This privacy policy explains how Anastasia Young, a sole trader business registered in the UK, collects, uses, stores, and protects your personal data when you visit our website and purchase our products or services. We are committed to protecting your privacy and ensuring you have a positive experience on our website.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy sets out the basis on which we process any personal data we collect from you or that you provide to us.

Please read this policy carefully. If you have any questions about how we process your data, please contact us using the details in Section 9 below.

Data Controller Information:

• Business Name: Anastasia Young Jewellery

• Business Type: Sole Trader

• Email: mail-at-anastasiayoung-dot co dot uk

We are the data controller responsible for your personal data. This means we decide how and why your data is processed.

We may collect and process the following types of personal data from you:

3.1 Information You Provide Directly

• Purchase information: Name, email address, postal address, phone number, payment card details (processed securely by third parties)

• Account information: If you create an account on our website, we collect login credentials and profile information

• Communication data: Any messages, emails, or enquiries you send us, including feedback and customer service communications

• Marketing preferences: Your consent to receive promotional emails, newsletters, or other marketing communications

3.2 Information Collected Automatically

• Technical data: IP address, browser type, operating system, pages visited, time spent on pages

• Cookie data: Information collected through cookies and similar tracking technologies (see Section 7 for details)

• Usage analytics: How you interact with our website, products viewed, and searches performed

• Device information: Device type, screen resolution, and device identifiers

3.3 Payment Information

We do not directly collect or store full credit or debit card details. Payment processing is handled by Squarespace payments or PayPal. Their privacy policies apply to payment data.

Under UK GDPR, we only process your personal data where we have a lawful basis to do so. We process your data for the following purposes:

• Processing orders and delivering products — We process your data to perform our contract with you (fulfilling your order).

• Sending order confirmations and delivery updates — We send you order and delivery information as part of our contractual obligations to you.

• Collecting payment — We process payment information to perform our contract with you.

• Improving our website and services — We use data such as browsing behaviour and feedback to enhance our website and customer experience. This is based on our legitimate interest in providing a better service.

• Marketing and promotional communications — We only send marketing emails, newsletters, and promotional offers where you have explicitly consented. You can withdraw this consent at any time by clicking "unsubscribe" in any email or contacting us directly.

• Complying with legal obligations — We process data for tax, accounting, and regulatory compliance as required by law.

• Fraud prevention and security — We process data to detect and prevent fraudulent transactions and protect our website and systems. This is based on our legitimate interest in protecting our business and customers.

• Customer service and support — We process data to respond to your queries and provide support, either as part of our contract with you or based on our legitimate interest in providing good customer service.

For marketing communications, we will only send these where you have explicitly consented. You can withdraw this consent at any time.

We use your personal data for the following purposes:

5.1 Essential Business Operations

• Processing and fulfilling your orders

• Sending order confirmations, invoices, and delivery notifications

• Managing customer service enquiries and complaints

• Collecting payment for products and services

5.2 Legal and Compliance Obligations

• Maintaining accounting and financial records for tax purposes

• Complying with legal requirements (e.g., Consumer Rights Act 2015)

• Fraud prevention and detection

• Protecting against legal liability

5.3 Website Improvement and Analytics

• Analysing how you use our website to improve functionality and user experience

• Identifying technical issues and optimising site performance

• Understanding customer behaviour and preferences (in anonymised form where possible)

5.4 Marketing (With Your Consent)

• Sending newsletters, product updates, and promotional offers

• Personalising marketing content based on your interests

• Inviting you to participate in surveys or reviews

5.5 Safety and Security

• Protecting our website and business from fraud, abuse, and cyber attacks

• Enforcing our terms and conditions

• Protecting your rights and the rights of other customers

We do not sell or trade your personal data. We may share your data with the following third parties only where necessary:

6.1 Essential Service Providers

• Payment processors: [Payment provider name] — to process your payments

• Delivery/logistics partners: Royal Mail, DPD, or other couriers — to deliver your orders

• Hosting provider: [Web hosting company name] — to operate our website

• Email service provider: [If used] — to send newsletters and marketing communications

6.2 Legal and Regulatory Bodies

• Tax authorities (HMRC) — for tax compliance

• Law enforcement — where required by law or to protect rights

• Courts — if legally required

6.3 Business Transfers

If our business is sold, merged, or restructured, your data may be transferred as part of that transaction. We will notify you of any such change.

6.4 Data Sharing Restrictions

We do not share your data with third parties for their own marketing purposes without your explicit consent. All third parties are required to protect your data according to UK GDPR.

7.1 What Are Cookies?

Cookies are small text files stored on your device that help us remember your preferences and improve your website experience.

7.2 Types of Cookies We Use

We use the following types of cookies on our website:

• Essential/Functional Cookies — These enable basic site functionality such as your shopping cart, login credentials, and payment processing. These cookies are necessary to perform our contract with you and allow you to use our website. You cannot opt out of these cookies.

• Analytics Cookies — We use analytics tools such as Google Analytics to understand how you use our website, including which pages you visit, how long you spend on each page, and how you navigate between pages. We use this information to improve our website and user experience. This is based on our legitimate interests in understanding user behaviour and optimising our services. We will obtain your consent before deploying these cookies.

• Marketing and Advertising Cookies — We use cookies to track conversions (purchases made after clicking an ad) and to personalise advertisements across different platforms and websites. These cookies help us show you more relevant ads based on your browsing history. We only deploy these cookies where you have explicitly consented.

• Third-party Cookies — Our payment processors and social media platforms may set their own cookies on your device. These are governed by their own privacy policies and terms of service. We only permit third parties to set cookies where required for contract performance or where you have consented.
  

  7.3 Your Cookie Choices

• We use a cookie consent banner on our first visit to obtain your consent for non-essential cookies

• You can manage cookies through your browser settings (consult your browser's help section)

• You can opt out of Google Analytics here

• Withdrawing consent does not affect the lawfulness of processing before withdrawal

7.4 Third-Party Cookies

• Google Analytics: Collects anonymous usage data. See Google's privacy policy

• Facebook Pixel / Social Media: If used, allows us to retarget ads. See respective platform privacy policies

• Payment processors: May use cookies for security purposes

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or where required by law. Our retention periods are as follows:

• Order Data (name, address, email) — We retain this for 6 years to comply with the Limitation Act 1980 and for tax and accounting purposes as required by HMRC.

• Payment Information — We do not store payment card details on our servers. Payment information is retained by our payment processor in accordance with their own privacy policy and PCI-DSS compliance requirements.

• Customer Service Communications — We retain emails, support tickets, and correspondence for 2 years to handle complaints, disputes, and queries.

• Marketing Consent Records — We retain records of your marketing preferences for as long as you remain subscribed. Once you withdraw consent, we delete these records in accordance with your request.

• Website Analytics Data — We retain analytics data for 26 months (Google Analytics default retention period) for performance analysis and understanding user behaviour. After this period, data is automatically deleted.

• Log Files and IP Data — We retain server logs and IP addresses for 12 months for security purposes, fraud prevention, and investigating any suspicious activity. After this period, logs are deleted.

Once the retention period has expired, we securely delete your data or anonymise it so it cannot be linked back to you.

Under UK GDPR, you have the following rights regarding your personal data:

9.1 Right of Access

You have the right to request a copy of the personal data we hold about you. We will respond within 30 calendar days.

How to request: Email [mail-at-anastasiayoung dot co dot uk] with "Subject: Data Access Request" and provide proof of identity.

9.2 Right to Rectification

You can request that we correct any inaccurate or incomplete personal data. We will correct this within 30 days where possible.

9.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data in certain circumstances, including:

• Your data is no longer needed for the purpose we collected it

• You withdraw consent on which processing relied

• You object to processing on grounds of legitimate interests

Exception: We may retain data if required by law (e.g., tax records for 6 years).

9.4 Right to Restrict Processing

You can request that we limit how we use your data while we verify a dispute or handle your request.

9.5 Right to Data Portability

You can request your personal data in a structured, portable format (e.g., CSV) to transfer to another organisation.

9.6 Right to Object

You can object to:

• Processing based on legitimate interests

• Direct marketing and promotional communications

• Automated decision-making

9.7 Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects without your consent.

9.8 How to Exercise Your Rights

To exercise any of the above rights, please contact us:

• Email: [mail-at-anastasiayoung dot co dot uk]

Please include "Data Subject Request" in your email subject line and provide proof of identity (e.g., copy of ID or recent utility bill).

We take the security of your personal data very seriously and implement appropriate technical and organisational measures to protect it:

10.1 Security Measures

• SSL/TLS encryption: Our website uses HTTPS encryption to protect data in transit

• Secure payment processing: Payment data is processed by PCI-DSS compliant third parties

• Access controls: Only authorised staff can access personal data

• Password protection: Admin accounts are password-protected and regularly updated

• Regular backups: We maintain secure backups of our data

• Firewall and malware protection: Our website is protected against cyber attacks

10.2 Data Breach Notification

If we experience a data breach that poses a risk to you, we will:

• Notify the Information Commissioner's Office (ICO) within 72 hours

• Contact you directly if the breach is likely to result in high risk to your rights and freedoms

• Provide information about the breach and steps you can take

10.3 Limitations

While we implement strong security measures, no internet transmission is completely secure. We cannot guarantee absolute security, but we do our best to protect your data.

11.1 Data Location

Your personal data is primarily processed and stored in the United Kingdom. We do not routinely transfer data outside the UK.

11.2 Third-Party Service Providers

Some third-party service providers (payment processors, hosting providers, email services) may process data outside the UK, including in the United States. Where data is transferred outside the UK:

• We only use providers with appropriate safeguards (e.g., Standard Contractual Clauses, UK adequacy decisions)

• We ensure transfers comply with UK GDPR Article 44-49

• You can request details of safeguards by contacting us

Our website is not intended for children under 18 years old. We do not knowingly collect personal data from children. If we become aware that we have collected data from someone under 18, we will delete it immediately.

If you are under 18 and have provided data, or a parent/guardian is aware we hold such data, please contact us immediately.

We may update this privacy policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. We will:

• Post the updated policy on this page

• Update the "Last Updated" date at the bottom

• Notify you by email of material changes

Your continued use of our website after changes constitutes your acceptance of the updated policy. We recommend reviewing this policy regularly.

14.1 Questions About This Policy

If you have any questions, concerns, or requests regarding this privacy policy or how we handle your personal data, please contact us:

Data Controller: Anastasia Young
Email: mail-at-anastasiayoung-dot-co-dot-uk

Response Time: We aim to respond within 10 business days

Alternatively:
Email: privacy@squarespace.com

14.2 Complaints to the Regulator

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

ICO Contact Details:
Website: www.ico.org.uk
Email: casework@ico.org.uk
Phone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

• Data Controller: The organisation (you/your business) that decides how and why personal data is processed

• Data Subject: The individual whose personal data is being processed

• Personal Data: Any information relating to an identified or identifiable natural person

• Processing: Any operation performed on data (collecting, storing, using, deleting, etc.)

• Lawful Basis: The legal reason for processing personal data under UK GDPR

• Consent: Clear, freely given permission to process data for a specific purpose

• Legitimate Interests: Processing that is necessary for your business interests, balanced against individuals' rights