This notice explains what personal data we collect when you use this site and buy from us, and what we do with it. It is written to meet the UK GDPR and the Data Protection Act 2018.
Who we are
[TODO Elmir: legal name, registered address, company or VAT number]. Contact for privacy questions: [TODO Elmir: contact email].
What we collect and why
- Order details: name, delivery address, email address, phone number if you give it, and what you bought. We need these to perform the contract with you: to take payment, deliver the product and answer questions about your order.
- Payment: card payments are processed by Stripe Payments UK Ltd. Card numbers never reach our systems. Stripe also acts as an independent controller for fraud prevention; see the Stripe privacy policy.
- Technical data: IP address, browser type and the pages you request, held in server logs for security and to keep the site working. Our legal basis is legitimate interest.
- Tax records: we keep invoices and order records for six years because HMRC requires it. This is a legal obligation.
Who we share it with
- Stripe, for payment processing.
- Selfnamed (Cosmetics Nord, Latvia), which manufactures and dispatches the product. They receive your name and delivery address. Latvia is in the EU, which the UK recognises as providing adequate data protection.
- The delivery carrier, which receives your name, address and phone number for delivery updates.
- Our hosting provider, which stores the site and its database. [TODO Elmir: hosting provider name and location.]
We do not sell personal data and we do not use it for advertising.
Cookies
The site sets only strictly necessary cookies: the ones our shop software needs to remember your cart and checkout session. They are not used for tracking and expire when the session ends. We set no advertising or analytics cookies, which is why you are not asked to accept any.
If that ever changes we will ask for your consent before setting them, and we will update this notice on the same day.
How long we keep it
Order and invoice data: six years after the order, then deleted. Server logs: 30 days. Email correspondence: until the matter is closed, then deleted within 12 months.
Your rights
You can ask us for a copy of your data, ask us to correct or delete it, restrict or object to how we use it, or ask for it in a portable format. Email us and we will reply within one month. If you are unhappy with our answer you can complain to the Information Commissioner’s Office at ico.org.uk.
Last updated: [TODO date at launch].