Privacy notice

Who we are

amalyashop Ltd, a company registered in England and Wales, company number 14827301, trading as amalia and amalyashop. We are the data controller for the personal data described here, which means we decide why it is held and what happens to it. Our registered office address and our data protection contact are being confirmed and will be listed here before the shop takes live orders.

What we collect

When you place an order

• Your name, email address, delivery address and phone number.
• What you ordered, what you paid, any discount code used, and any note you added for the packer.
• A payment reference from our payment provider. We never see or store your full card number.

When you use the site

• The contents of your basket, held in a cookie on your own device for 30 days. It is not linked to you until you check out.
• Your chosen delivery method and any discount code you have applied, in the same way.
• Standard server logs, including IP address and browser type, kept briefly for security and to work out why something broke.

When you contact us or sign up

• Your name, email address and whatever you write in the message.
• Your email address alone if you join the newsletter, plus the date you joined.

Why we have it, and on what basis

• To perform our contract with you. Taking payment, packing the order, getting it to your door, handling a return. Without this data there is no order.
• Our legitimate interests. Keeping the site secure, preventing fraud, answering your messages, and understanding which products fail so we can stop selling them. We have weighed this against your interests and it is limited to what a shop needs.
• Your consent. Marketing emails only. You give it by ticking a box, and you can take it back in one click from any email we send.
• Legal obligation. Keeping records of sales for tax purposes.

Who we share it with

Only the suppliers who need it to get your order to you, and only the part of it they need.

• The courier carrying the parcel, which gets your name, address and phone number.
• Our payment provider, which handles the card details we never receive.
• Our hosting and database providers, which store the order so we can show it to you again.
• Our email provider, for order confirmations and the newsletter.

We do not sell personal data, we do not share it for anyone else’s marketing, and there is no advertising network on this site. Where a supplier processes data outside the UK, the transfer relies on UK adequacy regulations or the international data transfer addendum to the standard contractual clauses.

How long we keep it

• Order records: six years after the end of the tax year the order falls in, because HMRC requires it.
• Contact messages: two years, so we can pick up a conversation about a product you bought.
• Newsletter sign-ups: until you unsubscribe, plus a record of the unsubscribe so we do not email you again by accident.
• Server logs: a matter of weeks.

Your rights

Under the UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or hand it to another provider in a portable format. You can object to processing we justify on legitimate interests, and you can withdraw consent to marketing at any time. There is no charge, and we answer within one month.

Some of it we cannot delete on request. An order record has to survive for tax reasons even if you ask us to forget you, so in that case we restrict it to the accounting record and remove the rest.

Ask through the contact form. If you are not satisfied with how we handle it, you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you gave us the chance to fix it first.

Cookies

The site sets three cookies, all of them needed to run a basket, and none for advertising. They are listed in full on the cookies page.

Children

The shop is not aimed at children and we do not knowingly collect data from anyone under 16. If a child has given us something, tell us and we will remove it.

Changes to this notice

When it changes materially we update the date at the top of this page and, if it affects how we use data you have already given us, we email anyone on the list.