Privacy policy

My Store is the data controller for the personal data described in this notice. That means we decide why and how it is used, and we are accountable for it under the UK General Data Protection Regulation and the Data Protection Act 2018.

Trading name

My Store

Registered name

[registered company name]

Company number

[company registration number]

VAT number

[VAT registration number, if registered]

Trading address

[registered trading address]

Email

[contact email address]

For any question about your data, or to exercise any of the rights in clause 08, write to us at [contact email address].

Data you give us. Your name, delivery and billing address, email address, telephone number where you provide one, the contents of your order, your account password in encrypted form, and anything you write to us in a message.

Data collected automatically. Your IP address, device and browser type, the pages you view, how you arrived at the site, and similar technical information gathered through cookies and comparable technologies. Our Cookie Policy sets this out in detail.

Data from others. Confirmation of payment and fraud-screening outcomes from our payment provider, delivery status from carriers, and aggregated measurement data from advertising and analytics providers.

We do not receive or store your full card number. Card data is collected directly by our payment provider in their own secure environment. We never ask you for your card details by email or telephone.

• To take and fulfil your order — processing payment, dispatching goods, handling returns and refunds, and keeping you informed about your order. Lawful basis: performance of our contract with you.
• To prevent fraud and keep the store secure — screening orders and protecting the site against misuse. Lawful basis: our legitimate interests in trading safely, and compliance with legal obligations.
• To answer your messages and provide customer service. Lawful basis: performance of our contract, and our legitimate interests in supporting our customers.
• To keep accounting and tax records of what we have sold. Lawful basis: compliance with a legal obligation.
• To send marketing emails, where you have asked for them or where you are an existing customer and we are telling you about similar products. Lawful basis: your consent, or our legitimate interests under the existing-customer rule. You can stop these at any time.
• To measure and improve the store, and to advertise through analytics and advertising cookies and pixels. Lawful basis: your consent, given through our cookie controls.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and you may object at any time.

We share personal data only with organisations that need it to run the store:

• our ecommerce and hosting providers, who operate this site on our behalf;
• our payment provider, to take payment and screen for fraud;
• carriers and fulfilment partners, to deliver your order and handle returns;
• email and customer-service providers, to send order and service messages;
• analytics and advertising providers, where you have consented to those cookies;
• our professional advisers, and public authorities or law enforcement where we are legally required to disclose.

These organisations act on our documented instructions as processors, except where they determine their own purposes — as advertising and analytics providers may. We never sell your personal data.

Some of our providers process data outside the United Kingdom. Where that happens we rely on UK adequacy regulations for the destination country, or on the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, together with additional safeguards where they are needed. You can ask us for details of the safeguards used for a particular transfer.

• Order and transaction records — six years after the end of the financial year in which the order was placed, to meet HMRC and accounting requirements.
• Account data — for as long as your account is open, and for a short period afterwards so the account can be restored if closed by mistake.
• Correspondence — normally two years after your query is resolved, or longer where a dispute is ongoing.
• Marketing data — until you unsubscribe or withdraw consent, after which we keep a minimal suppression record so we do not contact you again.
• Cookie and analytics data — for the periods set out in our Cookie Policy.

Traffic to and from this site is encrypted in transit. Access to personal data is limited to the people who need it to do their job, and we require our providers to maintain appropriate security measures. No transmission over the internet can be guaranteed completely secure, but we take these obligations seriously and will notify you and the Information Commissioner where a breach requires it.

Under UK data protection law you have the right to:

• be told how your data is used, which is the purpose of this notice;
• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have data erased, where we no longer need it and no legal obligation requires us to keep it;
• restrict how we use your data while a concern is being resolved;
• receive data you gave us in a portable format, or have it sent to another controller;
• object to processing carried out on the basis of legitimate interests, and to object at any time to direct marketing;
• withdraw consent at any time, where we rely on consent.

If you are unhappy with how we have handled your data, you may complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve it with you first.

Every marketing email we send carries an unsubscribe link, and acting on it stops further marketing immediately. Unsubscribing does not stop the service messages we must send about an order you have placed, such as dispatch and refund confirmations.

Cookies, pixels and similar technologies are covered separately in our Cookie Policy, which lists what is set, by whom, for how long, and how to change your choice.

We do not make decisions producing legal or similarly significant effects about you by automated means alone. Our payment provider may run automated fraud checks on a transaction; if a payment is refused on that basis you can contact us and ask for it to be looked at by a person.

This store is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, tell us and we will delete it.

We review this notice regularly and will update the date at the top whenever it changes. Where a change materially affects how we use your data, we will tell you directly.