Privacy Policy

1. Information We Collect

When you register for an account, we collect your name, email address, and password (stored securely as a hash — we never store your actual password). You may also optionally provide your phone number and delivery address. When you make a purchase, we collect payment information. We also collect browsing data such as pages visited and search queries to improve our service.

When you submit a contact form or quote request, we collect your name, email address, and the content of your message. We process this data only with your explicit consent, which you provide by ticking the consent checkbox on each form.

2. How We Use Your Information

• To process and deliver your orders
• To manage your account and profile information
• To send order confirmations and shipping updates
• To respond to customer service enquiries
• To improve our website and product offerings
• To send marketing emails (only with your explicit opt-in consent)

We will never sell your personal data to third parties. We do not use your data for automated decision-making or profiling.

3. Legal Basis for Processing

Under UK GDPR, we process your data on the following legal bases:

• Contract: Processing necessary to fulfil your order and manage your account
• Consent: Marketing communications and non-essential cookies (you can withdraw consent at any time)
• Legitimate interest: Improving our website, preventing fraud, and ensuring security
• Legal obligation: Tax records and regulatory compliance

4. Data Retention

We retain your data for the following periods:

• Account data: Retained until you request deletion, or 3 years after your last login if your account is inactive
• Order records: 6 years from the date of purchase (as required by HMRC for tax records)
• Contact form messages: 12 months from the date of submission, then deleted
• Quote/sell requests: 12 months from the date of submission, then deleted
• Cookie consent preferences: Stored in your browser until you clear them

5. Data Security

We take data security seriously. Payment information is processed securely by our payment provider (Shopify Payments) and is never stored on our servers. We use SSL/TLS encryption for all data transmission. Passwords are hashed using industry-standard algorithms and cannot be viewed by anyone, including our staff.

6. Cookies

We use essential cookies to enable core website functionality (shopping basket, authentication). We also use functional cookies for personalisation and third-party cookies for embedded content. Non-essential cookies are only set with your consent via our cookie banner.

For full details on the cookies we use, their purposes, and how to manage them, please see our Cookie Policy.

7. Third-Party Services (Sub-processors)

We share data with the following third-party services as necessary to operate our business:

Each service has its own privacy policy governing how they handle data.

8. Account Data

Your account data (name, email, phone, and address) is stored securely in our database. You can update your profile information at any time from your account page. If you wish to delete your account and all associated data, please contact us at support@ethanscards.co.uk and we will process your request within 30 days.

9. Your Rights

Under UK GDPR, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data (subject to legal obligations)
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Request your data in a machine-readable format
• Right to object: Object to processing based on legitimate interest or for direct marketing
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at support@ethanscards.co.uk. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Children's Privacy

Our website and products are intended for users aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with an updated “Last updated” date. We encourage you to review this policy periodically.

12. Contact

For any privacy-related enquiries, please contact us at support@ethanscards.co.uk.

Data controller: Ethan's Cards (sole trader), United Kingdom.