[PLACEHOLDER] against what this business
actually does — which payment processor, courier, email platform and analytics tools are really
in use — since a privacy policy has to accurately describe real processing, not just look
correct.
1. Who we are
This privacy notice explains how ShellyUK (“we”, “us”, “our”) collects, uses, shares and protects your personal data when you visit this website or buy from us. We are the data controller for the personal data described in this notice.
| Trading name | ShellyUK |
|---|---|
| Operated by | Greg Kilpatrick and Lewis Harrison-Wood — an ordinary business partnership, not a limited company, so no Companies House number applies |
| Trading address | 4 The Mews, Hindley, Wigan, WN2 3EZ |
| Data protection contact | hello@shellyuk.com |
| ICO registration number | [PLACEHOLDER, if registered] |
2. What personal data we collect
We collect the following categories of personal data:
- Identity and contact data: name, billing and delivery address, email address, telephone number.
- Order data: what you’ve bought, order value, order history.
- Payment data: processed directly by our payment provider — see Section 5. We don’t store full card details ourselves.
- Account data: if you create an account, your login details and saved addresses.
- Technical and usage data: IP address, browser type, device information, and how you use this site, collected via cookies and similar technologies — see Section 8.
- Marketing preferences: whether you’ve opted in or out of marketing emails.
3. How we collect it
We collect most of this data directly from you — when you browse the site, create an account, place an order, or contact us. We also collect some technical data automatically via cookies (Section 8), and receive delivery status updates from our courier.
4. How and why we use your data
| Purpose | Process and fulfil your order, including payment, delivery and customer service |
|---|---|
| Lawful basis | Performance of a contract with you |
| Purpose | Maintain accounting and tax records |
|---|---|
| Lawful basis | Legal obligation |
| Purpose | Send you marketing emails about products and offers |
|---|---|
| Lawful basis | Consent (only where you’ve opted in — you can withdraw this at any time) |
| Purpose | Improve this website and understand how it’s used |
|---|---|
| Lawful basis | Legitimate interests (running and improving our business) / consent for non-essential cookies |
| Purpose | Prevent fraud and protect the security of this site |
|---|---|
| Lawful basis | Legitimate interests |
5. Who we share your data with
We share personal data with the third parties needed to run our business and fulfil your order, and only to the extent necessary:
- Payment processing: Square — handles your payment details directly; we don’t see or store full card numbers.
- Delivery: Royal Mail (Tracked 24/Tracked 48) and other couriers for special or larger orders — receives your name and delivery address to deliver your order.
- Website hosting and email: [PLACEHOLDER: hosting provider, email/marketing platform if any].
- Analytics: [PLACEHOLDER: e.g. Google Analytics, if in use — remove this row if not].
- Legal and regulatory bodies where we’re required to by law, or to protect our legal rights.
We do not sell your personal data to third parties.
6. International data transfers
Some of the third parties listed in Section 5 may store or process data outside the UK. Where that happens, we rely on legal safeguards recognised under UK data protection law — such as the UK’s own adequacy regulations or standard contractual clauses — to ensure your data is protected to the same standard as it would be in the UK. [PLACEHOLDER: confirm once actual third-party providers and their data locations are known.]
7. How long we keep your data
- Order and payment records: 6 years, to meet UK tax and accounting record-keeping requirements.
- Account data: for as long as your account is active, or until you ask us to delete it.
- Marketing data: until you unsubscribe or withdraw consent.
8. Cookies
This site uses cookies and similar technologies. We categorise them as follows:
- Strictly necessary — required for the site to function (e.g. remembering what’s in your basket, keeping you logged in). These can’t be switched off.
- Analytics — help us understand how visitors use the site, only set with your consent. [PLACEHOLDER: name the actual analytics tool(s) in use, if any.]
- Marketing — used to show relevant ads or measure marketing campaigns, only set with your consent. [PLACEHOLDER: name the actual marketing/ad tools in use, if any.]
You can manage or withdraw cookie consent at any time via your browser settings or, where provided, the cookie preferences link on this site.
9. Security
We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse, including secure (HTTPS) transmission and restricted access to personal data within our business. No online service can guarantee absolute security, but we take this seriously and review our practices regularly.
10. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — ask us to delete your data, where there’s no legal reason for us to keep it.
- Restrict processing — ask us to limit how we use your data in certain circumstances.
- Data portability — request a copy of your data in a portable, machine-readable format.
- Object to processing based on legitimate interests, or to direct marketing at any time.
- Withdraw consent at any time, where we rely on consent (this won’t affect processing already carried out).
To exercise any of these rights, contact us at hello@shellyuk.com. We’ll respond within one month, as required by law.
You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk or by calling 0303 123 1113 — though we’d appreciate the chance to resolve any concern directly first.
11. Children’s privacy
This site is not directed at children, and we don’t knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we’ll delete it.
12. Automated decision-making
We do not use your personal data for any automated decision-making that produces legal or similarly significant effects on you.
13. Changes to this notice
We may update this privacy notice from time to time. The current version is always the one published on this page, with the date below.
14. Contact us
Questions about this notice or how we handle your data? Email hello@shellyuk.com or use our Contact page.
Last updated: [PLACEHOLDER: date] — draft, not yet finalised.