Privacy notice

This notice explains how we use your personal data when you visit our website or buy from Puddlebury, as required by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are

Puddlebury is run by Mackenzie Millward, 698 Harvey Rd, Derby, DE24 0EG, England.

We're the controller of your personal data. This means we decide how and why it's used. If you have a question about this notice or your data, email hello@puddlebury.co.uk or write to 698 Harvey Rd, Derby, DE24 0EG, England.

What we collect

When you order: your name, email address, delivery address, phone number (if you give one) and what you've ordered.
When you pay: Stripe, our payment provider, handles your card details. We never see your full card number. Stripe tells us whether your payment went through and the results of its fraud checks.
When you contact us: your messages and anything you include in them.
When you leave a review: your review, your rating, the name shown with it, and any photos you share.
When you sign up to our newsletter: your email address and when you signed up.
When you visit our website: our servers use your IP address and browser details to show you the site and keep it secure. We also use cookies (see our cookie policy) and a visitor counter (see below).

We also get delivery updates about your order from our fulfilment partner and the courier.

We need your name, email address and delivery address to take and deliver your order. Without them, we can't process it. Giving a phone number is optional.

How we use your data and why

The law says we need a lawful basis for using your data. These are ours.

To carry out our contract with you

taking payment, and packing and delivering your order
sending emails about your order and its delivery
handling cancellations, returns and refunds

To meet our legal obligations

keeping tax and accounting records

For our legitimate interests, where these aren't outweighed by your rights

preventing fraud and keeping our website secure
answering your questions and helping with problems
counting visits so we can improve our shop
asking for a review after delivery, and publishing genuine reviews
emailing customers about similar products (see below)

With your consent, which you can withdraw at any time

sending our newsletter
using optional analytics and marketing cookies
showing photos you've shared with a review

Marketing emails

We only send you marketing emails if:

you've signed up to our newsletter, or
you've bought from us, the emails are about similar products, and you haven't told us to stop

Every marketing email has an unsubscribe link. You can also email hello@puddlebury.co.uk to stop them.

Our visitor counter

Our website has a built-in visitor counter that doesn't use cookies. Instead of storing your IP address, it combines your IP address and browser details with a key that changes every day, and turns them into a one-way code. This lets us count visits without keeping your IP address. Because the key changes daily, visits on different days can't be linked. We only use the counter to see overall numbers, such as how many people visit a page.

Who we share your data with

We only share what each organisation needs to do its job.

Stripe processes payments and helps prevent fraud. We use Stripe Payments Europe Ltd (Ireland), which works with Stripe, Inc. (USA). Stripe also uses some data for its own purposes, such as preventing fraud and meeting its legal duties, under its own privacy policy.
Resend (USA) sends our emails, including order updates, review requests and newsletters.
netcup GmbH (Germany) hosts our website.
CJdropshipping, our fulfilment partner, packs and sends your order from its UK warehouse. It receives your name, delivery address, phone number (if you gave one) and what you ordered. CJdropshipping is based in China.
Couriers receive the details they need to deliver your parcel.

We may also share data when the law requires it, for example with HMRC or the police.

Optional services

We only use these if we've switched them on and you've agreed in our cookie banner.

Google Analytics (Google Ireland Ltd) shows us how visitors use our website.
Meta Pixel (Meta Platforms Ireland Ltd) and TikTok Pixel (TikTok Technology Ltd, Ireland) help us measure and improve our ads on their platforms.

These companies also use the data for their own purposes, under their own privacy policies, and may transfer it outside the UK.

Transfers outside the UK

Some of the organisations above are based outside the UK, so your data is transferred abroad. We protect it like this:

Ireland and Germany (Stripe Payments Europe, netcup, and the optional Google, Meta and TikTok services): UK law recognises the European Economic Area as giving adequate protection, under UK "adequacy regulations".
USA (Stripe, Inc. and Resend): UK adequacy regulations, where the company is certified under the UK Extension to the EU-US Data Privacy Framework. Otherwise, the UK International Data Transfer Agreement or the UK Addendum to the EU's standard contractual clauses.
China (CJdropshipping): there are no UK adequacy regulations for China. We use the UK International Data Transfer Agreement or Addendum where one is in place. Where it isn't, we rely on the transfer being necessary to deliver your order.

To find out more, or to get a copy of these safeguards, email hello@puddlebury.co.uk.

How long we keep your data

Orders, payments and tax records: 6 years after the end of the financial year they relate to.
Newsletter sign-ups: until you unsubscribe.
Messages you send us: 2 years.
Reviews and review photos: for as long as they're published.

For how long cookies last, see our cookie policy.

Your rights

You have the right to:

Access: get a copy of your data.
Correction: have wrong or incomplete data put right.
Erasure: have your data deleted.
Restriction: ask us to limit how we use your data.
Portability: get your data in a format you can take elsewhere.
Withdraw consent: where we rely on your consent, you can withdraw it at any time.

Your right to object. You can object at any time to us using your data for our legitimate interests. You can also tell us to stop sending you marketing, and we will.

Some rights only apply in certain situations. For example, we can't delete records we must keep for tax.

To use your rights, email hello@puddlebury.co.uk. It's usually free. We may need to check your identity. We'll reply within one month, or tell you if we need up to two more months because your request is complex.

Automated decisions

We don't make decisions about you based only on automated processing that have legal or similarly significant effects.

Children

Our shop isn't aimed at children.

Complaints

If you're unhappy with how we've used your data, please tell us first at hello@puddlebury.co.uk. We'll acknowledge your complaint within 30 days and let you know the outcome.

You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.

Changes to this notice

We'll update this notice if the way we use your data changes.