Data
Privacy notice
We hold an address so a parcel can reach it and an email address so you can be told when a window opens. That is close to the whole of it, and the detail is below.
This notice is a template. It has not been reviewed by a solicitor or a data protection adviser, and the entries marked {CONFIRM} are outstanding.
Who is responsible
The data controller is {CONFIRM}, a company registered in England and Wales under company number {CONFIRM}, whose registered office is at {CONFIRM}. Trading as Proper Hardman.
Data protection enquiries go to {CONFIRM}. We have not appointed a data protection officer, because the size and nature of the business does not require one. This notice is written to meet the UK General Data Protection Regulation and the Data Protection Act 2018.
What we hold and why
Each row states the lawful basis under Article 6 of the UK GDPR that permits us to hold it, and how long it is kept.
| Record | What it contains | Lawful basis | Retention |
|---|---|---|---|
| Order details | Name, delivery address, email address, telephone number if you give one, the items and sizes ordered, the amount paid. | Contract | Six years from the end of the tax year in which the order was placed, because UK tax law requires it. |
| Payment details | Handled entirely by Stripe. We receive a confirmation, the last four digits of the card and the card type. We never see or hold the full card number. | Contract and legal obligation | Six years, as above. The card data itself is held by Stripe, not by us. |
| The drop list | The email address you give us to be told when a window opens. | Consent | Until you unsubscribe, or after two years of no engagement, whichever comes first. |
| Enquiries | Whatever you put in an email to us, and our reply. | Legitimate interests | Two years from the last message in the thread. |
| Site logs | The hosting provider records requests, including IP addresses, to keep the site up and to block abuse. | Legitimate interests | As set by the hosting provider. See the processors below. |
The table scrolls sideways on a narrow screen.
Where we rely on legitimate interests, the interest is keeping the site running, preventing fraud and abuse, and answering the messages people send us. We have considered your rights and freedoms against those interests and consider the processing proportionate. You can object at any time.
We do not sell personal data, we do not share it for anyone else's marketing, and we do not make automated decisions or profile you.
Who else touches it
These are processors acting on our instructions under a written contract. They are named because you are entitled to know who holds your order.
- Stripe
- Takes and processes payments and holds the card data we never see. Stripe acts as an independent controller for parts of that processing under its own terms.
- Email provider
- Sends order confirmations, dispatch notices and drop-list messages, and holds the addresses those are sent to. Provider is {CONFIRM}.
- Hosting provider
- Serves this site and keeps request logs for availability and abuse prevention. Provider is {CONFIRM}.
- Fulfilment and postage
- The printer and the carrier receive the name and delivery address needed to make the parcel and deliver it, and nothing else. Printer and carrier are {CONFIRM}.
- Transfers abroad
- Some of these providers process data outside the United Kingdom. Where they do, the transfer is covered by UK adequacy regulations or by the International Data Transfer Agreement or Addendum. The specific mechanism for each provider is {CONFIRM}.
Cookies
This site sets no advertising cookies and no analytics cookies. There is no tracking pixel, no advertising network tag and no third-party script watching you read this sentence. That is why there is no consent banner: there is nothing to consent to.
The one thing stored on your device is your basket, kept in your browser's local storage so that the items survive a refresh. It stays on your device, it is never sent to us until you go to checkout, and clearing your browser data removes it.
If you go to checkout, Stripe sets its own cookies on its own pages to process the payment and to prevent fraud. Those are strictly necessary for the payment to work and are described in Stripe's own privacy policy.
Your rights
Under UK GDPR you have the following rights. Ask at {CONFIRM} and we will answer within one month. Exercising them is free.
- Access
- Ask for a copy of the personal data we hold about you.
- Rectification
- Have anything inaccurate corrected.
- Erasure
- Ask us to delete your data, where we are not required by law to keep it.
- Restriction
- Ask us to stop using your data while a question about it is resolved.
- Portability
- Receive the data you gave us in a common machine-readable format.
- Objection
- Object to processing we carry out on the basis of legitimate interests.
- Withdraw consent
- Leave the drop list at any time, using the link in any message we send. Withdrawing consent does not undo anything done before you withdrew it.
Complaints
If you think we have handled your data badly, tell us first at {CONFIRM} and we will look at it properly.
You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at ico.org.uk, by telephone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You do not have to come to us first.
This notice was last updated {CONFIRM}. If we change it, the version on this page is the one that applies.