LEGAL
Privacy policy
Last updated 2 November 2026
I take looking after your information seriously. This policy explains what I collect when you use enchantedcraftcave.co.uk, why, and your rights. The data controller is EnchantedCraftCave (trader details at the bottom of this page), contactable at [email protected].
What I collect
- Order details: your name, email address, delivery address, what you ordered, and the personalisation text you enter.
- Reviews: your rating, review text, name as you choose to show it, and any photos you upload.
- Emails you send me.
- Payment: handled entirely by Stripe. I don’t see or store your full card details.
Why I use it (and the legal basis)
- To make, post and support your order, including dispatch and download emails – performance of a contract.
- To send you one email about a week after delivery asking for a review – legitimate interests. You can ignore it, and I won’t send marketing emails without your consent.
- To keep accounting records – legal obligation.
- To prevent fraud and misuse of discount codes – legitimate interests. Discount codes store a scrambled (hashed) version of your email so each code is used once.
Who I share it with
Only the services needed to run the shop, each under their own data protection terms:
- Stripe – payments
- Royal Mail (Click & Drop) – your name and address to deliver your parcel
- Cloudflare – website hosting and secure order storage
- Resend – sending order and download emails
- Google Fonts – the website’s font is loaded from Google, which receives your IP address
Some of these providers may process data outside the UK; where they do, they use approved safeguards such as the UK International Data Transfer Addendum. I never sell your data.
How long I keep it
Order and accounting records are kept for 6 years, as required by HMRC. Review photos and text stay up until you ask me to remove them. Download links expire after 30 days.
Cookies
This site doesn’t use advertising or tracking cookies. Your browser stores your basket (using local storage) so it’s still there if you come back – this is strictly necessary for the shop to work, so no cookie banner is needed. Stripe sets its own cookies on its checkout page to prevent fraud.
Your rights
You can ask to see the information I hold about you, correct it, delete it, restrict or object to how I use it, or receive a copy. Just email me – I’ll reply within one month. If you’re unhappy with how I’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk.
Trader: Zoe-Louise Roberts trading as EnchantedCraftCave, Frinton-on-Sea, Essex. Contact: [email protected]