Privacy Policy

1. Information We Collect

Signing in to our website uses your Shopify customer account — we never see or store a password. When you sign in, we receive your name and email address from Shopify so we can show you your account and remember features like your saved binder. When you make a purchase, your order, delivery address, and payment details are collected and processed by Shopify at checkout.

When you submit a contact form or quote request, we collect your name, email address, and the content of your message. We process this data only with your explicit consent, which you provide by ticking the consent checkbox on each form.

2. How We Use Your Information

• To process and deliver your orders
• To manage your account and profile information
• To send order confirmations and shipping updates
• To respond to customer service enquiries
• To improve our website and product offerings
• To send marketing emails (only with your explicit opt-in consent)

We will never sell your personal data to third parties. We do not use your data for automated decision-making or profiling.

3. Legal Basis for Processing

Under UK GDPR, we process your data on the following legal bases:

• Contract: Processing necessary to fulfil your order and manage your account
• Consent: Marketing communications and non-essential cookies (you can withdraw consent at any time)
• Legitimate interest: Improving our website, preventing fraud, and ensuring security
• Legal obligation: Tax records and regulatory compliance

4. Data Retention

We retain your data for the following periods:

• Account data: Retained until you request deletion, or 3 years after your last login if your account is inactive
• Order records: 6 years from the date of purchase (as required by HMRC for tax records)
• Contact form messages: 12 months from the date of submission, then deleted
• Quote/sell requests: 12 months from the date of submission, then deleted
• Cookie consent preferences: Stored in your browser until you clear them

5. Data Security

We take data security seriously. Payment information is processed securely by our payment provider (Shopify Payments) and is never stored on our servers. We use SSL/TLS encryption for all data transmission. Sign-in is handled by Shopify's secure customer authentication — we never see or store your password.

6. Cookies

We use essential cookies to enable core website functionality (shopping basket, authentication). We also use functional cookies for personalisation and third-party cookies for embedded content. Non-essential cookies are only set with your consent via our cookie banner.

For full details on the cookies we use, their purposes, and how to manage them, please see our Cookie Policy.

7. Third-Party Services (Sub-processors)

We share data with the following third-party services as necessary to operate our business:

Each service has its own privacy policy governing how they handle data.

8. Account Data

Your account itself (name, email, addresses, and order history) is held by Shopify, our e-commerce platform, and you can update it from your account page. Our own database stores the site features attached to your account: cards saved to your binder and mystery pack records, linked to your Shopify customer ID and email. If you wish to delete your account and all associated data, please contact us at sales@ethanscards.co.uk and we will process your request within 30 days.

9. Your Rights

Under UK GDPR, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data (subject to legal obligations)
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Request your data in a machine-readable format
• Right to object: Object to processing based on legitimate interest or for direct marketing
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at sales@ethanscards.co.uk. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Children's Privacy

Our website and products are intended for users aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with an updated “Last updated” date. We encourage you to review this policy periodically.

12. Contact

For any privacy-related enquiries, please contact us at sales@ethanscards.co.uk.

Data controller: Ethan's Cards (sole trader), United Kingdom.