Privacy policy

• Data you give us: name, email address, telephone number, delivery and billing addresses, account password, messages you send us and newsletter sign-ups.
• Order data: the items you buy, prices, delivery method, order and return history.
• Payment data: payments are processed directly by our payment providers. We receive confirmation of payment and limited details (such as card type and last four digits) but never your full card number.
• Technical data: IP address, browser and device type, pages viewed, referring site and cookie identifiers. See our Cookie Policy.

We do not collect special category data (such as health data), and our store is not intended for children under 18.

We never sell your personal data. We share it only with service providers who help us run the store, under contracts that require them to protect it:

• E-commerce and hosting providers (Amboras, our store platform, and Vercel, our hosting provider) to run the website, your account and checkout;
• Payment providers (such as Stripe) to take payments securely and prevent fraud;
• Delivery carriers to deliver your order and process returns;
• Email providers to send order confirmations and, if you agree, newsletters;
• Meta Platforms Ireland Ltd (Facebook & Instagram), only with your consent, to measure and improve our advertising;
• Professional advisers and authorities (accountants, HMRC, courts or police) where required by law.

Some of our providers are located outside the UK and the European Economic Area, in particular in the United States. Where this happens, we ensure your data is protected by an adequacy decision (such as the UK Extension to the EU-US Data Privacy Framework) or by the standard contractual clauses / International Data Transfer Agreement approved by the UK and EU authorities. You can ask us for a copy of these safeguards.

• Orders and invoices: 6 years from the end of the financial year of the purchase, as required for tax and accounting purposes.
• Customer account: while your account is active; if inactive for 3 years we will delete or anonymise it, and you can ask us to delete it at any time.
• Customer service messages: up to 3 years after our last exchange.
• Newsletter: until you unsubscribe, or 3 years without any interaction.
• Cookies: for the durations listed in our Cookie Policy (13 months maximum).

You have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data erased, where we no longer have a reason to keep it;
• restrict or object to our use of your data, including at any time to direct marketing;
• receive your data in a portable format;
• withdraw your consent at any time (for example via the Manage cookies link in our footer or the unsubscribe link in our emails), without affecting processing carried out before.

To exercise any of these rights, email [email protected]. We will reply within one month and may ask you to confirm your identity. Exercising your rights is free of charge.

If you are not satisfied with our response, you can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk, or, if you live in the European Union, to the data protection authority of your country (in France, the CNIL at cnil.fr).

Our website is served over an encrypted connection (HTTPS), passwords are stored encrypted, and access to personal data is limited to those who need it. Payments are handled by PCI-DSS certified providers. No method of transmission over the internet is completely secure, but we take appropriate technical and organisational measures to protect your data and will notify you and the authorities of any breach where the law requires it.

We may update this policy to reflect changes in our practices or the law. The date at the top of this page shows when it was last updated. If we make significant changes, we will let you know on the website or by email.