Privacy policy

This policy covers personal data we handle when you use our website, create an account, place an order or contact us. It should be read alongside our Cookie policy, which explains the cookies and browser storage we use.

The data controller responsible for your personal data is Osevaro (registered company details to be confirmed before launch). Our full registered details will be published before we begin trading.

Depending on how you use the site, we may collect the following categories of personal data:

• Identity and contact data — your name, email address, delivery and billing addresses, and phone number where you provide it.
• Account data — your login details and saved preferences (passwords are stored only in a hashed form, never in plain text).
• Order and transaction data — the items you buy, order totals, delivery method, and a record of your orders. Payment is handled by our payment provider, so we do not store full card numbers.
• Communications — messages you send us through the contact form or by email, and our replies.
• Technical and usage data — information such as your device type, browser and, with your consent, basic analytics about how the site is used.
• Consent and preference data — your cookie choices and marketing preferences.

We do not seek to collect special-category data (such as health or ethnicity), and we do not knowingly collect data from children.

• Directly from you — when you create an account, place an order, save an address or contact us.
• Automatically — through cookies and similar technologies when you use the site, in line with your cookie choices.
• From service providers — for example our payment provider and, once fulfilment is live, delivery partners, who share information needed to complete and dispatch your order.

We only process your personal data where we have a lawful basis to do so under the UK GDPR:

• To create and run your account and keep you signed in.
• To process, fulfil and deliver your orders and handle returns and refunds.
• To respond to your enquiries and provide customer support.
• To keep the site and your account secure and to prevent and detect fraud.
• To meet our legal, tax and accounting obligations.
• To send marketing only where you have given consent — and you can unsubscribe at any time.

We use a small amount of essential browser storage to make the site work — for example to remember your basket and your cookie choice — and optional analytics only if you consent to it. Our Cookie policy explains each category, gives examples and shows how to change your choice at any time.

We do not sell your personal data. We share it only with trusted providers who help us run the shop, and only as far as they need it:

• Payment provider — Stripe processes your payment securely; we do not store full card details.
• Delivery and fulfilment partners — once fulfilment is live, we share the details needed to pick, pack and deliver your order.
• Technology and email providers — for hosting, storing data securely and sending service emails.
• Professional advisers and authorities — where we are legally required to share information, or to protect our rights.

Each provider acts as our processor under an appropriate data-processing agreement and may use your data only on our instructions.

Some of our providers may process data outside the United Kingdom. Where they do, we make sure the transfer is protected by an appropriate safeguard — such as UK adequacy regulations, the International Data Transfer Agreement, or equivalent contractual protections — so your data receives essentially the same protection as it does in the UK.

We keep personal data only for as long as we need it for the purposes described here, then delete or anonymise it. In general:

• Account data is kept while your account is open; if you close it, we remove or anonymise data we no longer need.
• Order and transaction records are kept for as long as tax and accounting law requires, which is normally around six years.
• Support correspondence is kept for as long as needed to handle your query and any follow-up.
• Marketing preferences are kept until you unsubscribe or ask us to stop.

Under UK data-protection law you have the right to:

• be informed about how we use your data;
• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• ask us to erase your data in certain circumstances;
• restrict or object to certain processing;
• data portability — receive your data in a reusable format;
• withdraw consent at any time, where we rely on consent.

To exercise any of these rights, contact us at our contact page (a monitored data-protection contact will be published before launch). We will respond within the timeframes set by law, normally within one month.

If you are unhappy with how we have handled your data, please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data-protection regulator.

ICO — Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline: 0303 123 1113. Website: ico.org.uk.

For any question about this policy or your personal data, please contact us at our contact page (a monitored data-protection contact will be published before launch). A named data-protection contact will be published here before we begin trading.