Privacy policy

Last updated: [date]. TODO: review with a professional before launch.

[Company name] Ltd ("we"), [registered address], is the controller of your personal data under the UK GDPR and the Data Protection Act 2018. ICO registration number: [ZA000000]. Contact: [[email protected]].

What we collect

Name, delivery address, email, phone number and order details. Card payments are processed by Stripe; we never see or store your card number.

Why and lawful basis

• To fulfil your order (contract) — including sharing your name, address and phone with our fulfilment partner and couriers.
• To meet legal/tax obligations (legal obligation), keeping order records for 6 years.
• To prevent fraud (legitimate interests).

We do not send marketing unless you opt in. We do not sell your data.

Processors

Stripe (payments), Supabase (order database), Cloudflare (hosting), Resend (transactional email), our dropship fulfilment partner and UK couriers (Royal Mail, Evri, DPD, UPS). Some processors may transfer data outside the UK under appropriate safeguards (e.g. UK IDTA / adequacy).

Cookies

We only use essential browser storage (your bag and age confirmation). No advertising or analytics cookies.

Your rights

Access, rectification, erasure, restriction, objection, portability. Contact us to exercise them. You can complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113.