The short version
Twistaroo is a small family business. We only collect the information we need to send you your order and look after you as a customer. We never sell your details, we don't send marketing emails, and we never see your card details. The rest of this page explains all of that in more detail.
Who we are
Twistaroo is run by Sam [SURNAME], a sole trader based in the UK.
Postal address: [POSTAL ADDRESS]
Email: sam@twistaroo.co.uk
Website: https://twistaroo.co.uk
[ICO registration number: [ICO NUMBER] — include only if registered]
In data protection law, we are the "controller" of your personal information. That means we're responsible for how it's used and for keeping it safe.
What information we collect, and when
When you buy something. Payment is handled by Stripe, a company that specialises in taking payments securely. At the checkout, Stripe asks for your name, email address, delivery address and card details. Stripe passes the following to us so we can send your order: your name, email address, delivery address, what you bought, how much you paid, the date, and Stripe's order reference. We never see or store your card details. Stripe also emails you the receipt.
When you email us. We keep your email address, your name and what you've written, so that we can reply and sort out whatever you need.
When you visit the website. Our website is hosted by a company called Netlify. Like almost every website, Netlify's servers automatically record basic technical details about each visit: your IP address (a number that identifies your internet connection), the pages you looked at, the date and time, and the type of browser and device you used. We don't add anything to this.
Fonts. The website uses typefaces from Google Fonts. Your browser downloads these directly from Google's servers, which means Google receives your IP address and some basic details about your browser.
Your shopping cart. When you add a Twistaroo to your cart, that's remembered by your own web browser on your own device (using something called "local storage"). It is never sent to us or to anyone else. There's more on this under "Cookies and local storage" below.
What we don't collect. We don't have customer accounts, a newsletter or a mailing list. We don't buy or collect information about you from other companies. We don't use your information to make automated decisions about you. (Stripe may run automated fraud checks on payments; that's covered by Stripe's own privacy policy.)
Why we use your information, and our legal reason for doing so
UK data protection law says we need a proper reason (a "lawful basis") for using your personal information. Here is what we do and why:
- To process and deliver your order, and to help if something goes wrong. Legal basis: this is necessary to carry out our contract with you. Without your name and delivery address, we can't send you your order.
- To keep records of sales. Legal basis: we are legally required to keep these for HMRC.
- To keep the website secure, prevent fraud and fix technical problems (the server logs described above). Legal basis: our legitimate interest in running a safe, working website. We've considered this and don't believe it affects your privacy in any serious way.
- To make the website display properly (Google Fonts). Legal basis: our legitimate interest in having a clear, readable website.
- To reply to your emails. Legal basis: our contract with you if it's about an order; otherwise our legitimate interest in being helpful to the people who contact us.
Where we rely on "legitimate interests", you have the right to object. See "Your rights" below.
Who we share your information with
We only share your details with the companies we need to in order to run the shop:
- Stripe takes your payment, collects your email address and delivery address, and sends your receipt. Stripe handles your card details under its own strict security rules. For some things (such as fraud prevention), Stripe is responsible for your information in its own right. Stripe's privacy policy is at https://stripe.com/gb/privacy.
- Netlify hosts the website and keeps the server logs described above. Netlify's privacy policy is at https://www.netlify.com/privacy/.
- Royal Mail (or another courier) receives your name and address so they can deliver your parcel. Royal Mail's privacy notice is at https://www.royalmail.com/privacy-notice.
- Google provides the fonts the website uses, so Google receives your IP address when a page loads. We also use Google Search Console, which shows us how our website appears in Google search results. This gives us general statistics from Google and does not collect anything from your visit to our site. Google's privacy policy is at https://policies.google.com/privacy.
We may also have to share information if the law requires it, for example with HMRC, the police or a court.
We never sell your details, and we never pass them to anyone for marketing.
Information sent outside the UK
Stripe, Netlify and Google are international companies, and some of their computer systems are outside the UK, including in the United States. When they handle your information abroad, they do so under safeguards recognised by UK law, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK–US Data Bridge for certified US companies. If you'd like more detail, email sam@twistaroo.co.uk.
How long we keep your information
- Order records (name, address, what you bought, amount paid): for 6 years after the end of the tax year in which you bought it. HMRC requires us to keep these.
- Emails: emails about an order are kept with that order's record. Other emails are deleted [EMAIL RETENTION PERIOD, e.g. 12 months] after your query is resolved.
- Server logs: kept by Netlify for a short time under its own retention rules. We don't download or keep copies.
- Your shopping cart: stays in your own browser until you empty it or clear your browser's site data. We never have it.
Your rights
Under UK data protection law, you can:
- Ask for a copy of the personal information we hold about you.
- Ask us to correct anything that is wrong or out of date.
- Ask us to delete your information. We'll do this unless the law says we must keep it, for example tax records for HMRC.
- Ask us to limit how we use your information while a question or disagreement is sorted out.
- Ask for your information in a portable format, so you can take it elsewhere.
- Object to our using your information where we rely on legitimate interests.
To do any of these, email sam@twistaroo.co.uk. There's no charge. We'll reply within one month. We may ask you to confirm who you are first, so that we don't give your information to the wrong person.
If you're not happy
Please tell us first. Email sam@twistaroo.co.uk and we'll do our best to put it right.
You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO):
Website: https://ico.org.uk
Helpline: 0303 123 1113
Cookies and local storage
Cookies are small files that a website can store on your device to recognise you or follow what you do.
Our website does not set any cookies of its own, and does not use tracking or advertising cookies.
Your shopping cart is kept in your browser's "local storage". This is a similar idea to a cookie, but it stays on your device and is never sent to anyone. It is strictly necessary for the shop to work, so the law doesn't require us to ask your permission for it. You can clear it at any time by emptying your cart or clearing your browser's site data.
Stripe's checkout. When you click to pay, you're taken to a page run by Stripe. Stripe sets its own cookies on that page to make the payment work securely and to help prevent fraud. These are Stripe's cookies, not ours. Details are in Stripe's cookie policy, which is linked from https://stripe.com/gb/privacy.
Children
Our website and products are not aimed at children under 16, and we don't knowingly collect information from them. If you think a child has given us their details, please email us and we'll delete them.
Keeping your information safe
The website is served over a secure (https) connection. Payments are handled entirely by Stripe, so we never hold card details. The order information we do hold is kept in password-protected accounts, and only the people who need it to run the business can see it.
Changes to this policy
We may update this policy from time to time, for example if we change the services we use. The date at the top shows when it was last changed. If we make a significant change, we'll make that clear on the website.