Privacy policy
What we collect, why we collect it, and how to make us stop. Written to be read, not to be skipped.
Last updated 26 September 2026
Business details not filled in yet — this page is incomplete.
The following must come from the real registered business before the store can trade. They have deliberately been left blank rather than filled with plausible-looking placeholders.
BUSINESS_LEGAL_NAME— Distance sellers must identify the trader (S.I. 484/2013). Shown on Terms, Privacy and invoices.BUSINESS_SUPPORT_EMAIL— A monitored contact address is legally required and is where cancellation notices arrive.BUSINESS_RETURNS_ADDRESS— The returns policy cannot tell customers where to send goods without it.
Who's responsible for your data
The data controller is 1 Main Street, Midleton, Co. Cork, Ireland, Ireland.
We’re based in Ireland, so the Data Protection Commission is our supervisory authority, and the GDPR applies to everything below.
What we collect and why
- Your order details — name, delivery address, email, phone if you gave one, and what you bought. We need these to take the order and get it to you. Legal basis: performance of a contract.
- Your basket — held against a random token in a cookie so your basket survives a page refresh. Legal basis: strictly necessary for a service you asked for.
- Your account, if you make one — email and a hashed password. We never store the password itself, only a one-way hash. Legal basis: contract.
- Marketing emails — only if you ticked the box. Legal basis: your consent, which you can withdraw in one click from any email.
- Analytics — only if you accept analytics cookies. Legal basis: consent. Decline and no analytics script loads at all.
We don’t collect anything we don’t have a use for, and we don’t buy personal data from anyone.
Card payments
Card details are entered on Stripe’s payment page and go straight to Stripe. They never touch our servers and we never see or store a card number. We keep only Stripe’s reference for your payment so we can match it to your order and process refunds.
Stripe is a payment processor in its own right — see Stripe’s privacy policy.
Who else sees your data
Only the parties that are needed to actually deliver your order:
- Suppliers and warehouses — your name and delivery address, so they can post the parcel. Nothing else.
- Carriers — the same, plus your email or phone if you want delivery notifications.
- Stripe — payment processing.
- Our email provider — to send order confirmations and, with consent, marketing.
We do not sell your data, rent it, or share it for anyone else’s advertising. Where a processor is outside the EEA, the transfer relies on the European Commission’s standard contractual clauses.
How long we keep it
- Orders and invoices: six years. Irish tax law requires it — we can’t delete these earlier even if you ask.
- Account details: until you close the account, then 30 days.
- Abandoned baskets: 90 days, then deleted.
- Marketing consent records: for as long as you’re subscribed, plus two years so we can prove consent existed.
Your rights
Under the GDPR you can ask us to:
- give you a copy of everything we hold about you;
- correct anything that’s wrong;
- delete it (except records we’re legally required to keep);
- stop using it for a particular purpose;
- hand it over in a portable format;
- withdraw consent at any time, without affecting what was lawful beforehand.
Ask via the contact page and we’ll respond within one month. It’s free. If you’re unhappy with how we handle it you can complain to the Data Protection Commission.
Cookies
Covered in detail on the cookies page. The short version: strictly necessary cookies only, unless you explicitly accept more.
Changes
If this policy changes materially we’ll update the date at the top and, where it affects you meaningfully, tell you by email.