Privacy policy

Who we are

This site is run by Constroll, a small handmade business based in the United Kingdom. For data protection purposes we’re the data controller. You can reach us at constrollstaff@outlook.com.

What we collect, and why

When you place an order

Your name, email address, delivery address and order details. We need these to make the right thing and post it to the right place. The legal basis is performance of a contract.

When you pay

Your card details go straight to Stripe and are never seen by, sent to or stored on this site. We only ever see the last four digits and whether the payment succeeded.

When you sign up to the newsletter

Your email address, held by MailerLite. The legal basis is your consent, and you can withdraw it at any time using the unsubscribe link in any email.

When you email us

Whatever you put in the email. We keep correspondence so we can pick up the thread if you write again.

What we don’t collect

• No accounts. There’s no login, so there’s no password of yours for us to lose.
• No advertising or social media trackers. No Meta pixel, no Google Ads tags, no cross-site profiling.
• No selling or sharing. Your details are never sold, rented or passed to anyone beyond the processors below.

Cookies and local storage

This site sets no advertising or analytics cookies. Your basket is kept in your browser’s local storage on your own device – it never reaches our server, and clearing your browser data removes it. Stripe sets its own cookies on its checkout pages, which are necessary for payment and fraud prevention; that’s covered by Stripe’s own policy.

Who processes your data

• Stripe – payments, order records and fraud prevention.
• MailerLite – the newsletter list, if you sign up.
• Vercel – hosting, including server logs which contain IP addresses for a short period for security and troubleshooting.
• Royal Mail or a courier – the name and address needed to deliver your parcel.

Each of these is a company in its own right with its own privacy notice. Some may process data outside the UK; where they do, they rely on the safeguards required by UK GDPR.

How long we keep things

Order records are kept for six years, because HMRC requires business records to be retained for that long. Newsletter subscriptions are kept until you unsubscribe. General correspondence is kept for around two years.

Your rights

Under UK GDPR you can ask us for a copy of the data we hold about you, ask us to correct it, ask us to delete it, object to how we’re using it, or ask for it in a portable format. Email constrollstaff@outlook.com and we’ll respond within a month – usually much sooner, because there isn’t much of it.

If you think we’ve got something wrong, please tell us first so we can fix it. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.

Changes

If this policy changes, the date at the bottom of this page changes with it.