Privacy

This Privacy Policy explains how Caitlin’s Little Studio (“we”, “us”, “our”) collects, uses, shares and protects your personal data when you visit our website, create an account, place an order, subscribe to our newsletter or contact us. It also sets out your privacy rights and how the law protects you.

We run an online shop at caitlinslittlestudio.co.uk. Payments are handled by Mollie, our payment processor, our newsletter is sent through MailerLite, and we use Google Analytics to understand how the site is used. Each is explained in more detail below.

By using our website you acknowledge this Policy. We may update it from time to time and will post the revised version on this page. If we make significant changes we will take reasonable steps to let you know.

Who this Policy applies to and what it covers

This Policy applies to visitors to our website, registered account holders, customers who place orders and anyone who subscribes to our newsletter. It covers personal data we collect online through our website and related services, including account management, order processing, customer support, marketing emails, analytics and the use of cookies and similar technologies.

Personal data we collect

Depending on how you interact with us, we collect and process the following:

• Account data: username, password (stored in encrypted form), preferences and settings.
• Contact details: name, billing and delivery addresses, email address and telephone number.
• Order and delivery details: items ordered, order history, delivery instructions, tracking information, and any gift wrap choices or handwritten note wording you give us. If your note names another person, we only use their name to write the note.
• Payment-related data: payment method, transaction identifiers and the limited information needed to link your order to a payment. Your card details are entered directly with Mollie and are never stored by us.
• Newsletter data: email address, name if you give it, subscription status, preferences and engagement statistics (for example opens and clicks) provided by MailerLite.
• Device and usage data: IP address, device identifiers, browser type, operating system, pages viewed, time and date of visits, referring URLs and how you interact with website features.
• Cookies and analytics data: information collected via cookies and similar technologies, including Google Analytics, used to remember your preferences and to measure and improve site performance.

We collect personal data directly from you (when you create an account, place an order or contact us), automatically from your device and cookies when you use the website, and from the service providers who help us run the shop (Mollie, MailerLite, Google Analytics and our hosting provider).

Why we use your data and our lawful bases

We process personal data for the following purposes under the following lawful bases:

• Account creation and management: to register you, log you in, maintain your account and provide account features. Lawful basis: performance of a contract with you, and our legitimate interest in running our website.
• Order fulfilment: to process and deliver your orders, send order updates, handle returns and refunds and manage payments. Lawful basis: performance of a contract with you, and our legitimate interest in providing good customer service.
• Review invitations. After your order is completed we send one email inviting you to review what you bought. This runs on our own website; your details are not shared with any outside reviews service. We use your name, email address and order details to send it, on the basis of our legitimate interest in gathering honest feedback. If you leave a review, the name you give, your words and any photos you add are published on the site. We check reviews before they appear, but we do not change them.
  
• Customer support: to answer your enquiries and resolve issues. Lawful basis: performance of a contract with you, and our legitimate interest in supporting our customers.
• Newsletter and marketing: to send you our newsletter and occasional marketing emails, and to measure how they perform. Lawful basis: your consent. You can withdraw consent or unsubscribe at any time.
• Website analytics: to understand how visitors use our website so we can improve it. Lawful basis: your consent, given through our cookie banner.
• Fraud prevention and security: to detect and prevent fraud, abuse and security incidents, and to keep our systems secure. Lawful basis: our legitimate interests and, where applicable, legal obligations.
• Legal compliance: to comply with tax, accounting and other legal requirements, and to establish, exercise or defend legal claims. Lawful basis: compliance with legal obligations and our legitimate interests.

Where we rely on legitimate interests, we balance those interests against your rights and freedoms. Where we rely on consent, you can withdraw it at any time without affecting processing that took place before you withdrew.

How payments are processed

Payments on our website are processed by Mollie B.V., a payment services provider based in Amsterdam, the Netherlands. When you pay, you enter your card or payment details directly with Mollie. We never receive or store your full card number, card security code (CVV) or PIN.

Mollie sends us the limited information needed to confirm payment and match it to your order: a payment reference, the payment method used, the last four digits of your card where relevant, the amount, date and time, and the payment status. We share with Mollie the information it needs to take payment, prevent fraud and meet its own legal obligations, such as your name, billing and delivery address, email address, phone number, order details, IP address and device information.

Mollie acts as an independent controller for your payment details and is regulated as a payment institution. You can read Mollie’s own privacy statement on its website at mollie.com.

How our newsletter is sent

Our newsletter is sent using MailerLite, an email marketing service based in the European Union. We only add you to our list if you ask to join, for example by signing up on our website or ticking the newsletter box at checkout.

When you subscribe we share your email address and, where you have given it, your name and preferences with MailerLite so that it can send our emails on our behalf. MailerLite also records limited engagement data (opens, clicks and unsubscribes) so we can see what our readers find useful. MailerLite processes this data on our instructions as our data processor.

You can unsubscribe at any time using the link at the bottom of any newsletter, or by contacting us. Once you unsubscribe, MailerLite keeps only the minimum record needed to make sure we do not email you again. You can read MailerLite’s privacy policy on its website at mailerlite.com.

How we measure website use

We use Google Analytics, provided by Google LLC, to understand how visitors use our website, for example which pages are popular and how people find us. It collects information such as your IP address, device type, browser, pages viewed and how long you stay. We have turned on IP anonymisation and do not use Google’s advertising features.

Google Analytics only runs if you accept analytics cookies in our cookie banner, and you can change your choice at any time. You can also block Google Analytics in any browser using Google’s opt-out add-on. Google processes this data in the United States (see International data transfers below). You can read Google’s privacy policy at policies.google.com/privacy.

Other sharing and disclosures

We share personal data with trusted third parties only where needed for the purposes above, including:

• Service providers acting on our instructions, such as our website hosting and maintenance providers and email delivery service.
• Postal and courier services (for example Royal Mail and Evri) to deliver and track your orders.
• Mollie, MailerLite and Google Analytics, as described above.
• Professional advisers such as our accountant, and insurers, where needed to run the business.
• Regulators, courts and law enforcement where the law requires it or where necessary to establish, exercise or defend legal claims.
• A buyer or successor if the business is ever sold or restructured, subject to appropriate safeguards.

We require every service provider to protect your data, use it only on our instructions and apply appropriate security measures. We do not sell your personal data.

International data transfers

Mollie and MailerLite are both based in the European Union. The UK recognises the EU as providing an adequate level of data protection, so your data can lawfully be processed there. Google processes analytics data in the United States under the UK–US data bridge, which the UK government has approved. Where any other provider moves data outside the UK or the European Economic Area, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or Addendum. Contact us if you would like more information about these safeguards.

How long we keep your data

We keep personal data only for as long as we need it for the purposes in this Policy, including to meet our tax, accounting and legal obligations. Our retention periods are:

• Order and invoice records: seven years from the end of the financial year in which you placed the order. HMRC requires us to keep records of sales for tax purposes, so we cannot delete these earlier even if you ask us to. If you ask us to erase your data, we remove your name, address and contact details from these records and keep only what the tax rules require: the order number, date, items and amounts.
• Unpaid, failed or cancelled orders: deleted after 30 days.
• Account data: kept for as long as your account is open. If you have not used your account for three years we will delete it. You can ask us to close your account at any time.
• Customer support messages: up to three years after your query is resolved, or longer if needed for legal reasons.
• Newsletter data: until you unsubscribe. After that, MailerLite keeps only the minimum needed to honour your opt-out.
• Device, usage and analytics data: up to 24 months, unless a shorter or longer period is needed for security, fraud prevention or legal reasons.
• Cookies: according to each cookie’s lifespan, as set out in the Cookies section below and your cookie preferences.

We may keep data for longer where needed to establish, exercise or defend legal claims or to comply with a legal obligation.

Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. These include access controls, encryption of data in transit, secure hosting and regular monitoring. No system can be completely secure, but we work to reduce risks to a level proportionate to the data we hold.

Your rights

Subject to legal limits, you have the following rights over your personal data:

• Access: to get a copy of your personal data and information about how we use it.
• Rectification: to correct inaccurate or incomplete data. You can update most details yourself in your account.
• Erasure: to ask us to delete your personal data where there is no good reason for us to keep it. We will remove everything we can, but we must keep the order and invoice records described above for tax purposes.
• Restriction: to ask us to limit how we use your data in certain circumstances.
• Objection: to object to processing based on our legitimate interests, and to object at any time to direct marketing.
• Portability: to receive the data you gave us in a structured, machine-readable format.

Where we rely on consent, you can withdraw it at any time. You can manage newsletter preferences using the unsubscribe link in any email, and manage cookies through our cookie banner and your browser settings.

To exercise any of these rights, contact us using the details below. We may need to confirm your identity first, and we will respond within one month. If we cannot fully meet your request, for example because tax law requires us to keep certain records, we will explain why.

You also have the right to complain to the UK Information Commissioner’s Office (ICO). We would appreciate the chance to sort out any concern first, so please contact us before you approach the ICO.

Children’s privacy

Our website is not aimed at children and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, please contact us so we can remove it.

Cookies and similar technologies

We use cookies and similar technologies to run our website, remember your preferences, keep your shopping bag together, analyse how the site is used and improve our services. Cookies are small files placed on your device. Some are essential for the website and checkout to work, such as the cookie that keeps your shopping bag together. Others are optional: Google Analytics cookies (which measure how the site is used) are only set if you accept them in our cookie banner.

You can manage your cookie preferences through our cookie banner and your browser settings, including blocking or deleting cookies. If you disable certain cookies, parts of the website (such as the shopping bag and checkout) may not work properly. Where required, we ask for your consent before setting non-essential cookies.

Contact us

If you have questions about this Policy or how we handle your personal data, or you want to exercise your rights, contact us at:

Caitlin’s Little Studio

Email: hello@caitlinslittlestudio.co.uk

Postal address: Imprint House, 14 Museum Place, Cardiff

You can contact the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Updates to this Policy

We may update this Policy from time to time. Any changes will be posted on this page with a new effective date.

Effective date: 31 August 2026