Privacy policy
This policy explains what personal information Mrs T’s Boutique collects when you visit our website, shop with us or get in touch, how we use it, and the choices you have. We only collect what we need, we keep it safe, and we never sell it.
How we use cookies is explained in our Cookies policy.
Who we are
Mrs T’s Boutique (mrstsboutique.co.uk) is run by [Karen’s full name or company name], [trading as Mrs T’s Boutique]. We are the “controller” of your personal information, which means we decide how it is used and we are responsible for looking after it.
- Address: [business address]
- Email: info@mrstsboutique.co.uk
- WhatsApp: 07904 132710
- ICO registration number: [ZAxxxxxx]
The information we collect
When you place an order
Your name, billing and delivery address, email address, phone number, the items you order and any notes you add. Card payments are handled by Stripe: your card number goes straight to Stripe and we never see or store it. Stripe tells us only the card type, the last four digits and whether the payment succeeded.
When you create an account
The details above, plus your password (stored encrypted, so even we can’t read it) and your order history.
When you contact us
If you email us, message us on WhatsApp, Instagram or Facebook, or use the form on our Contact page, we receive your name, contact details and your message. For sizing questions this may include your usual size, height and measurements, which you choose to share so Karen can recommend the right fit.
When you sign up to our newsletter
Your email address [and name].
When you browse our website
Technical information such as your IP address, browser and device type, the pages you visit and how you found us (for example from a Google search or an Instagram post). Some of this is collected using cookies; see our Cookies policy.
How we use it, and why we’re allowed to
Data protection law says we must have a lawful reason (a “lawful basis”) for each use of your information. Here is what we do and why:
| What we do | Lawful basis |
|---|---|
| Process your order, take payment, deliver it and handle returns and exchanges | Contract: we need it to sell to you |
| Send order confirmations, dispatch emails and updates about your order | Contract |
| Answer your questions, including sizing advice | Legitimate interests: helping our customers, or steps you ask us to take before you buy |
| Run your customer account | Contract |
| Prevent fraud and keep our website secure | Legitimate interests: protecting you and our business |
| Keep accounting and tax records | Legal obligation |
| Send our newsletter | Consent: you can unsubscribe at any time |
| Measure how our website is used, with Google Analytics, and which visits lead to orders | Consent: through the cookie banner |
We don’t use your information to make automated decisions that have a legal or similarly significant effect on you.
Payments
Payments on our website are processed by Stripe [card, Apple Pay and Google Pay]. When you pay, your payment details are sent directly to Stripe over an encrypted connection. Stripe is certified to PCI DSS Level 1, the highest standard in the payments industry.
Stripe also uses information about your payment and device to detect and prevent fraud. For this it acts as a separate controller. Read Stripe’s privacy policy for details.
Analytics and Google services
We use Google Analytics to understand how people use our website: for example which pages are popular, how visitors find us and whether the site works well on phones. This helps us improve the shop. Google Analytics only runs if you accept analytics cookies, and it reports trends rather than identifying you. Google Analytics 4 does not log or store IP addresses. We keep analytics data for [14 months].
When you place an order, WooCommerce also records how you arrived at our site (for example “Instagram” or “Google search”) alongside the order, so we can see which of our posts and pages lead to sales. This also only happens if you accept analytics cookies.
We use Google Search Console to see how our website appears in Google search results, such as which searches show our pages. It uses information Google already holds about searches, sets no cookies on our website and gives us totals, not information about individual people.
Our website loads its fonts from Google Fonts, which means your browser connects to Google’s servers and shares your IP address with them.
You can read how Google uses information in How Google uses information from sites that use its services. You can also block Google Analytics on every website with the Google Analytics opt-out browser add-on.
Who we share it with
We never sell your information or share it with anyone for their own marketing. We only share it with trusted companies that help us run the shop, and only what they need:
- Stripe: to take payments and prevent fraud.
- [Royal Mail / Evri / courier name]: your name, address and [phone number or email] so they can deliver your order.
- Krystal Hosting: our UK web host, which stores the website and its database.
- Google: Google Analytics (with your consent), Google Search Console and Google Fonts.
- [Email provider]: for our email.
- [Newsletter provider]: if you sign up to our newsletter.
- Storm Development: our website developer, who may see order or account details while maintaining or fixing the website.
- [Our accountant]: for our accounts and tax returns.
We may also share information if the law requires it, for example with HM Revenue & Customs, or to prevent fraud or crime.
Information sent outside the UK
Some of the companies we use, including Stripe and Google, are based in the United States or store information there. When this happens, the transfer is protected by the UK–US “data bridge” or by contracts approved by the UK government, so your information gets the same level of protection as in the UK.
How long we keep it
We only keep your information for as long as we need it:
| Information | How long |
|---|---|
| Orders, invoices and payment records | 6 years after the end of the financial year they relate to, because HMRC requires it |
| Your customer account | Until you ask us to close it. Order records are then kept as above. |
| Emails, contact form and WhatsApp messages | [Up to 2 years] after our last conversation, unless they relate to an order |
| Newsletter sign-up | Until you unsubscribe |
| Google Analytics data | [14 months] |
Keeping it safe
Our website uses an encrypted connection (HTTPS) on every page. Payments are handled by Stripe, so card details never touch our website. Passwords are stored encrypted, the website is protected by security software and kept up to date, and only Karen and the people who need it to help run the shop can see your details.
Your rights
You have the right to:
- see the personal information we hold about you and get a copy of it
- ask us to correct anything that is wrong or incomplete
- ask us to delete your information, unless we have to keep it by law (for example order records for HMRC)
- ask us to restrict how we use it, or object to us using it
- ask us to send your information to you or another company in a portable format
- withdraw your consent at any time, for example by unsubscribing from our newsletter or changing your cookie settings
To use any of these rights, email info@mrstsboutique.co.uk. It’s free, and we’ll reply within one month. We may ask you to confirm your identity first.
If you’re unhappy with how we’ve handled your information, please tell us so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Children
Our shop is for adults. You must be 18 or over to place an order, and we don’t knowingly collect information from children.
Other websites
Our website links to other sites, such as Instagram, Facebook and WhatsApp. They have their own privacy policies, and we’re not responsible for how they use your information. If you message us on one of them, that company will also process your message under its own policy.
Changes to this policy
We may update this policy from time to time, for example if we start using a new service. The date at the top of this page shows when it was last changed. If we make an important change, we’ll let customers know.
Any questions?
If you have a question about your information or how we use it, email Karen and she’ll get back to you.