Privacy Policy
Effective date: 15 October 2026
There is one question a privacy policy ought to answer, and most of them never get round to it: what do you actually have on me?
So this one is written as the contents of your file. If you have ordered from us once, there are seven records with your name on them. Each gets the same four facts: what is in it, why we hold it, what in law allows us to, who else sees it, and the date it goes. Then there is the part that is about you but is not in any file — cookies, and the platforms that set them — and then your rights, which are how you act on all of it.
No section here says "we may collect". We either hold a thing or we do not.
Cosycombe LTD is the controller of everything described below. That means the decisions are ours and the responsibility is ours, including for what our suppliers do with your data on our instructions.
Part 1 — The seven records
Record 1 — Your order
What is in it: your name; billing address; delivery address; email address; telephone number; the items, sizes and quantities you bought; the amount you paid; the delivery method; the order number and the date.
Why: to take the order, charge you, get the parcel to you, keep you posted, deal with returns, and file correct accounts and VAT returns.
What allows us to: performance of a contract (Article 6(1)(b) UK GDPR) for everything up to delivery. After that, legal obligation (Article 6(1)(c)) — tax and company law require us to keep the transaction.
Who else sees it: Shopify, which runs the shop and the checkout and stores the record. Stripe, which takes the payment. Royal Mail, which gets the name, delivery address, postcode, and your email or phone number for the tracking notification — and nothing else.
When it goes: six years from the end of the financial year the order falls in. That is not a figure we chose. VAT records must be kept six years (Value Added Tax Act 1994), corporation tax records six years from the end of the accounting period (Finance Act 1998), and a contract claim can be brought for six years (Limitation Act 1980). All three land in the same place, so that is the date.
Can you have it deleted sooner? Not while the tax obligation runs. We can delete the parts not covered by it — that is Record 3 and Record 4 below — and we will if you ask.
Record 2 — Your payment
What is in it: the last four digits of your card, the card type, the expiry month, the authorisation result, the amount, the currency, and the payment reference.
What is not in it: the full card number, the security code on the back, and your PIN. Those never reach us. The card fields at checkout are served by Stripe and the details go straight to them. We could not leak your card number because we do not have it.
Why: to take the payment, match it to the order, issue refunds, and defend a chargeback if one is raised.
What allows us to: contract for the payment itself; legal obligation for the accounting record; legitimate interests in being able to answer a chargeback, where our interest is not being charged twice for one order.
Who else sees it: Stripe. Note that Stripe is not only acting on our instructions here — it has its own duties under money-laundering and payment-services law, and for those purposes it is a controller in its own right and its own privacy notice applies. We cannot tell Stripe to stop doing that, and nor can you.
When it goes: six years, with the order.
Record 3 — Your messages to us
What is in it: your emails and anything you send through the contact form — your name, email address, phone number if you give it, the order number and what you wrote. If you telephone us, a short written note of what was agreed. We do not record calls.
Why: to answer you, and to be able to see what we told you if the matter comes back.
What allows us to: contract where the message is about an order you placed. Legitimate interests where it is not — a question before you buy, say — and the interest is simply being able to run a shop that answers its post.
Who else sees it: our email provider, as the service that carries and stores the mailbox. Nobody else. Your messages are not used for marketing, and we do not mine them.
When it goes: 24 months from the last message in the thread. Where the exchange concerns a complaint, a return, a warranty claim or anything that might become a dispute, it is kept with the order for six years instead, because that is how long you have to bring a claim and we may need to answer it.
Record 4 — Your account, if you made one
What is in it: your email address, a hashed password — a one-way transformation, so we cannot read it or tell you what it is — your saved addresses, and your order history.
Why: so you can sign in, see your orders, and check out without retyping your address.
What allows us to: contract. You asked for an account; this is the account.
Who else sees it: Shopify, which hosts it.
When it goes: while the account exists, and then 30 days after you delete it, which is how long it takes to roll off our backups. After that the account is gone and only the order records survive, on the legal-obligation basis in Record 1.
You do not have to have one. Guest checkout gives you the same rights, the same delivery and the same prices.
Record 5 — Your marketing record
What is in it: your email address; the date, time and wording of the box you ticked, which is our evidence that you agreed; whether our emails were opened and whether links in them were clicked; the date you unsubscribed, if you have.
Why: to send you what you asked for, and to be able to prove we were entitled to send it.
What allows us to: consent (Article 6(1)(a)), and regulation 22 of the Privacy and Electronic Communications Regulations 2003, which is the rule that actually governs marketing email in the UK. If you have bought from us, regulation 22 also permits us to email you about similar products on the basis of legitimate interests, provided we gave you the chance to refuse at the time and give you one in every message. We did and we do.
Who else sees it: the provider that sends the emails.
When it goes: we stop sending the moment you unsubscribe. Your email address then goes onto a suppression list and stays there — and this is the one retention period that has no end date, for a reason worth stating plainly: the only way to be certain we never email you again is to keep a record that we must not. That list is used for nothing else. It is checked before a send and never added to a campaign.
Unsubscribing does not stop order emails. Confirmations, dispatch notices and replies to your questions are part of the contract, not marketing.
Record 6 — Your returns and complaints
What is in it: what you sent back and why; any photographs you supplied; what we decided; the amount refunded and the date; the correspondence.
Why: to carry out the return, pay the refund, claim against the carrier where a parcel was damaged, and show what happened if the matter is reopened.
What allows us to: contract and legal obligation — you have statutory rights and we have to be able to evidence that we honoured them.
Who else sees it: Royal Mail, where we are claiming for damage in transit, and then only what the claim needs.
When it goes: six years, with the order.
Record 7 — Your fraud check
What is in it: the IP address the order came from; whether the billing and delivery addresses matched; the result of the card issuer's address and security-code checks; any chargeback raised against the order.
Why: because card fraud on a stolen card is paid for by the shop, and because an order shipped to a fraudster costs the real cardholder their afternoon.
What allows us to: legitimate interests (Article 6(1)(f)). Stated properly, as the law requires: our interest is preventing payment fraud and chargeback loss; the data used is the minimum that answers the question; and we have weighed it against your interests on the footing that a declined order inconveniences you far less than a fraudulent one.
Who else sees it: Stripe's fraud screening, which is part of taking the payment.
When it goes: 12 months, or six years where a chargeback was actually raised, because that is a dispute and Record 6 applies.
No order is refused by a machine alone. See Part 5.
Part 2 — What is about you but is in no file
Server logs
Our hosting records each request to the site: IP address, browser and version, operating system, the page requested, the referring page, and the timestamp. This is not linked to your name unless you are signed in.
Basis: legitimate interests — keeping the site up, keeping it secure, and finding out what broke when something does.
Retention: 90 days, then deleted.
Cookies and what sets them
The complete current list — every cookie, its provider, its purpose and how long it lasts — is in the cookie banner, under "Manage preferences". It is generated from what is actually running, which is why it is the authoritative list and this page is not.
What the categories mean, and what the law requires for each:
Strictly necessary. The basket, the checkout, signing in, the security token that stops someone forging a request on your behalf, and the record of your cookie choice itself. No consent is needed and none is asked for — the site cannot work without them, which is the test in regulation 6(4) of PECR.
Statistical. Page views, where visitors arrive from, which pages fail. Following the amendments made to PECR by the Data (Use and Access) Act 2025, cookies used solely to collect statistics in order to improve the service no longer require consent — but only on two conditions, and we meet both: we tell you clearly what they are for, which is this paragraph and the banner, and you can object, free and in one click, in the banner. The exemption does not cover sharing the data with anyone who will use it for their own ends, and we do not rely on it for anything that does.
Appearance and functionality. Remembering a preference you set. Same treatment, same free opt-out.
Advertising and conversion measurement. This is the category the exemption does not reach, and so nothing in it runs until you say yes. We use Google Ads conversion tracking to see whether an advert led to an order, and Google Analytics to understand how the site is used. Google processes some of that data for its own purposes as well as ours, which is exactly why it sits here and not under "statistical".
If you say no, nothing stops working. Prices do not change, delivery does not slow down, and you are not asked again on every page. You can change your answer at any time in the same banner — withdrawing is as easy as giving, which is the standard the law sets. Your browser's own cookie controls are a separate route and entirely yours; they are not how we record your choice.
Links and embedded content
Where we link to another site, that site's privacy policy governs what happens when you get there. We do not control it and we do not receive anything from it.
Part 3 — Who the data goes to, and where
Four kinds of recipient, and the distinction between the first two matters more than it looks.
Processors — they act on our instructions only. Shopify (shop platform, hosting, checkout, order storage), our email provider, and Royal Mail for the delivery address. Each is under a written contract required by Article 28 UK GDPR: they process only what we tell them to, they may not use your data for their own purposes, and they must return or delete it when we say.
Independent controllers — they have their own duties and their own reasons. Stripe, for payment-services and anti-money-laundering law. Google, for its advertising and analytics products. Their own privacy notices apply to that part, alongside this one.
Professional advisers, where we need legal or accounting advice on a specific matter — and then only the documents that matter bears on.
Public authorities, where the law requires it. We do not hand over customer data on a request that is merely polite. We check that whoever is asking has the power to ask, we give the minimum the power reaches, and where we are permitted to tell you, we do.
We do not sell your personal data, and we do not share it with data brokers, list builders or anyone compiling a profile of you for resale. Not for money and not for anything else of value — which is the broader form of that sentence, and the one worth making.
Transfers outside the UK
Royal Mail is domestic. Shopify, Stripe and Google are not — some of their processing happens in the EEA, the United States and elsewhere. A transfer out of the UK is lawful only on one of the routes in Chapter V UK GDPR, and ours are:
- UK adequacy regulations for the EEA, so EEA processing needs nothing further.
- The UK Extension to the EU–US Data Privacy Framework — the UK–US "data bridge" — where the US recipient is certified under it.
- Otherwise the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment.
Ask and we will tell you which route a specific recipient is on. That is a question with an answer, and you are entitled to it under Article 13(1)(f).
Part 4 — Your rights, and the machinery for using them
Nine rights. All of them are free, and we may not charge you for asking.
- To be informed — this document.
- Access — a copy of your data, with the context: why we have it, who we gave it to, how long we keep it.
- Rectification — anything inaccurate corrected, anything incomplete completed.
- Erasure — deletion where we no longer have a basis to hold it. Where tax law requires us to keep the order, that part stays, and we will tell you which part and why rather than refusing the whole request.
- Restriction — processing frozen while a dispute about accuracy or basis is resolved.
- Objection — to anything we do on legitimate interests. We must then stop unless we can show compelling grounds that override your interests, and the burden of showing that is ours.
- Portability — the data you gave us, in a machine-readable file, for you or for someone else.
- Withdrawal of consent — at any time, as easily as you gave it. Marketing and advertising cookies are the two things here that run on consent.
- Not to be subject to a solely automated decision with legal or similarly significant effects. See Part 5.
And one that is absolute. You can object to direct marketing and there is no balancing test, no exception and nothing we can weigh against it. We stop. One click in any email does it.
How to make a request
Email support@cosycombe.com. Say what you want; you do not need to cite an article number or use any particular form of words. "Send me everything you have on me" is a valid subject access request.
Our deadline is one month from receiving a valid request. Where a request is genuinely complex or there are several of them, we may extend by up to two further months — and if we do, we tell you inside the first month, with the reason.
Identity. We may ask you to confirm you are who you say you are, because handing your file to someone else would be the worse failure. We ask for the least that settles it — usually replying from the email address on the order. We do not ask for photo ID to answer an email, and the time taken to verify does not extend our deadline beyond what is reasonable.
If you are not happy with how we handled it
Complain to us first, and we must run a proper process. Since 19 June 2026 the Data (Use and Access) Act 2025 requires every controller to provide an electronic route for data protection complaints, to acknowledge a complaint within 30 days, to investigate it appropriately, and to tell you the outcome without undue delay. Email support@cosycombe.com with "Data protection complaint" in the subject line and that is the process you are in.
Then, or instead, the regulator. You may complain to the Information Commissioner's Office at any time; you do not need our permission and you do not have to exhaust us first.
Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline 0303 123 1113 · ico.org.uk/make-a-complaint
And the courts. You keep the right to bring a claim, and to compensation for damage — including distress — caused by a breach of data protection law. Nothing on this page affects that.
Part 5 — Four things worth stating because they are usually left out
Automated decisions
Our fraud screening scores orders and can flag one for review. It cannot cancel your order by itself. Where a flag is raised a person looks at it, and if we decline an order you can ask why, say your piece, and have the decision looked at again by a human. That keeps us outside Article 22, and it is also simply the right way round.
We do not profile you to set your price. Everyone sees the same price for the same item on the same day.
If there is a breach
If personal data is lost, stolen or exposed, we investigate at once and notify the ICO within 72 hours where the breach is likely to result in a risk to people's rights and freedoms (Article 33). Where the risk to you is high, we tell you too, without undue delay, in plain language: what happened, what data, what we have done, and what you should do (Article 34).
We will not describe a breach as a "security incident" in an email designed not to be read.
Children
The site is for adults and nothing on it is aimed at children. In the UK, 13 is the age at which a child can consent to an online service in their own right (section 9, Data Protection Act 2018), and we neither seek nor knowingly hold data about anyone younger. If you believe a child has given us something, email us and we will delete it.
Security, honestly
Encryption in transit across the whole site. Card data never on our systems. Passwords stored hashed. Access to order data restricted to the people who need it to do their job, and removed when they no longer do. Suppliers chosen on their security posture and bound by written terms.
What we will not tell you is that your data is perfectly safe, because nobody can and the sentence is worthless. It can be well protected, and the measures above are what we have. If they fail, the paragraph above this one is what happens next.
Changes to this policy
When we change something, the date at the top changes with it. Where a change materially affects what we do with data we already hold, we will tell you directly — by email where we have your address — rather than leaving it on this page to be discovered. We do not ask you to check back periodically, and we do not treat your continued use of the site as agreement to a material change.
Earlier versions are available on request.
Contact
Company name: Cosycombe LTD
Address: St Sepulchre Gate, Doncaster DN1 1SW, United Kingdom
Email: support@cosycombe.com
Phone: +44 1302 368335
Customer service: Monday–Friday, 9:00 am–5:00 pm
Saturday and Sunday: Closed
Response time: Within 2 working days