Privacy Policy & UK GDPR Information

1. Who We Are

For UK data-protection law, we are the controller responsible for the personal data described in this notice.

For privacy enquiries, use the contact details in section 14.

2. Personal Data We Collect

Depending on how you use our website and services, we may collect:

• Your full name, email address and telephone number(s).
• Your billing and delivery address(es).
• Account identifiers and securely protected login credentials.
• Order numbers, products ordered, prices, tax, delivery charges, order history and order status.
• Invoice and credit-note information.
• Courier, dispatch and tracking information.
• Communications with us, including support tickets and chatbot messages.
• Chatbot prompts and responses, and the order information selected to answer a verified request.
• IP address, session identifiers, browser/device information, security logs and basic website-usage data.
• Cookie preferences and analytics data where you have given the required consent.

We do not store payment-card numbers, card security codes or online-banking credentials. Payment information is handled by the payment provider you select. You should never enter a password, payment-card number or website session token into the chatbot.

3. How We Obtain Personal Data

• Directly from you when you register, order, contact us, use the chatbot or exercise a data-protection right.
• From our order, customer-account, invoice and support systems.
• From payment providers, where they confirm payment status without giving us your full card details.
• From couriers and delivery partners when they provide dispatch and tracking events.
• Automatically from your device through essential cookies, server logs and security tools.
• From analytics or embedded-media providers where you have consented to those technologies.

Certain information is required to create or fulfil an order. If you do not provide the required contact, billing or delivery information, we may be unable to accept or complete your order. You must be logged in before the chatbot can request information about an identifiable order. You may use our normal support channels instead of the chatbot.

4. Why We Use Personal Data and Our Legal Bases

Contract

We use personal data where necessary to take steps at your request, complete a sale, deliver products, administer returns and refunds, provide invoices, give tracking or order-status information, and provide customer support connected with your order.

Legal obligations

We use and retain information where required for accounting, taxation, consumer-protection, fraud-prevention, court, regulatory or other legal obligations.

Legitimate interests

We use personal data where necessary for our legitimate interests in operating an efficient customer-support service, providing an optional AI-assisted order-information service, protecting customer accounts, verifying identity, preventing unauthorised disclosure and fraud, maintaining website and network security, investigating misuse, keeping appropriate business records, handling legal claims, and improving our services. We balance these interests against your rights and reasonable expectations.

Consent

We rely on consent where required for non-essential analytics cookies, embedded media, and optional marketing communications. You may withdraw consent at any time, without affecting processing that took place before withdrawal.

5. AI-Assisted Order and Customer-Support Chatbot

Our website offers an optional chatbot powered using the OpenAI API. It can answer general support questions and provide limited information about an order only when the customer is already signed in to the website.

Login and order-ownership checks

• You must be signed in to your customer account before the chatbot can request information about one of your orders.
• When you provide an order number, our server-side ASP endpoint checks the active logged-in session and confirms that the order belongs to that customer.
• If the session is not valid, or the order does not belong to the logged-in customer, the endpoint does not return the order information.
• OpenAI does not receive your account password, login credentials or website session cookie.

Limited JSON information sent to OpenAI

After the server-side checks succeed, the endpoint returns a limited JSON response for the chatbot to explain to you. Depending on the order, this may include the order number, current order or dispatch status, a courier tracking URL, an invoice URL, and other limited order-related fields needed to answer the request. The invoice URL may contain the customer's name.

The order endpoint does not send your email address, telephone number, billing address or delivery address to OpenAI. OpenAI may nevertheless receive personal information that you choose to type into the chatbot yourself, so please do not enter information that is not needed for your request.

OpenAI receives the chatbot conversation and the limited JSON information described above. It does not receive direct access to our customer database, invoice database or order-management system. OpenAI processes this information on our behalf as a processor under its business terms and Data Processing Addendum, and may use authorised subprocessors.

Data sent through the OpenAI API is not used to train or improve OpenAI models by default unless the API customer explicitly opts in. We do not opt in to using our customers' chatbot inputs or outputs for OpenAI model training.

OpenAI may retain API prompts, responses and related metadata according to the API endpoint, features and data-control settings used. Standard abuse-monitoring data may generally be retained for up to 30 days, and some API features may retain application state unless configured otherwise. We configure and use the service with the aim of minimising the personal data and retention involved.

The chatbot is optional. You may stop using it and contact our support team instead. Chatbot answers can occasionally be incomplete or incorrect; for an important issue, refund dispute, account change or other matter requiring human judgement, contact our support team.

6. Who We Share Personal Data With

We disclose personal data only where necessary and proportionate, including to:

• Payment providers, such as PayPal, to process and confirm payments.
• Couriers, fulfilment partners and delivery services.
• OpenAI and its authorised subprocessors for the AI-assisted chatbot.
• Email-delivery providers used to send account and order-related messages.
• Website hosting, database, backup, cybersecurity, fraud-prevention and other IT service providers.
• Professional advisers, insurers, auditors and accountants where necessary.
• Courts, regulators, law-enforcement bodies or other authorities where required or permitted by law.
• A buyer, seller or adviser involved in a genuine business reorganisation, sale or acquisition, subject to appropriate confidentiality safeguards.

We do not sell, rent or trade customer personal data.

7. How Long We Keep Personal Data

We retain personal data only for as long as needed for the purpose for which it was collected, including legal, accounting, security and dispute requirements.

• Invoices, credits and core order/accounting records are normally retained for 7 years where required for tax, accounting or legal purposes.
• Customer accounts are kept while active and afterwards only for as long as needed for outstanding orders, legal obligations, fraud prevention or legal claims.
• Website and routine server logs are normally retained for less than 14 days, unless a security incident, investigation or legal obligation requires longer retention.
• Where we retain local chatbot conversation or diagnostic records, they are normally kept for no longer than 30 days, unless needed for an unresolved support issue, security investigation, complaint or legal claim.
• OpenAI API data retention is described in section 5 and may vary according to the API feature and the data-control settings available to us.

When a fixed period is not stated, we consider the amount, nature and sensitivity of the data; the risk of harm from unauthorised use or disclosure; the purpose for which it is processed; whether that purpose can be achieved in another way; and applicable legal requirements.

8. Cookies and Similar Technologies

We may use:

• Essential cookies required for login, checkout, session security, fraud prevention and operation of the chatbot.
• Analytics cookies only where the required consent has been given.
• Embedded-media cookies, including YouTube cookies, only where the required consent has been given.
• Marketing cookies only if we introduce them and first obtain any consent required by law. We do not currently use marketing cookies.

You can choose which non-essential cookies to allow through our cookie controls. Essential cookies cannot be disabled through those controls because the website cannot provide secure account, checkout or logged-in chatbot functions without them.

9. Your Data-Protection Rights

Depending on the circumstances and legal basis, you may have the right to:

• Access personal data we hold about you and receive related information.
• Rectify inaccurate or incomplete personal data.
• Erase personal data where the law gives you that right. You may also use our account-closure page.
• Restrict certain processing.
• Object to processing based on legitimate interests and to direct marketing.
• Receive or transfer certain data in a portable format where the right applies.
• Withdraw consent at any time where processing relies on consent.
• Complain to the Information Commissioner's Office.

To exercise a right, contact us using section 14. We may need to verify your identity before acting on a request. We normally respond without undue delay and within one month. The law permits an extension of up to two further months for a complex request or where you have made several requests; if so, we will explain the extension. Rights are not absolute and lawful exemptions may apply.

10. International Transfers

Some service providers, including OpenAI and its subprocessors, may process personal data outside the United Kingdom. This means chatbot prompts, responses or selected order information may be transferred to or accessed from another country.

Where a restricted international transfer takes place, we use an appropriate legal transfer mechanism. Depending on the recipient and destination, this may include UK adequacy regulations, the UK International Data Transfer Agreement, or the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum. We also assess and apply supplementary technical or organisational safeguards where required.

You may request further information or a copy of the relevant transfer safeguards by contacting us using section 14. Commercially confidential or security-sensitive information may be redacted where lawful.

11. Security and Access Controls

We use technical and organisational measures designed to protect personal data, including:

• SSL/TLS encryption for information transmitted between your browser and our website.
• Account login before the chatbot may request information about an identifiable order.
• Server-side checks confirming that the requested order belongs to the authenticated customer account.
• The OpenAI service is not given the customer password, login credentials or website session cookie.
• Restricted staff and system access based on business need.
• Server-side protection of API keys and other credentials.
• Data minimisation so that only information reasonably needed for a chatbot response is selected.
• Logging, rate limits, firewalls, backups and security monitoring appropriate to the service.

No online system can be guaranteed completely secure. Please protect your password and account session, and contact us promptly if you believe your account, email address or order information has been accessed without permission.

12. Automated Decision-Making

The chatbot generates responses automatically, but it is intended to provide information and customer-service assistance only. It does not make solely automated decisions about you that produce legal or similarly significant effects. It does not independently approve or refuse refunds, close accounts, change ownership of an account, determine legal rights, or make credit decisions. Matters requiring judgement can be referred to a member of our team.

13. Changes to This Notice

We may update this privacy notice when our services, providers, legal obligations or data practices change. We will publish the revised notice on this page and change the “Last updated” date. Where a change is material, we may also provide a more prominent notice before the new processing begins.

14. Contact and Complaints

If you have a privacy question, want to exercise a right, or have a complaint, please contact us first by sending a message to support, followed by @ and then our website domain. We obscure the address on this page to reduce automated scraping and malicious email.

You also have the right to complain to the UK Information Commissioner's Office:
Make a complaint to the ICO.

Information about OpenAI's business data processing is available through its Data Processing Addendum and its subprocessor information.