Privacy Policy.

Your privacy matters to us. This policy explains what information we collect, how we use it, and the choices you have.

Introduction

This Privacy Policy describes how Eden & Willow ([Company Name Ltd], registered in England and Wales, Company No. [XXXXXXXX]) collects, uses, and protects the personal information you provide when using our website (edenandwillow.co.uk) or purchasing from us.

We are committed to protecting your personal data and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We will never sell your personal data to third parties.

Who We Are

Eden & Willow is the data controller responsible for your personal information. If you have any questions about how we handle your data, please contact our Data Protection contact using the details at the bottom of this policy.

Information We Collect

We collect personal information when you interact with us in the following ways:

• Creating an account — name, email address, password (hashed), and optional date of birth.
• Placing an order — billing and delivery addresses, phone number, and payment details (processed securely, we do not store full card numbers).
• Contacting us — name, email address, and the content of your message.
• Subscribing to marketing — email address and marketing preferences.
• Browsing our website — IP address, device type, browser, pages visited, and referral source, collected via cookies and analytics tools.
• Leaving a review — name, email, and the content of your review.

We do not collect sensitive personal data (such as health information or biometric data) and we do not knowingly collect data from children under 13.

How We Use Your Information

We use the information we collect to:

• Process and fulfil your orders, including arranging delivery and handling returns.
• Send you order confirmations, dispatch notifications, and tracking information.
• Manage your account and respond to your enquiries.
• Send marketing emails if you have opted in (you can unsubscribe at any time).
• Improve our website, products, and services through analytics.
• Detect and prevent fraud and protect the security of our systems.
• Comply with legal and regulatory obligations.

Legal Basis for Processing

Under UK GDPR, we rely on the following legal bases to process your personal data:

Cookies & Tracking Technologies

We use cookies and similar technologies to provide a functional, personalised experience on our website. These text files are stored on your device.

• Essential cookies — required for the website to function (e.g. shopping basket, session management). These cannot be disabled.
• Analytics cookies — help us understand how visitors use our site (e.g. Google Analytics). These are only set with your consent.
• Marketing cookies — used to deliver relevant advertising and track campaign performance. These are only set with your consent.
• Preference cookies — remember your settings, such as currency or language.

You can manage your cookie preferences at any time via the cookie settings banner or your browser settings. Disabling certain cookies may affect website functionality.

Sharing Your Information

We do not sell your personal data. We share it only with trusted third parties who help us provide our services:

• Courier partners (Royal Mail, DPD, DHL) — to deliver your orders.
• Payment processors (Stripe, PayPal, Klarna) — to handle transactions securely.
• Email service providers — to send transactional and marketing emails.
• Analytics providers (Google Analytics) — to understand website usage.
• IT and hosting providers — to maintain our website and systems.

All third parties are required to handle your data in accordance with UK GDPR and our data processing agreements. We do not permit them to use your data for their own purposes.

International Transfers

Some of our third-party service providers are based outside the UK or European Economic Area (EEA). Where we transfer personal data internationally, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or adequacy decisions.

For example, Google Analytics may process data on servers in the United States. Google's participation in the UK-US data bridge provides an appropriate level of protection.

Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this policy, or as required by law. Our standard retention periods are:

When data is no longer required, we securely delete or anonymise it.

Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure — request deletion of your data in certain circumstances.
• Right to restrict processing — ask us to limit how we use your data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before processing your request.

Marketing Communications

We will only send you marketing emails if you have explicitly opted in. Each email includes an unsubscribe link — clicking it will remove you from our mailing list immediately. You can also manage your preferences in your account settings.

We may send transactional emails (such as order confirmations and dispatch notifications) regardless of marketing preferences, as these are necessary to fulfil your order.

Children's Privacy

Our website and services are not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected information from a child, please contact us immediately and we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Any changes will be posted on this page with an updated revision date. Where changes are significant, we may notify you by email.

We encourage you to review this policy periodically to stay informed of any updates.

Contact & Complaints

If you have any questions, concerns, or complaints about how we handle your personal data, please contact us: