Legal

Privacy Policy

Last updated {{ lastUpdated }}

Silk Wings is a small handmade business. We collect the minimum we need to send you your order and keep our records straight, we do not sell your information to anyone, and you can ask us to delete it. This page explains that in full.

1. Who is responsible for your data

{{ traderIntro }} We are the data controller for the information described here, and we trade online only. Our service address is available in writing on request. You can contact us about anything on this page at {{ contactEmail }}.

2. What we collect and why

Name, delivery address, email and phone number

To make the contract with you, pack and post your order, and contact you about it. Lawful basis: performance of a contract.

Order and payment records

To handle refunds, returns and faults, and to keep the accounting records HMRC requires. Lawful basis: contract, and legal obligation.

Emails you send us

To answer your question and keep a record of what was agreed. Lawful basis: legitimate interests in running the business and dealing with enquiries.

Card details

We never receive or store these. Payment is handled entirely by Stripe on their own secure checkout.

We do not ask for any special category data, and we do not make automated decisions or profile you.

3. Who we share it with

We share only what is necessary, and only with organisations that process the information on our behalf or have their own legal duty to handle it:

Stripe processes your payment and holds the transaction record. Stripe operates internationally and transfers are covered by their standard contractual clauses. Their own privacy policy is at stripe.com/gb/privacy.

Royal Mail receives your name and delivery address in order to deliver the parcel.

Our email provider stores the messages we exchange with you.

Our accountant and HMRC, where required for tax records.

We never sell, rent or trade your personal information, and we do not pass it to advertisers.

4. How long we keep it

Order and payment records are kept for six years after the end of the tax year they fall in, which is the period HMRC requires. General email correspondence is kept for up to two years and then deleted. If you ask us to delete your information we will do so, except for anything we are legally required to retain.

5. Marketing

We will only send you marketing email if you have asked us to. Every such email includes an unsubscribe link, and you can also ask us to stop at any time by replying or emailing us. Unsubscribing does not affect emails about an order you have already placed.

6. Cookies

Our website itself does not set advertising or analytics cookies, and there is nothing for you to consent to in order to browse it. When you go through to checkout, Stripe sets cookies that are strictly necessary to process your payment and to prevent fraud. If we add analytics in future we will ask for your consent first and update this page.

7. Your rights

Under UK GDPR you have the right to ask for a copy of the information we hold about you, to have it corrected if it is wrong, to have it deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time.

Email {{ contactEmail }} to exercise any of these. We will respond within one month and it is free of charge.

8. Security and complaints

Order information is held in password-protected accounts and only the owner of the business has access to it. Our website is served over an encrypted connection and payment is handled on Stripe's own secure pages.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113.

In short

Your address to post the parcel, your email to confirm it, a record for the taxman. Nothing else, nobody else.