This page explains what we do with your personal data. We are the data controller. Our regulator is the Information Commissioner's Office (ICO).
What we collect, and why
| Data | Why | Legal basis |
|---|---|---|
| Name, delivery address, email, phone | To take payment and get your order to you | Performance of a contract |
| Order history | To handle returns, refunds and warranty claims | Performance of a contract, then legal obligation |
| Payment details | Handled entirely by our payment provider. We never see or store your card number. | Performance of a contract |
| Site measurement and advertising data | To understand which pages work and which adverts brought you here | Your consent, which you can withdraw at any time |
| Email address for marketing | Only if you ask us to | Your consent |
Who else sees it
Only the parties who need it to fulfil your order: Shopify, which runs this shop and stores its data; our payment provider; the supplier who ships your parcel and the carrier who delivers it; and Google, for measurement and advertising, only if you consented.
Some of these are outside the United Kingdom. Where that is the case, transfers rely on the UK International Data Transfer Addendum or on adequacy regulations.
We do not sell your data. We do not share it with anyone who is not needed to serve your order.
How long we keep it
Order records for six years, because tax law requires it. Marketing consent until you withdraw it. Measurement data for 14 months.
Your rights
You can ask us for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, or ask us to restrict it. Write to contact@cremalab.co.uk and we will answer within one month.
If you are not satisfied with our answer, you can complain to the ICO at ico.org.uk or on 0303 123 1113. You do not have to come to us first.