Privacy Policy

This policy explains how we collect and use your personal data when you visit our website, create an account or place an order. We are the data controller; our details are at the bottom of this page. We comply with the UK GDPR, the Data Protection Act 2018 and, for customers in the European Union, the EU General Data Protection Regulation (GDPR).

Data we collect

Account data: name, email address, password (stored encrypted), phone number.
Delivery data: postal address and country.
Order data: products bought, amounts, order history and status.
Payment data: payment status and a payment reference from our payment provider. We do not receive or store your card details.
Marketing preferences: whether you agreed to receive promotional emails, and when.
Technical data: data strictly needed to run the website securely, such as a login cookie (see our Cookie Policy).

Sensitive information

Because of the nature of our products, the fact that you buy from us could reveal information about your intimate life. We treat all order data as confidential, limit access to staff who need it to fulfil your order and ship every order in plain, unbranded packaging.

Why we use your data and our legal basis

Creating your account, processing, delivering and supporting your orders, order and shipping emails: performance of a contract.
Keeping accounting and tax records: legal obligation.
Preventing fraud and keeping the website secure: legitimate interests.
Sending offers and discounts by email: your consent, which you can withdraw at any time.

Who we share data with

We only share your data with service providers that help us run the shop, under contracts that protect your data:

Mollie B.V. (Netherlands): payment processing
[Email provider, e.g. Resend]: sending order and marketing emails
[Hosting provider]: hosting the website and database
[Courier(s), e.g. Royal Mail, DHL]: delivering your order
Customs authorities: for orders shipped to the EU, the information required on customs declarations
[Accountant]: bookkeeping and tax

We never sell your personal data.

International transfers

We are based in the United Kingdom. Transfers between the UK and the EU are covered by adequacy decisions. Where a provider processes data outside the UK or EU (for example in the United States), we rely on appropriate safeguards such as the International Data Transfer Agreement / Standard Contractual Clauses or the UK–US data bridge.

How long we keep data

Order and invoice data: 6 years after the end of the financial year, as required by UK tax law.
Account data: until you delete your account, then removed within [30] days except where we must keep order records.
Marketing consent: until you unsubscribe.

Your rights

You have the right to access your data, correct it, have it erased, restrict or object to its use, receive it in a portable format and withdraw consent at any time. To exercise a right, email us at the address below. You can unsubscribe from marketing emails via the link in every email or in your account.

You can complain to the UK Information Commissioner's Office (ico.org.uk) or, if you live in the EU, to the data protection authority of your country. Please contact us first so we can try to help.

EU representative

[Name and address of our representative in the EU under Article 27 GDPR.]

Age

Our website and products are for adults aged 18 or over. We do not knowingly collect data from anyone under 18.

Changes

We may update this policy. The date of the latest update is shown on this page.