0
Draft policy, being finalised. Not legal advice. Items in [square brackets] are still TBC. Your statutory rights as a UK consumer always apply. Last updated: 11 October 2026.

Privacy Policy

How ShopHaul collects and uses your personal data under the UK GDPR and the Data Protection Act 2018.

Who is the data controller

ShopHaul, Unit 25, Enterprise Way, London NW10 6UG, email: [email protected] ([Legal entity / trader name, company number and VAT number still TBC]). [ICO registration number placeholder, if required.]

What we collect

  • Order data: name, delivery address, email, phone (if given), items bought.
  • Payment data: handled by Stripe, our payment processor. We don't see or store your full card details.
  • Marketing: your email (and first name if you give it) if you opt in to our emails.
  • Customer service: messages you send us.
  • "Where did you hear about us?": an optional question at checkout (TikTok, Instagram, YouTube, Email, Friend, Other, or the default "Prefer not to say"). We store your answer with your order and use it for marketing analysis, to see which channels work. Answering is entirely optional.
  • Technical data: essential storage needed to run the site (for example your cart). Optional analytics only if you accept them; see our Cookie Policy.
  • Campaign source (UTM) data, optional: if you arrive from a link tagged with campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and you accept optional cookies, we keep them in first-party session storage for your visit and attach them to your order, so we know which of our own posts or emails led to the sale. If you don't accept, they aren't stored. They're cleared when you close the tab, aren't shared with third-party analytics or ad networks, and aren't used to profile you.

Why we use it (lawful basis)

  • To process and deliver your order: contract.
  • To keep tax and accounting records: legal obligation.
  • To prevent fraud, improve the site and analyse your optional "Where did you hear about us?" answer: legitimate interests.
  • Marketing emails: consent (or, for existing customers, the soft opt-in under PECR, always with an easy unsubscribe).
  • Optional analytics, including campaign source (UTM) data: consent, which you can withdraw at any time via cookie settings.

Who we share it with

Only service providers who help us run the shop, under contracts that protect your data:

  • Stripe: payment processing.
  • Brevo: our email processor, for order emails and (if you opt in) marketing emails.
  • Cloudflare: website hosting and security.
  • [Fulfilment partner, e.g. CJ Dropshipping] and delivery couriers: name, address and order details only, to send your order.

Some providers may process data outside the UK; where they do, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Addendum. [List of transfers to be confirmed.]

How long we keep it

Order records: [6 years, for tax purposes, placeholder]. Marketing data: until you unsubscribe. Customer service messages: [placeholder period].

Your rights

You can ask to access, correct, delete or restrict use of your data, object to processing, ask for data portability, and withdraw consent at any time. Contact [email protected]. You can also complain to the Information Commissioner's Office (ico.org.uk).

Marketing emails

We only send marketing emails if you've agreed, and every email includes an unsubscribe link.