Privacy and data protection policy

Last updated: [date to set at go-live]

I respect your privacy and am committed to protecting your personal information.

This Privacy Policy explains what personal information I collect when you visit my website, place an order, contact me or join my mailing list, why I collect it, how I use and protect it, and the rights you have in relation to your information.

Who I am

Sand & Spirit is a small UK business creating handmade resin art, jewellery, homeware and memorial jewellery from my workshop in Berkshire.

Email: [email protected]
Business address: 19 Samborne Drive, Wokingham, Berkshire, RG40 1GF

For the purposes of UK data protection law, Sand & Spirit is responsible for the personal information described in this policy.

Information I may collect

Depending on how you interact with me, I may collect information including:

  • Your name
  • Email address
  • Telephone number, where provided
  • Billing and delivery address
  • Details of products you order
  • Information relating to personalised, bespoke or memorial orders
  • Communications you send to me
  • Newsletter and marketing preferences
  • Transaction and payment confirmation information
  • Information about how you use my website
  • Technical information such as your IP address, browser and device information where collected by my website or associated services

I only aim to collect information that is reasonably necessary to provide my products and services, operate my business and meet my legal obligations.

How I use your information

I may use your personal information to:

  • Process and fulfil your orders
  • Take and confirm payments
  • Create personalised, bespoke and memorial pieces
  • Deliver your purchases
  • Contact you regarding your order
  • Respond to questions and enquiries
  • Manage returns, refunds or problems with an order
  • Maintain appropriate business and accounting records
  • Prevent or investigate fraud and protect my website and business
  • Improve my website and customer experience
  • Send marketing emails where you have chosen to receive them
  • Comply with my legal and regulatory obligations

My lawful bases for using your information

UK data protection law requires me to have a lawful basis for using personal information. Depending on the circumstances, I may process your information because:

  • Contract: I need the information to process an order, take payment, create your products and fulfil my agreement with you.
  • Legal obligation: I may need to retain or process certain information to meet legal, accounting or tax requirements.
  • Legitimate interests: I may use information where reasonably necessary to operate, protect and improve Sand & Spirit, provided those interests do not override your rights and interests.
  • Consent: where appropriate, such as when you actively choose to subscribe to marketing communications. Where I rely on consent, you can withdraw it at any time.

Payments

Payments made through my website are securely processed by Stripe, through WooPayments.

When you make a payment, the information required to process that payment is provided to the payment provider. Sand & Spirit does not receive or store your full debit or credit card details.

I receive information confirming your transaction together with the information necessary to process and fulfil your order.

The payment providers may process personal information for purposes including processing payments, fraud prevention, security and meeting their own legal and regulatory obligations. You can read more about how they handle personal information in their own privacy policies.

Email marketing: MailerLite

I use MailerLite to manage my email mailing list and send newsletters, product news, offers and other Sand & Spirit updates to people who have chosen to receive them.

If you subscribe, information such as your email address and any other information you provide when signing up may be stored and processed through MailerLite.

You can unsubscribe from my marketing emails at any time by using the unsubscribe link contained within my emails.

Unsubscribing from marketing does not prevent me from contacting you where necessary in connection with an order you have placed.

Website and online shop

My website is built using WordPress, and my online shop and customer orders are managed with WooCommerce.

When you place an order through my website, the information necessary to process and fulfil that order will be collected and stored using my website and relevant service providers.

Website analytics

I use Plausible Analytics to understand, at a high level, how my website is used: for example which pages are visited, how visitors arrived at the website and whether orders are completed.

Plausible does not use cookies, does not collect personal information and does not track you across other websites. All of the information it records is aggregated, so no individual visitor can be identified.

[To confirm: Plausible is included as standard if the website is hosted with Prystine.]

I may also use Google Analytics to understand in more detail how my website is used, such as pages visited, approximate location, device and browser information, and how visitors arrived at the website. Google Analytics uses cookies, so it will only be used if you agree to analytics cookies through my cookie consent system.

[To confirm: Google Analytics is optional. Caroline to decide whether she wants it; it needs configuring, and this paragraph comes out if not.]

Advertising and social media tracking

If I use advertising or social media tracking technologies, I will explain what they are used for and provide appropriate controls where consent is required.

[To confirm: whether a Meta (Facebook) Pixel or any other advertising tracking will be installed. If none, replace this section with: “I do not use advertising or social media tracking on my website.”]

Cookies

My website uses cookies and similar technologies.

Some cookies are strictly necessary for the website to function, for example to provide essential shopping basket, checkout or security functions.

Other cookies may be used for purposes such as analytics, remembering preferences or advertising. Non-essential cookies and similar technologies will only be used where permitted and, where consent is required, in accordance with the choices you make through my cookie consent system.

[To confirm: the cookie consent system. This depends on hosting and on whether Google Analytics or any advertising tracking is used.]

Who I share your information with

I do not sell your personal information.

I may share information with trusted third-party providers where necessary to operate my business and provide my services. These may include:

  • Stripe and WooPayments for payment processing
  • MailerLite for email marketing
  • My website hosting and technical service providers
  • Plausible Analytics for aggregated website statistics
  • Delivery and postal providers where necessary to deliver an order
  • Professional advisers such as accountants where necessary
  • Government, regulatory or law-enforcement bodies where I am legally required to provide information

[To confirm: add Google Analytics and any advertising providers to this list if they are used.]

I only provide third parties with information that is reasonably necessary for the relevant purpose.

Memorial jewellery information

When you order memorial jewellery, I may retain additional information necessary to safely identify, manage and fulfil your order.

This may include your order details, contact information, the name or identifying reference associated with the memorial piece, the date ashes were received, production information and records relating to the return of unused ashes.

This information is used to maintain accurate records and ensure that ashes entrusted to Sand & Spirit can be correctly identified throughout the creation and return process.

I take particular care with records associated with memorial orders because of the personal and sensitive nature of these purchases.

Please see my separate Memorial Jewellery Terms & Returns Policy for more information about how ashes are handled.

How long I keep your information

I only keep personal information for as long as reasonably necessary for the purpose for which it was collected, including meeting legal, tax and accounting requirements and dealing with potential disputes or enquiries.

Different types of information may therefore be retained for different periods.

Marketing information is retained until you unsubscribe, withdraw your consent where applicable, or I determine that it is no longer appropriate to retain it.

I periodically review the personal information I hold and securely delete or anonymise information that I no longer need.

Keeping your information secure

I take reasonable organisational and technical measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

I also take care to restrict access to customer and memorial-order information to those who genuinely need access to it.

However, no method of electronic transmission or storage can be guaranteed to be completely secure.

International data transfers

Some of the third-party services I use may process or store information outside the UK.

Where personal information is transferred internationally, I expect appropriate safeguards to be used in accordance with applicable UK data protection law.

[To confirm: review once hosting and all website providers are confirmed.]

Your data protection rights

Depending on the circumstances, UK data protection law gives you rights over your personal information. These may include the right to:

  • Ask me for a copy of the personal information I hold about you
  • Ask me to correct inaccurate or incomplete information
  • Ask me to delete your personal information in certain circumstances
  • Ask me to restrict the way I use your information in certain circumstances
  • Object to certain uses of your personal information
  • Request transfer of certain information
  • Withdraw your consent where I rely on consent to process your information

These rights are not absolute and may depend on the circumstances and my legal obligations.

If you would like to exercise any of these rights, please contact me at [email protected]. I may need to verify your identity before responding to a request.

Marketing communications

I will only send you electronic marketing communications where I have an appropriate lawful basis to do so.

You can unsubscribe at any time by clicking the unsubscribe link in one of my marketing emails or by contacting me.

You will still receive essential communications relating to orders you place with me.

Children’s information

My website and products are not specifically directed at children and I do not knowingly collect personal information directly from children for marketing purposes.

Complaints

If you have concerns about how Sand & Spirit has handled your personal information, please contact me first and I will do my best to resolve the matter.

You also have the right to raise a concern with the Information Commissioner’s Office (ICO), the UK’s data protection regulator.

Changes to this privacy policy

I may update this Privacy Policy occasionally to reflect changes to my business, website, service providers or legal obligations.

The latest version will always be published on my website and the date at the top of this policy will show when it was last updated.

Contact me

If you have any questions about this Privacy Policy or how I use your personal information, please contact me at [email protected].