoned-cart reminders (depending on your preferences). Details of the technologies we use and how to refuse certain cookies are set out in our Cookie Notice.
Google Analytics. We may share your information with Google Analytics to analyse use of the Services. To opt out, visit https://tools.google.com/dlpage/gaoptout . For more on Google’s practices, see https://policies.google.com/privacy .
7. How Do We Handle Your Social Logins?
In short: If you register or log in using a social media account, we may receive certain information about you.
If you register or log in using a third-party social media account (like Facebook or X), we will receive certain profile information from that provider. This may include your name, email address, friends list, and profile picture, as well as other information you have made public. We use this information only for the purposes described in this notice or made clear to you on the relevant Services. We do not control, and are not responsible for, other uses of your information by your social media provider, so we recommend reviewing their privacy notice.
8. International Data Transfers
In short: Your information may be processed in countries other than your own.
Because we and some of our service providers operate in different countries, your personal information may be processed outside your country of residence — including outside the European Economic Area (EEA) and the United Kingdom, and in the United States (for example, by some of our payment or analytics providers). Where we transfer personal information internationally, we rely on an appropriate safeguard, such as an adequacy decision, the EU/UK Standard Contractual Clauses, or another lawful transfer mechanism. You can contact us for more information about the safeguards we use.
9. How Long Do We Keep Your Information?
In short: We keep your information only as long as necessary, unless the law requires otherwise.
We keep your personal information only for as long as necessary for the purposes set out in this notice, unless a longer period is required or permitted by law (such as tax, accounting or other legal requirements). For example, we typically keep order and transaction records for [NUMBER] years to meet legal and tax obligations, and keep account data while your account is active. When we no longer have a legitimate business need to process your information, we will delete or anonymise it, or (where that is not possible, for example because it is held in backups) securely store it and isolate it from further processing until deletion is possible.
10. How Do We Keep Your Information Safe?
In short: We aim to protect your information through organisational and technical measures.
We have implemented appropriate and reasonable technical and organisational security measures designed to protect the personal information we process. However, no electronic transmission over the internet or storage technology can be guaranteed to be 100% secure, so we cannot guarantee that unauthorised third parties will never defeat our security. Transmission of personal information to and from our Services is at your own risk, and you should only access the Services within a secure environment.
11. Do We Collect Information from Minors?
In short: We do not knowingly collect data from, or market to, children under 18.
We do not knowingly collect, solicit data from, or market to children under 18 years of age (or a higher age where your local law requires), nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18, or that you are the parent or guardian of a minor and consent to that minor’s use of the Services. If we learn that we have collected personal information from a user under 18, we will deactivate the account and take reasonable steps to delete the data. If you believe we may have collected such data, please contact us.
12. What Are Your Privacy Rights?
In short: Depending on where you live, you may have rights to access and control your personal information.
Depending on your location, you may have some or all of the following rights: to request access to and a copy of your personal information; to request correction of inaccurate information; to request deletion; to restrict processing; where applicable, to data portability; to object to processing (including direct marketing and processing based on legitimate interests); to withdraw consent; and not to be subject to solely automated decision-making that has a legal or similarly significant effect. To exercise a right, contact us using the details in Section 16. We will consider and act on your request in accordance with applicable data-protection laws, and we may need to verify your identity first.
Withdrawing your consent. Where we rely on your consent, you can withdraw it at any time by contacting us or updating your preferences. This will not affect the lawfulness of processing before withdrawal, nor processing carried out on other lawful grounds.
Opting out of marketing. You can unsubscribe at any time by clicking the unsubscribe link in our emails, replying “STOP” or “UNSUBSCRIBE” to our SMS messages, updating your account settings, or contacting us. You will then be removed from our marketing lists, though we may still send you service-related messages (such as order confirmations and important account notices).
Account information. To review, change or terminate your account, log in to your account settings, or contact us. On request to terminate your account, we will deactivate or delete it and your information from our active databases, though we may retain some information to prevent fraud, troubleshoot problems, assist investigations, enforce our terms, and/or comply with legal requirements.
13. Region-Specific Rights
13.1 EEA, United Kingdom and Switzerland
If you are in the EEA, the UK or Switzerland, you have the rights described in Section 12, and we process your data on the legal bases in Section 4. You also have the right to lodge a complaint with your supervisory authority: your EEA Member State authority, the UK Information Commissioner’s Office (ICO), or the Swiss Federal Data Protection and Information Commissioner (FDPIC).
13.2 California (CCPA / CPRA)
If you are a California resident, you have the right to: know and access the personal information we collect, use and disclose; request deletion of your personal information; correct inaccurate personal information; opt out of the “sale” or “sharing” of your personal information; limit the use of sensitive personal information; and not be discriminated against for exercising your rights. We do not “sell” or “share” personal information as those terms are defined under California law. You may use an authorised agent to submit a request. The categories of personal information we collect and disclose are described in Sections 2 and 5.
13.3 Other Regions
If you are located elsewhere (for example, Canada, Australia, Brazil or another country with its own privacy law), you may have similar rights under your local law. Contact us and we will honour the rights that apply to you.
14. Controls for Do-Not-Track Features
Most web browsers and some mobile operating systems and applications include a Do-Not-Track (“DNT”) feature you can activate to signal your preference not to have your online browsing activity monitored. No uniform technology standard for recognising DNT signals has been finalised, so we do not currently respond to DNT browser signals. If a standard is adopted that we must follow, we will update this notice.
15. Do We Make Updates to This Notice?
In short: Yes, we will update this notice as necessary to stay compliant with relevant laws.
We may update this Privacy Notice from time to time. The updated version will be indicated by a revised “Last updated” date. If we make material changes, we may notify you by prominently posting a notice or sending you a direct notification. We encourage you to review this notice frequently.
16. How Can You Contact Us About This Notice?
If you have questions or comments about this notice, contact us:
- Email: [SUPPORT / PRIVACY EMAIL]
- Data controller: [LEGAL COMPANY NAME / YOUR NAME TRADING AS BRAND]
- Address: [BUSINESS ADDRESS]
You also have the right to complain to your data-protection authority if you are unhappy with how we have handled your personal data.
17. How Can You Review, Update, or Delete Your Data?
Depending on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, ask how we have processed it, correct inaccuracies, or delete it, and you may have the right to withdraw your consent. These rights may be limited in some circumstances by applicable law. To make a request, contact us using the details in Section 16.