Privacy policy

Depending on how you use the site, we may collect:

• your name, company, billing and delivery addresses, email and telephone number;
• account details, order history, returns, customer-service messages and reviews;
• artwork, logos and the instructions you provide for personalised garments;
• cart, order, payment status and transaction references;
• device, browser, IP address, security logs and cookie or consent choices; and
• marketing preferences and, after consent, analytics and advertising identifiers.

Card details entered in Stripe's secure payment fields are handled by Stripe. We receive the payment result and references needed to manage the order, not your complete card number.

Most information comes directly from you. We may also receive order, payment, delivery and fraud-prevention information from the providers involved in your transaction, and technical information from your browser or device.

We use personal information only where we have a lawful reason:

• Contract: to manage your cart, account, order, proof, delivery, return and payment.
• Legal obligation: for tax, accounting, fraud-prevention and other records the law requires.
• Legitimate interests: to secure and improve the service, answer enquiries, prevent misuse and understand business performance, balanced against your rights.
• Consent: for optional analytics, advertising cookies and email marketing where consent is required. You can withdraw it at any time.

Payment and fraud-prevention providers may use automated checks when deciding whether to authorise a transaction. Their privacy notices explain those checks. Contact us if you need help with a payment decision affecting an order.

We share only what is needed with service providers that help us run the shop: website and cloud hosting, WooCommerce, payment provider Stripe, delivery companies, transactional email, customer support, fraud prevention and professional advisers.

If configured, Klaviyo handles newsletter subscriptions and consented checkout reminders. Google, Meta and Reddit may receive consented analytics or conversion information. Their own privacy notices explain how they act as independent controllers for some uses.

We may also disclose information where the law requires it, to establish or defend legal rights, or as part of a business sale or reorganisation. We do not sell customer personal information.

Some technology providers may process information outside the UK. Where that happens, we use the provider's UK-approved transfer mechanism or another lawful safeguard. Contact us if you want more information about a particular transfer.

We keep information only for as long as it is needed for the purpose collected. Order, invoice and tax records are normally retained for the period required by accounting and tax law. Account, artwork and support records are kept while the relationship is active and for a reasonable period afterwards to handle reorders, disputes or legal claims.

Marketing information is kept until you unsubscribe, withdraw consent or it is no longer useful. Security logs and rotating backups have shorter operational lifecycles. The exact period can vary where a dispute, legal hold or regulator requires us to keep a record longer.

Necessary cookies keep the cart, checkout, account and security controls working. Preference cookies remember choices such as VAT display and your cookie decision. Optional analytics and advertising cookies stay off unless you accept them.

You can accept or decline optional cookies in the banner and reopen Cookie settings from the footer. Newsletter messages include a way to unsubscribe. You can also email us to withdraw marketing consent.

Depending on the circumstances, you can ask to access, correct, erase or restrict your personal information, object to certain uses, or receive information in a portable form. You can withdraw consent at any time. Some rights have legal exceptions, for example where records must be kept for tax or a legal claim.

Your right to object: you can object at any time to use of your information for direct marketing. You can also object to processing based on legitimate interests; whether processing must stop depends on the circumstances and the law.

Contact us first and we will try to resolve the issue. You also have the right to complain to the Information Commissioner's Office.

To make a data protection complaint, email sales@theembroideryshed.co.uk with “Data protection complaint” in the subject line, or write to our postal address above. Tell us how we can contact you and what you believe went wrong.

We will investigate without undue delay, keep you informed and tell you the outcome. Data-rights requests are handled within the time limits required by data-protection law. You may also complain to the Information Commissioner's Office.

We update this notice when the service or the law changes. The date at the top shows the latest revision.

For an order question, use the contact page. For a privacy request, email sales@theembroideryshed.co.uk with “Privacy request” in the subject line so it reaches the right person.