Privacy Notice

1. Who is responsible for your information?

The business operating DESIRELICIOUS is the data controller for customer information collected by this shop. For privacy questions, to exercise your rights, or to request the legal identity and postal contact details of the seller, use our Contact us page.

The full legal identity, geographical address and direct contact details of the contracting seller must also be shown clearly to customers before checkout. The brand name alone is not an adequate substitute for the legal identity of the controller.

2. Information we collect

Depending on how you use the shop, we process your name, contact details, billing and delivery addresses, account credentials (held as protected password hashes), shopping basket, purchases, invoices, customer enquiries, refund requests, delivery tracking details, and technical information such as IP address, browser information, security events and cookie choices.

Our payment provider, Stripe, processes payment card information as part of secure payment processing. We receive payment status, transaction identifiers and related limited payment details needed to manage orders and refunds. We do not need your full card number or card security code to complete an order.

3. Why we use your data and our lawful bases

• Contracts (UK GDPR Article 6(1)(b)): create accounts when requested, take orders, accept payments, arrange delivery and handle customer service relevant to your purchase.
• Legal obligations (Article 6(1)(c)): maintain records required by tax, accounting and consumer-protection law and respond to valid legal requests.
• Legitimate interests (Article 6(1)(f)): protect the shop, investigate fraud, secure accounts, prevent abuse, resolve disputes and improve the reliability of our service. These interests are assessed against your privacy rights.
• Consent (Article 6(1)(a)): use non-essential tracking technologies and send consent-based marketing where applicable. You can withdraw consent without affecting the lawfulness of prior processing.

When information is necessary to place an order (for example, a delivery address), not providing it may mean we cannot fulfil the order. Optional marketing and non-essential tracking are not conditions of purchase.

4. Stripe payments, cookies and tracking

We use Stripe for payment processing and related fraud prevention. When you enter payment or checkout flows, Stripe-hosted pages or Stripe scripts may receive technical identifiers, browser and device information, IP address and payment-related information for security, fraud prevention and transaction processing. Stripe also handles personal information under its own privacy documentation: Stripe Privacy Policy.

We use essential technologies where needed for basket contents, login sessions, account protection and payment security. Non-essential analytics, advertising or behavioural-tracking cookies and scripts are not activated until the required consent is obtained. Where a Stripe component stores or accesses information on your device, we assess whether its specific use is strictly necessary for the payment or security service you requested; a blanket exemption is not assumed for all Stripe scripts. Any non-essential use requires prior consent.

You can reject optional cookies or change your choices through the cookie controls made available on the site. Browser controls can also limit cookies, although disabling essential cookies may stop checkout or sign-in from working.

5. Sharing with suppliers and service providers

We disclose only the information reasonably necessary to payment processors, hosting and IT providers, email and customer-support services, approved product suppliers, order-fulfilment partners and delivery couriers. Some products may be dispatched directly by approved suppliers. We do not authorise them to use order details for unrelated marketing on our behalf.

We may also disclose information to professional advisers, regulators, law enforcement or courts where permitted or required by law. We do not sell customer personal information.

6. International transfers

Stripe, couriers, suppliers or technology providers may process information outside the United Kingdom. Before making a restricted transfer, we must identify an applicable UK adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum, and carry out any required transfer risk assessment. You can ask us for details of applicable safeguards using our contact page. Countries and providers used for an individual order can vary with its destination and supplier.

7. How long information is kept

We keep personal information no longer than necessary for its purpose. Purchase and accounting records are retained for the period required by applicable tax and accounting law (often at least six years, depending on the record and business status). Account details are retained while needed to operate the account, subject to legal obligations; security logs, support records and abandoned baskets are reviewed against documented retention schedules and deleted or anonymised when no longer needed. A valid deletion request does not override mandatory recordkeeping obligations.

8. Security

We use access controls, encrypted connections, password protection, restricted administration privileges and proportionate measures to reduce unauthorised access, loss and misuse. No internet-based service can be guaranteed completely secure. If you suspect unauthorised account activity, contact us promptly.

9. Your rights

Subject to applicable conditions and exceptions, you can ask to access or correct your personal data, request its deletion, restrict its use, receive portable information or object to processing. You have the right to object at any time to direct marketing, including related profiling. Where processing relies on consent, you can withdraw it at any time. We will respond to rights requests within the legal deadlines, ordinarily within one month, unless a permitted extension applies.

Contact us using our contact form. You may also complain to the Information Commissioner's Office (ICO). We would welcome an opportunity to investigate your concern first, but you do not have to contact us before approaching the ICO.

10. Automated decisions, children and updates

Payment processors may apply automated fraud screening to transactions. If a decision with legal or similarly significant effects is made solely by automated means, we will provide the required information and safeguards. We do not knowingly market our shop to children or knowingly collect children's personal information for independent accounts without an appropriate legal basis.

We may revise this notice when our services or processing activities change. Material changes affecting your information will be communicated as required by law, and the review date above will be updated.