Template — have this reviewed before launch. This policy is a starting point for a small UK online retailer and must be checked against your actual suppliers, analytics tools and data practices by a qualified adviser.
Legal
Privacy policy
We're a small business and we take looking after your information seriously. This policy explains, in plain English, what personal data we collect, why, and what your rights are.
Last updated: [insert date]
1. Who we are
Feather & Roan (“we”, “us”, “our”) runs the website featherandroan.co.uk. We are the data controller for the personal data described in this policy.
- Registered address: Feather & Roan, Unit 4, The Old Kennels, Ludlow, Shropshire, SY8 1AA
- Company number: 00000000
- Email: hello@featherandroan.co.uk
- Phone: 01234 567890
We are registered with the Information Commissioner's Office (ICO). Registration number: [insert ICO number].
2. What we collect
When you place an order
Your name, email address, phone number, delivery and billing addresses, the items you buy, any engraving or personalisation text, and your order history.
Payment information
Card payments are processed securely by our payment provider (Stripe). We never see or store your full card number. We receive limited information such as the card type, last four digits and whether the payment succeeded.
When you contact us
Your name, email address, order number (if you give it) and whatever you tell us in your message.
When you join the Spaniel Club
Your email address and, if you choose to tell us, your dog's name. We keep a record of when and where you signed up so we can show you consented.
When you browse the site
Your basket and wishlist are linked to an anonymous session cookie. If you accept analytics cookies, we also collect information such as pages visited, device type and approximate location (derived from your IP address). We use your IP address to help prevent fraud and abuse, for example rate-limiting repeated form submissions.
We don't knowingly collect data from children under 13, and we don't collect any special category data.
3. How we use it & why
UK data protection law requires us to have a lawful basis for each use of your data:
| What we do | Lawful basis |
|---|---|
| Process, deliver and support your order, including returns and refunds | Contract |
| Send order confirmations, dispatch and delivery updates | Contract |
| Reply to your messages and enquiries | Legitimate interests (helping our customers) |
| Send the Spaniel Club newsletter and marketing emails | Consent (you can withdraw at any time) |
| Keep accounting and tax records | Legal obligation |
| Prevent fraud, spam and misuse of our site | Legitimate interests (keeping our shop secure) |
| Understand how our site is used and improve it (analytics) | Consent (via our cookie banner) |
We will never sell your personal data, and we won't send you marketing unless you've asked us to.
4. Who we share it with
We only share your data with trusted service providers who help us run the shop, and only as much as they need:
- Payment processing — Stripe, to take payments securely and prevent fraud.
- Delivery — Royal Mail and DPD, who receive your name, delivery address, and email or phone number for delivery updates.
- Email — our email service provider, to send order emails and (if you've opted in) newsletters.
- Hosting & infrastructure — the companies that host our website and database.
- Made-to-order partners — print-on-demand partners receive your name, delivery address and order details to make and send personalised items.
- Professional advisers and authorities — accountants, lawyers, HMRC or the police where we're legally required to.
Some providers may process data outside the UK. Where they do, we make sure appropriate safeguards are in place, such as a UK adequacy decision or the ICO's International Data Transfer Agreement.
5. Cookies
We use a small number of cookies and similar technologies:
- Essential cookies — keep your basket and wishlist working, remember your cookie choice and keep checkout secure. These don't need consent.
- Analytics cookies — only set if you click “Accept all” on our cookie banner. They help us understand which pages are useful.
You can change your mind at any time by clearing cookies in your browser, which will show the cookie banner again.
6. How long we keep it
- Order and transaction records: 6 years from the end of the financial year, as required by HMRC.
- Contact messages: up to 2 years, unless linked to an ongoing order or claim.
- Newsletter subscriptions: until you unsubscribe, after which we keep a minimal suppression record so we don't email you again.
- Anonymous basket sessions: up to 90 days of inactivity.
7. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- ask us to correct anything that's wrong or incomplete;
- ask us to delete your data (where we don't need to keep it for legal reasons);
- object to or restrict how we use it;
- receive your data in a portable format;
- withdraw consent at any time — for example, by clicking “unsubscribe” in any marketing email.
To exercise any of these rights, email hello@featherandroan.co.uk or use our contact form. We'll respond within one month and there's normally no charge.
8. Security
Our website uses HTTPS encryption, payments are handled by a PCI DSS compliant provider, and access to customer data is limited to people who need it to run the shop. No system is perfectly secure, but we take sensible steps to protect your data, and we'll tell you and the ICO if a breach occurs where the law requires it.
9. Complaints
If you're unhappy with how we've handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
10. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top.