PRIVACY POLICY

1. INFORMATION ON THE COLLECTION OF PERSONAL DATA AND CONTACT DETAILS OF THE CONTROLLER

1.1 We are delighted that you are visiting our website and thank you for your interest. Below we inform you about the processing of your personal data when using our website. Personal data is all data that can be used to identify you personally.

1.2 The controller for data processing on this website within the meaning of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 is London Crafts, contactable at info@london-crafts.co.uk. The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

1.3 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (for example orders or enquiries sent to the controller). You can recognise an encrypted connection by the string "https://" and the padlock symbol in your browser bar.

2. DATA COLLECTION WHEN VISITING OUR WEBSITE

When you use our website purely for information purposes — that is, if you do not register or otherwise transmit information to us — we only collect the data that your browser transmits to our server (known as "server log files"). When you visit our website, we collect the following data, which is technically necessary to display the site to you:

• The website visited
• The date and time of access
• The amount of data sent, in bytes
• The source or referring link through which you reached the page
• The browser used
• The operating system used
• The IP address used (where applicable: in anonymised form)

Processing is carried out in accordance with Article 6(1)(f) UK GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to check the server log files retrospectively if there are specific indications of unlawful use.

3. COOKIES

In order to make visiting our website attractive and to enable the use of certain functions, we use cookies on various pages. These are small text files stored on your device. Some of the cookies we use are deleted at the end of the browser session, that is, after you close your browser (session cookies). Other cookies remain on your device and allow us, or our partner companies (third-party cookies), to recognise your browser on your next visit (persistent cookies).

When cookies are set, they collect and process certain user information such as browser and location data as well as IP address values, on an individual basis. Persistent cookies are automatically deleted after a set period, which may vary depending on the cookie.

In some cases, cookies are used to simplify the ordering process by saving settings (for example remembering the contents of a virtual basket for a later visit to the website). Where personal data is also processed by individual cookies set by us, the processing is carried out in accordance with Article 6(1)(b) UK GDPR for the performance of the contract, or in accordance with Article 6(1)(f) UK GDPR to safeguard our legitimate interests in the best possible functionality of the website and a user-friendly and effective design of the page visit.

We may work with advertising partners who help us make our website more interesting for you. For this purpose, cookies from partner companies may also be stored on your device when you visit our website (third-party cookies).

Please note: You can set your browser to inform you about the setting of cookies and decide individually whether to accept them, or to exclude the acceptance of cookies in certain cases or generally. Every browser differs in the way it manages cookie settings. Please note that the functionality of our website may be limited if cookies are not accepted.

Browser cookie settings:

• Microsoft Edge: support.microsoft.com/microsoft-edge
• Firefox: support.mozilla.org/kb/cookies-information-websites-store-on-your-computer
• Chrome: support.google.com/chrome/answer/95647
• Safari: support.apple.com/en-gb/guide/safari/sfri11471/mac
• Opera: help.opera.com/en/latest/web-preferences/#cookies

4. CONTACT

When you contact us (for example via the contact form or by email), personal data is collected. Where a contact form is used, the data collected is shown in the relevant contact form. This data is stored and used exclusively for the purpose of responding to your request or contacting you, and for the associated technical administration.

The legal basis for processing the data is our legitimate interest in responding to your request in accordance with Article 6(1)(f) UK GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Article 6(1)(b) UK GDPR. Your data will be deleted after your request has been fully dealt with, provided that no statutory retention obligations prevent this.

5. DATA PROCESSING WHEN OPENING A CUSTOMER ACCOUNT AND PROCESSING THE CONTRACT

In accordance with Article 6(1)(b) UK GDPR, personal data will continue to be collected and processed when you provide it to us for the performance of a contract or when opening a customer account. The data collected is shown in the respective input forms.

You can delete your customer account at any time by sending a message to the contact address of the controller given above. We store and use the data you provide in order to process the contract. After the contract has been fully processed or your customer account deleted, your data will be restricted with regard to tax and commercial retention periods and deleted after those periods have expired, unless you have expressly consented to further use of your data.

6. USE OF YOUR DATA FOR DIRECT MARKETING

6.1 — Email newsletter subscription

If you subscribe to our email newsletter, we will send you regular information about our offers. The only mandatory information for sending the newsletter is your email address. We use the double opt-in procedure for sending the newsletter. This means that we will only send you an email newsletter after you have expressly confirmed your consent to receive newsletters.

By activating the confirmation link, you give us your consent to the use of your personal data in accordance with Article 6(1)(a) UK GDPR. When you subscribe to the newsletter, we store the IP address assigned by your internet service provider (ISP) as well as the date and time of subscription. You can unsubscribe from the newsletter at any time using the link provided in the newsletter. After unsubscribing, your email address will be deleted from our mailing list immediately.

6.2 — Email newsletter to existing customers

If you have provided us with your email address when purchasing goods or services, we reserve the right to send you regular email offers for similar goods or services from our range. We do not need to obtain separate consent from you for this. Data processing is carried out solely on the basis of our legitimate interest in personalised direct marketing in accordance with Article 6(1)(f) UK GDPR. You have the right to object at any time to the use of your email address for marketing purposes, with effect for the future.

7. DATA PROCESSING FOR ORDER FULFILMENT

7.1 The personal data we collect will be passed on to the transport company commissioned with the delivery as part of the processing of the contract, insofar as this is necessary for the delivery of the goods. We will pass on your payment data to the commissioned credit institution as part of payment processing, insofar as this is necessary for processing the payment. The legal basis for the transfer of data is Article 6(1)(b) UK GDPR.

7.2 — Payment service providers

PayPal: When paying via PayPal, by card via PayPal, or by direct debit via PayPal, we transmit your payment data to PayPal. The transfer is carried out in accordance with Article 6(1)(b) UK GDPR and only to the extent necessary for payment processing. PayPal reserves the right to carry out a credit check. You can object to this processing at any time by sending a message to PayPal.

Card, Apple Pay and Google Pay: When paying by credit or debit card or through a digital wallet, your payment data is transmitted to the payment provider processing the transaction, solely for the purpose of processing that payment and only to the extent necessary for that purpose.

8. REVIEW REMINDER

We use your email address for a one-off reminder inviting you to submit a review of your order for the review system we use, provided that you have given us your express consent in accordance with Article 6(1)(a) UK GDPR during or after your order. You can withdraw your consent at any time by sending a message to the controller.

9. USE OF SOCIAL MEDIA: SOCIAL PLUGINS

9.1 — Facebook plugins (Shariff solution)

Our website uses social plugins from the social network Facebook, operated by Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA. To strengthen the protection of your data when visiting our website, these buttons are not integrated as unrestricted plugins, but only by means of an HTML link. This ensures that no connection is established with Facebook servers when you access a page on our website containing such buttons. When you click the button, a new browser window opens and calls up the Facebook page where you can interact with the plugins.

9.2 — Instagram plugin (Shariff solution)

Our website uses social plugins from the online service Instagram, operated by Meta Platforms, Inc. The same Shariff HTML link solution applies, ensuring that no connection to Instagram servers is established until you actively click the button.

10. ONLINE MARKETING

10.1 — Google Marketing Platform

This website may use the online marketing tools of the Google Marketing Platform (Google LLC). These tools use cookies to display advertisements that are relevant to users, to improve campaign performance reporting, or to prevent a user from seeing the same advertisements repeatedly. Processing is carried out on the basis of our legitimate interest in the optimal marketing of our website in accordance with Article 6(1)(f) UK GDPR. According to Google, these cookies do not contain any personal information.

10.2 — Google Ads conversion tracking

This website may use the Google Ads online advertising programme and its conversion tracking. We use Google Ads to draw attention to our offers on external websites. The conversion tracking cookie is set when a user clicks on a Google Ads advertisement. These cookies generally expire after 30 days and are not used for personal identification. Processing is carried out on the basis of our legitimate interest in accordance with Article 6(1)(f) UK GDPR.

11. WEB ANALYTICS SERVICES

Google (Universal) Analytics

This website uses Google Analytics, a web analytics service provided by Google LLC. Google Analytics uses cookies that enable an analysis of your use of the website. This website uses Google Analytics exclusively with the "_anonymizeIp()" extension, which ensures the anonymisation of the IP address by truncation and excludes any direct personal reference.

Google will use this information on our behalf to evaluate your use of the website, compile reports on website activity and provide other services relating to website and internet use. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

This website also uses Google Analytics for cross-device analysis of visitor flows, carried out using a User ID. A unique, permanent and anonymised identifier is assigned on the first page visit and is set across all devices. The User ID does not contain any personal data and does not transmit such data to Google. You can object at any time to the collection and storage of data via the User ID, with effect for the future.

12. RETARGETING / REMARKETING / RECOMMENDATION ADVERTISING

Facebook Custom Audience (Pixel)

This website uses the "Facebook Pixel" from Meta Platforms, Inc. If express consent is given, user behaviour may be tracked after the user has viewed or clicked on a Facebook advertisement. This procedure serves to evaluate the effectiveness of Facebook advertisements for statistical and market research purposes. The data collected is anonymous to us. However, the data is stored and processed by Meta. Processing only takes place after express consent in accordance with Article 6(1)(a) UK GDPR. Consent to the use of the Facebook Pixel can only be given by users over the age of 13.

Google Ads Remarketing

Our website uses the remarketing functions of Google Ads. Google sets a cookie in the browser of your device, which automatically enables interest-based advertising using a pseudonymous cookie ID based on the pages you have visited. Processing is carried out on the basis of our legitimate interest in accordance with Article 6(1)(f) UK GDPR. Further processing of the data only takes place if you have agreed that Google may link your internet and app browsing history to your Google account.

13. DATA SUBJECT RIGHTS

13.1 Applicable data protection law grants you extensive rights as a data subject (rights of access and intervention) in relation to the controller with regard to the processing of your personal data:

• Right of access (Article 15 UK GDPR): The right to obtain information about your personal data processed by us, the purposes of processing, the categories, the recipients, the envisaged storage period, and more.
• Right to rectification (Article 16 UK GDPR): The right to have inaccurate data corrected without delay and/or incomplete data that we store completed.
• Right to erasure (Article 17 UK GDPR): The right to request the deletion of your personal data where the conditions of Article 17(1) UK GDPR are met.
• Right to restriction of processing (Article 18 UK GDPR): The right to request the restriction of the processing of your personal data.
• Right to notification (Article 19 UK GDPR): The right to be informed of all recipients to whom personal data has been disclosed.
• Right to data portability (Article 20 UK GDPR): The right to receive your personal data in a structured, commonly used and machine-readable format.
• Right to withdraw consent (Article 7(3) UK GDPR): The right to withdraw consent at any time with effect for the future.
• Right to lodge a complaint (Article 77 UK GDPR): The right to lodge a complaint with a supervisory authority. In the United Kingdom, the supervisory authority is the Information Commissioner's Office (ICO), ico.org.uk.

13.2 — Right to object

Right to object: If we process your personal data on the basis of our overriding legitimate interest in the context of a balancing of interests, you have the right to object to this processing at any time with effect for the future, on grounds relating to your particular situation. If you exercise your right to object, we will stop processing the data concerned. However, further processing remains reserved if we can demonstrate compelling legitimate grounds that override your interests, fundamental rights and freedoms, or if the processing serves to establish, exercise or defend legal claims.

Direct marketing: If your personal data is processed by us for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing. If you exercise your right to object, we will stop processing the data concerned for direct marketing purposes.

14. RETENTION PERIOD FOR PERSONAL DATA

The retention period for personal data is based on the relevant statutory retention period (for example commercial and tax retention periods). Once the period has expired, the corresponding data is routinely deleted, provided it is no longer required for the performance or initiation of a contract and/or we no longer have a legitimate interest in its continued storage.

---

Contact for data protection enquiries: info@london-crafts.co.uk