Privacy policy

This policy explains what personal information Pretty Pickled collects when you visit prettypickled.co.uk, buy from us or get in touch, what we do with it, and the control you have over it. No legal fog: if anything here is unclear, email us and we'll explain it properly.

1. Who we are

Pretty Pickled Ltd, a company registered in Scotland (company number SC692693), is the "controller" of your personal information. That means we decide how and why it is used, and we're responsible for looking after it.

• Address for correspondence: Office 7, 35-37 Ludgate Hill, London EC4M 7JN
• Email: hey@prettypickled.co.uk
• ICO registration number: ZC223793

We are registered with the Information Commissioner's Office (ICO), the UK's data protection regulator. You can complain to them about us at any time (see section 11).

This policy was last updated on 16 August 2026. It reflects UK data protection law as amended by the Data (Use and Access) Act 2025.

2. The information we collect

Information you give us

• Contact details: name, email address, phone number, delivery and billing addresses.
• Order details: what you bought, sizes, embroidery and colourway choices, gift messages, order history, delivery preferences.
• Payment details: handled by our payment providers. We receive confirmation that a payment succeeded and the last four digits and card type; we never see or store your full card number.
• Account details: if you create an account, your username, password (encrypted) and saved addresses.
• Messages: anything you send us by email, contact form, WhatsApp or social media, including size questions and returns requests.
• Marketing preferences: whether you've asked for our emails, and what you click on in them.
• Reviews, photos and tags: product reviews and any content you post publicly or send us for use on our website or social channels.
• Pop-up and event details: if you buy from us in person or enter a competition.

Information we collect automatically

• Device and usage data: IP address, browser and device type, operating system, the pages you view, what you add to your basket, how you found us and roughly where you are (city level).
• Cookies and similar technologies: see section 6.

Information from other people

• Shopify, who host our shop and provide our checkout and order tools.
• Payment providers (including Shopify Payments, PayPal and Apple/Google Pay), who confirm payments and flag suspected fraud.
• Couriers (Royal Mail and other delivery partners), who tell us the status of your delivery.
• Advertising and analytics providers (Meta, Google), who tell us how our ads performed, usually as aggregated figures.
• Social media platforms, if you contact us or tag us there, limited to what your privacy settings allow.

Special category data

We don't ask for and don't want sensitive information (things like health, religion, ethnicity or political views). Please don't send it to us in messages. If you do tell us something sensitive, for example a dietary preference that affects a design choice, we'll only use it to help with your enquiry.

3. Why we use your information, and our legal reasons for doing so

UK and EU data protection law requires us to have a valid legal basis for every use of your information. Ours are set out below.

What we use it for	Our legal basis
Taking, making and delivering your order, and keeping you updated about it	Performance of our contract with you
Taking payment and processing refunds	Performance of our contract; legal obligation (tax and accounting records)
Handling returns, exchanges, faults and your consumer rights	Performance of our contract; legal obligation
Answering your questions and providing customer support	Performance of our contract; our legitimate interest in running a helpful shop
Preventing and detecting fraud and chargebacks	Our legitimate interest (recognised in law) in preventing fraud; legal obligation
Keeping our website and systems secure	Our legitimate interest (recognised in law) in network and information security
Sending you marketing emails about new designs, restocks and offers	Your consent, or the "soft opt-in" where you've bought from us and haven't unsubscribed
Showing you Pretty Pickled ads on Meta (Instagram/Facebook) and Google, and measuring how they perform	Your consent (given through our cookie banner)
Inviting you to review a product you've bought, and publishing reviews	Our legitimate interest in honest feedback; your consent for anything you choose to publish
Understanding how our website is used so we can improve it	Our legitimate interest in improving the shop (see section 6 on cookies)
Keeping business, tax and VAT records	Legal obligation
Dealing with complaints, disputes and legal claims	Our legitimate interest in defending our business; legal obligation

Where we rely on legitimate interests, we've weighed our interest against your rights and privacy, and we only proceed where we're satisfied our use is fair and wouldn't surprise you. You can ask us for details of that assessment, and you can object at any time (see section 9).

4. Marketing, and how to stop it

We'll only email you marketing if you've signed up, or if you've bought from us and we're offering similar products (the "soft opt-in" allowed by the Privacy and Electronic Communications Regulations). Either way you can opt out whenever you like.

• Click unsubscribe at the bottom of any marketing email, or
• email hey@prettypickled.co.uk and ask us to stop.

Opting out is free and takes effect quickly. We'll keep a minimal record of your opt-out so that we don't email you again by mistake. You'll still receive essential messages about orders you've placed; those aren't marketing.

5. Reviews and things you post publicly

If you leave a review or post content on a public part of our site, it can be seen by anyone, and we may reshare it on our website, in emails and on social media. Please only include a name you're happy to be public. You can ask us to remove your review at any time.

6. Cookies and similar technologies

Cookies are small files stored on your device. We use them to run the shop, remember your basket, understand how the site is used and, if you agree, to show you our ads.

Type	What it does	Consent needed?
Strictly necessary (Shopify cart, checkout, security, fraud prevention, load balancing)	Without these the shop simply doesn't work: you couldn't add to basket or check out.	No, exempt by law
Statistical / analytics (Shopify analytics and our website statistics provider)	Counts visits and shows us which pages and products people look at, so we can improve the site. Used only for statistics, never for advertising or building a profile of you.	No. This falls within the statistical-purposes exception introduced by the Data (Use and Access) Act 2025, but you can still opt out via our cookie banner
Preferences	Remembers choices such as your region and how the site is displayed.	No, exempt where used only for appearance, but you can opt out
Advertising and measurement (Meta pixel, Google Analytics and Google Ads)	Lets us show Pretty Pickled ads to people who've visited us and measure whether ads led to sales. These providers may use the data for their own purposes.	Yes. These are only set if you accept them in our cookie banner

You can change your mind at any time using the cookie settings link on our website, and you can block or delete cookies in your browser settings, though blocking necessary cookies will break the checkout. We don't use analytics data to build advertising profiles: if we ever combine analytics with advertising, we'll ask for your consent first.

7. Who we share your information with

We never sell your personal information, and we don't share it with third parties for their own marketing. We do share it with the suppliers who help us run the shop, each of whom is only allowed to use it on our instructions.

Who	What for
Shopify	Hosting our shop, checkout, order management and store analytics
Payment providers (Shopify Payments, PayPal, Apple Pay, Google Pay and any buy-now-pay-later provider shown at checkout)	Taking payment, refunds and fraud screening
Our embroidery and fulfilment partner	Making and packing your order
Delivery partners (Royal Mail and other couriers)	Delivering your order and handling tracking and lost parcels
Klaviyo	Sending our emails and managing our mailing list
REVIEWS.io	Collecting and displaying product reviews
Meta and Google	Advertising and measurement, where you've consented
Our website statistics provider	Counting visits and page views
Our accountant and professional advisers	Accounts, tax and legal advice
Apps installed on our Shopify store	Specific features such as size guides, wishlists and customer support

We may also disclose information where the law requires it (for example to HMRC, the police or a court), to protect our rights, or if the business is ever sold or transferred, in which case your information would pass to the buyer under this policy.

8. Sending information outside the UK

Some of our suppliers are based outside the UK, mostly in the EEA, the United States and Canada. When your information leaves the UK we make sure it stays protected by relying on one of the following:

• UK adequacy regulations: the UK government has decided the country offers equivalent protection (this covers the EEA and, for commercial organisations, Canada).
• The UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
• The UK Extension to the EU–US Data Privacy Framework, where a US supplier is certified under it.

Transfers between the UK and the EEA continue to flow freely under the European Commission's UK adequacy decisions, renewed in December 2025. You can ask us for a copy of the safeguards we use for any specific supplier.

9. How long we keep your information

What	How long
Order, payment and invoice records	7 years from the end of the relevant tax year (HMRC requirement)
Customer account details	Until you ask us to close the account, or after 5 years of inactivity
Marketing list details	Until you unsubscribe, or after 3 years with no engagement, whichever is sooner
Unsubscribe / suppression records	Kept indefinitely, so we don't accidentally email you again
Customer service messages	2 years from the end of the conversation
Product reviews	For as long as the review is published, or until you ask us to remove it
Website analytics data	Up to 26 months, then deleted or aggregated
Complaints and disputes	6 years from resolution (the limitation period for legal claims)

When we no longer need your information we delete it or anonymise it so it can no longer identify you.

10. Your rights

You have the right to:

• Be told how we use your information: that's what this policy is for.
• Get a copy of the personal information we hold about you.
• Have it corrected if it's wrong or incomplete.
• Have it deleted, where we don't have a good reason to keep it.
• Restrict how we use it while a query is sorted out.
• Object to us using it for our legitimate interests. You have an absolute right to object to direct marketing: say the word and we stop.
• Portability: receive information you gave us in a machine-readable format, or have it sent to someone else.
• Withdraw consent at any time, where we relied on it. This doesn't affect anything done before you withdrew it.
• Complain: to us, and to the regulator (see section 11).

To use any of these, email hey@prettypickled.co.uk. It's free. We'll reply within one month, and we'll tell you if we need longer because the request is complex (we can extend by up to two further months). We may ask you to confirm your identity first, so we don't hand your details to the wrong person.

11. Complaints

If you're unhappy with how we've handled your personal information, please tell us first; we'd like the chance to put it right. Email hey@prettypickled.co.uk with "Data protection complaint" in the subject line, or write to us at the address in section 1. You can complain in any way that suits you; you don't have to use a form.

We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.

You can also complain to the Information Commissioner's Office at any time:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

12. Keeping your information safe

Our shop runs on Shopify, which is PCI DSS compliant, and the whole site is encrypted (HTTPS). Access to customer data is limited to the people who need it, protected by strong passwords and two-factor authentication. No system is perfectly secure, but if a breach happens that puts your rights at risk, we'll tell the ICO within 72 hours and tell you without undue delay where the law requires it.

13. Children

Our shop isn't aimed at children, and we don't knowingly collect information from anyone under 16 without a parent or guardian's involvement. If you believe a child has given us their details, email us and we'll delete them.

14. Automated decisions and profiling

Our payment providers run automated fraud checks on orders, which can result in an order being declined or held for review. We also group customers loosely (for example "bought a bucket hat") to make our emails more relevant. We don't make decisions that produce legal or similarly significant effects about you by automated means alone. If an order is declined and you think it's wrong, email us and a human will look at it.

15. If you're in the EU or EEA

We sell worldwide, and where we offer goods to people in the EU or EEA, the EU GDPR applies alongside UK law. The rights described in section 10 apply equally, and you can also complain to the supervisory authority in the country where you live, work, or where the issue happened. You can also contact us directly using the details in section 1.

16. Other websites

Our site links to other websites and social platforms. We're not responsible for their privacy practices, so have a look at their policies before sharing anything with them.

17. Changes to this policy

We'll update this policy when our practices or the law change. The "last updated" date at the top always tells you which version you're reading, and if the change is significant we'll flag it on the site or by email. Please check back now and again.

Thanks for reading the boring bits. Stay pretty pickled.