Privacy Policy
[Business Name] ("we", "us", "our") runs the Rose & Drake website at roseanddrake.co.uk. This page explains what personal data we collect when you use the site, why, and what rights you have over it. Last updated: [date].
Who we are
Rose & Drake is operated by [Business Name / your name], [business address]. For anything relating to this policy or your personal data, you can reach us at [privacy@example.com].
What we collect, and why
We only collect what we need to run the shop:
- Placing an order — your name, email address and shipping address, so we can fulfil the order, contact you about it, and let you look it up later using your email and confirmation code. This is necessary to perform the contract when you buy something from us.
- Leaving a review — the email and confirmation code from a genuine order (to confirm you actually bought the item), an optional display name, and your rating and comment. The email and confirmation code are used only to verify the review and are not shown publicly; the name and comment are shown on the product page.
- Contacting us — your name, email address and message, so we can reply to your enquiry.
We don't sell your data, and we don't use it for advertising or profiling.
Payment
[This site does not currently process real payments — update this section once a payment provider (e.g. Stripe, PayPal) is connected, naming the provider and confirming that card details are handled by them directly and never stored by us.]
Cookies and similar storage
This site does not use cookies for tracking or advertising. Your basket is remembered using your browser's built-in session storage (not a cookie) purely so it survives a page refresh — it's cleared automatically when you close the tab, and it never leaves your device. Because this storage is strictly necessary for the basket to work, we don't need to ask your permission to use it.
The site loads fonts from Google Fonts, which involves your browser making a request directly to Google's servers and sharing your IP address with them as part of that request. No Rose & Drake account or order data is involved in that request.
How long we keep your data
We keep order records for as long as necessary to deal with returns, disputes and our accounting/tax obligations (typically up to six years). Reviews are kept for as long as the product listing exists, or until you ask us to remove one. Contact enquiries are kept only as long as needed to resolve them.
Where your data is stored
Our website and database are hosted with Fly.io, with servers located in London, UK.
Your rights
Under UK GDPR, you can ask us to:
- Send you a copy of the personal data we hold about you
- Correct anything that's inaccurate
- Delete your data, where we're not required to keep it (e.g. for tax records)
- Restrict or object to how we use it
To ask us to do any of these, email [privacy@example.com]. If you're not happy with how we've handled your data, you can also complain to the Information Commissioner's Office, the UK's data protection regulator.
Changes to this policy
If we change how we handle your data, we'll update this page and change the date at the top.