Privacy Policy

This Privacy Policy explains how Thallo & Whimsy Ltd collects, uses and protects your personal data when you visit our website or purchase from us.

Thallo & Whimsy Ltd is the data controller responsible for your personal data in accordance with UK data protection law, including the UK General Data Protection Regulation and the Data Protection Act 2018.

1. Company Information

Thallo & Whimsy Ltd is a company registered in England and Wales.

Company number: 16978225

Registered office: Unit A, 82 James Carter Road, Mildenhall, IP28 7DE

Email: thalloandwhimsy@gmail.com

If you have any questions about this Privacy Policy or your personal data, please contact us using the details above.

2. The Personal Data We Collect

When you place an order or attempt to place an order, we may collect:

  1. Your name
  2. Billing address
  3. Shipping address
  4. Email address
  5. Telephone number
  6. Payment details (processed securely by our payment provider)

When you visit our website, we may automatically collect:

  1. IP address
  2. Browser type
  3. Device information
  4. Pages viewed and browsing behaviour
  5. Referral source

This information may be collected using cookies and similar technologies.

We do not knowingly collect personal data from children under the age of 13.

3. How We Use Your Personal Data

We use your personal data to:

  1. Process and fulfil your orders
  2. Provide order confirmations and customer support
  3. Arrange shipping and delivery, including international shipping
  4. Provide necessary information to delivery providers and customs authorities
  5. Prevent fraud and manage risk
  6. Comply with legal and tax obligations
  7. Improve our website and services

If you have opted in to receive marketing communications, we may use your email address to send you updates about our products. You may unsubscribe at any time using the link in our emails or by contacting us.

We do not sell your personal data.

4. Lawful Basis for Processing

Under UK data protection law, we rely on the following lawful bases:

  1. Contract, to fulfil your order and provide our services
  2. Legal obligation, to comply with tax and accounting requirements
  3. Legitimate interests, to prevent fraud and improve our business
  4. Consent, for marketing communications where you have opted in

5. Sharing Your Personal Data

We share your personal data only where necessary to operate our business, including with:

  1. SumUp, to operate our online store and process payments
  2. Payment processors
  3. Delivery providers, including international couriers
  4. Customs authorities where required for international shipments
  5. Professional advisers such as accountants
  6. Analytics providers such as Google Analytics

These providers process your data on our behalf under contractual obligations or as independent controllers where appropriate.

We may also disclose personal data where required by law.

6. International Transfers

Some of our service providers may process personal data outside the United Kingdom, including within the European Economic Area and the United States.

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK data protection law. This may include reliance on UK adequacy regulations or the use of approved contractual safeguards.

7. Data Retention

We retain order and transaction records for at least 6 years to comply with UK tax and accounting obligations.

We retain other personal data only for as long as necessary for the purposes set out in this policy.

8. Your Rights

Under UK GDPR, you have the right to:

  1. Access the personal data we hold about you
  2. Request correction of inaccurate data
  3. Request deletion of your data in certain circumstances
  4. Restrict or object to processing
  5. Request transfer of your data to another provider
  6. Withdraw consent where processing is based on consent

To exercise any of these rights, please contact us using the details above.

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) in the United Kingdom.

9. Cookies

Our website uses cookies to:

  1. Enable essential site functionality
  2. Analyse website traffic
  3. Improve user experience

Non-essential cookies are only used where you have provided consent through our cookie banner.

You can control cookie preferences through your browser settings.

10. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements or business practices. The version in force at the time of your interaction with us will apply.