Privacy Policy

1. Data Controller

SpinAndSnag Tea Ltd ("we", "us", "our") is the data controller responsible for your personal data. We are a company registered in Scotland (Registration No. SC782491) with our registered address at: 47 Primrose Lane, Shoreditch, London, E1 6BT, United Kingdom.

2. What Data We Collect

We may collect and process the following categories of personal data:

• Identity data: name, title, date of birth (where relevant).
• Contact data: billing and delivery address, email address, telephone number.
• Transaction data: details of orders, payments, and purchases you make through our website.
• Technical data: IP address, browser type and version, time zone, device information, and how you use our website.
• Usage data: information about how you interact with our site, including pages visited and time spent.
• Marketing and communications data: your preferences for receiving marketing from us and your communication preferences.

3. Legal Basis for Processing

Under UK GDPR, we process your personal data only where we have a lawful basis. This includes:

• Contract: to perform our contract with you (e.g. processing orders, delivering products, providing customer support).
• Legitimate interests: to operate our business, improve our services, prevent fraud, and ensure security (where these interests are not overridden by your rights).
• Legal obligation: to comply with applicable laws (e.g. tax, consumer protection).
• Consent: where you have given clear consent for specific processing (e.g. marketing emails).

4. How We Use Your Data

We use your personal data to:

• Process and fulfil your orders and deliver products to you.
• Manage your account and provide customer support.
• Send order confirmations, shipping updates, and service-related communications.
• Respond to enquiries sent via our contact form or email.
• Improve our website, products, and services.
• Detect and prevent fraud and ensure the security of our systems.
• Comply with legal and regulatory obligations.
• Send marketing communications where you have opted in.

5. Cookies

Our website uses cookies and similar technologies. Cookies are small text files stored on your device that help us provide a better experience. We use:

• Essential cookies: required for the website to function (e.g. session, cart).
• Analytics cookies: to understand how visitors use our site and improve it.
• Preference cookies: to remember your settings (e.g. cookie consent).

You can manage your cookie preferences via our cookie banner. For more detail, see our Cookie Policy or contact us.

6. Third-Party Sharing

We may share your data with trusted third parties only where necessary, including:

• Payment processors: to process card payments securely.
• Delivery partners: to fulfil and deliver your orders.
• Service providers: hosting, analytics, email delivery, and support tools (under data processing agreements).
• Legal and regulatory bodies: when required by law.

We do not sell your personal data. All third parties are required to protect your data in line with applicable data protection law.

7. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this policy, or as required by law. Typically:

• Order and transaction data: up to 7 years for legal and accounting purposes.
• Customer account data: for the duration of your account plus a reasonable period after closure.
• Marketing data: until you withdraw consent or unsubscribe.
• Technical and usage data: as needed for analytics and security, usually up to 2 years.

8. Your Rights Under UK GDPR

Under UK data protection law, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of your data in certain circumstances.
• Restriction: request that we limit how we use your data in certain situations.
• Portability: receive your data in a structured, machine-readable format.
• Object: object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us using the details below. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Children's Privacy

Our website and services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will take steps to delete it promptly.

10. International Transfers

Your data is primarily processed within the United Kingdom. Where we use service providers outside the UK, we ensure appropriate safeguards are in place (e.g. UK adequacy decisions, Standard Contractual Clauses, or equivalent mechanisms) to protect your data in accordance with UK GDPR.

11. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The "Last updated" date at the top of this page indicates when it was last revised. We encourage you to review this policy periodically. Material changes will be communicated where appropriate.

12. Contact for Data Enquiries

For any questions about this Privacy Policy, your personal data, or to exercise your rights, please contact our Data Protection contact:

Email: [email protected]
Post: SpinAndSnag Tea Ltd, 47 Primrose Lane, Shoreditch, London, E1 6BT, United Kingdom

We aim to respond to data enquiries within 30 days.