Last updated: 1 October 2026
Privacy Policy
This policy explains what personal data we collect when you visit our website, buy from us or contact us, why we use it, who we share it with, how long we keep it and what your rights are. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
The controller of your personal data is [OWNER FULL NAME], a sole trader trading as [TRADING NAME] under the brand AeroDoze ("we", "us", "our").
- Address: [BUSINESS ADDRESS]
- Email: [CONTACT EMAIL]
- ICO registration number: [ICO REGISTRATION NUMBER]
We're a small business and haven't appointed a data protection officer. If you have any question about your personal data, email us.
2. The personal data we collect
When you buy from us
Our checkout is run by Stripe. When you place an order, Stripe collects your details and passes the following to us:
- your name, email address and delivery address, and your phone number if you give it;
- what you ordered, the price you paid, any discount or referral code you used, and the date of your order;
- limited payment information, such as the type of card, its last four digits and expiry date, and your billing country and postcode. We never see or store your full card number or security code.
When you contact us
Your name, email address, the content of your messages and anything you send us, such as photos or videos of a faulty item.
Referral codes
When you buy from us, we create a personal referral code for you and give it to you, for example on a card in your parcel. Your code may include your first name, so people you share it with will see it. When a code is used, we record which code was used and on which order, so that we can apply the discount, check that codes are used fairly and, if we introduce referrer rewards, give rewards. To check that a customer is new, we may compare the name, email address, delivery address and payment card details (such as the last four digits) with our previous orders. We won't share your friend's personal details or order details with you.
When you visit our website
- Server logs. Our hosting provider records technical information when you visit, such as your IP address, browser type, the pages requested and the date and time. This is needed to deliver the website and keep it secure.
- Your cookie choice. We store your choice about marketing cookies in your own browser. It isn't sent to us. See our Cookie Policy.
- Marketing pixels, only with your consent. If you accept marketing cookies, the Meta Pixel (and the TikTok Pixel, if we use it) collects information about your visit, such as your IP address, browser and device information, the pages you view, the actions you take (for example viewing the product, starting checkout or completing a purchase, including the order value) and identifiers stored in cookies. If you have a Facebook, Instagram or TikTok account, the platform may link this information to your account. If you don't accept, these tools aren't loaded.
Marketing emails
We only send marketing emails if you've opted in. If you do, we keep your email address, your name if you give it, your preferences and a record of your consent. Every marketing email includes a link to unsubscribe.
We don't ask for sensitive information, such as information about your health. Please don't include it when you contact us.
3. How we use your data and our lawful bases
| What we use your data for | Data we use | Lawful basis |
|---|---|---|
| Processing your order, taking payment (through Stripe), delivering your order and sending you order and dispatch emails | Name, email address, delivery address, phone number (if given), order details, limited payment information | Contract: we need it to sell and deliver your order |
| Handling cancellations, returns, refunds and claims about faulty items | Order details, your messages, photos or videos you send, return tracking details | Contract, and legal obligation (consumer law) |
| Answering questions that aren't about an order | Name, email address, your message | Legitimate interests: replying to people who contact us |
| Running our referral scheme: sending you your code, applying your friend's discount, checking that codes are only used by new customers and, if we introduce them, giving referrer rewards | Referral code, the orders it was used on, name, email address, delivery address and payment card details (such as the last four digits) | Contract (the referral terms in our Terms of Sale), and legitimate interests: preventing misuse of codes |
| Keeping accounts and tax records | Order, payment and refund records | Legal obligation (tax law) |
| Preventing fraud and keeping our shop and payments secure | Order details, IP address, device and payment information (through Stripe) | Legitimate interests: preventing fraud and misuse |
| Hosting our website and keeping it secure | IP address, browser type, pages requested, date and time | Legitimate interests: running a secure website |
| Measuring our adverts and showing relevant adverts on Facebook and Instagram (and on TikTok, if we use it) | Cookie identifiers, pages viewed and actions taken on our website, IP address, browser and device information | Consent, which you can withdraw at any time |
| Sending marketing emails, only if you opt in | Name, email address, your preferences | Consent, which you can withdraw at any time by unsubscribing |
| Complying with the law, dealing with your data protection requests and complaints, and establishing, exercising or defending legal claims | Any of the above, as relevant | Legal obligation, and legitimate interests: protecting our legal rights |
4. Who we share your data with
We don't sell your personal data. We share it only with the following, and only as far as they need it:
- Stripe (Stripe Payments UK, Ltd and other Stripe group companies) processes your payment. Stripe acts on our behalf when it processes payments for us, and as a separate controller for its own purposes, such as preventing fraud and meeting its legal and regulatory obligations. If you pay with Link, Apple Pay or Google Pay, that provider's own terms and privacy policy also apply. See Stripe's Privacy Policy.
- Delivery companies (InPost, Evri or Royal Mail, depending on how your order is sent) receive your name, delivery address and email address and/or phone number, so that they can deliver your parcel and send you tracking updates. They use your data in line with their own privacy notices.
- Our email provider, [EMAIL PROVIDER], which we use to send and receive emails, including order emails and any marketing emails you've agreed to receive.
- Our hosting provider, [HOSTING PROVIDER], which hosts our website and keeps its server logs.
- Providers of the software we use to run the business, such as spreadsheet and cloud storage services, which store our order and referral records on our behalf.
- Meta (Meta Platforms, Inc.), only if you've accepted marketing cookies. For the collection of data by the Meta Pixel on our website and its transmission to Meta, we and Meta are joint controllers. Meta acts on our behalf when it produces reports about our adverts, and is responsible as a separate controller for its own further use of the data. See Meta's information about joint processing and Meta's Privacy Policy.
- TikTok (TikTok Information Technologies UK Limited and TikTok Technology Limited), only if we use the TikTok Pixel and you've accepted marketing cookies. For the collection and transmission of data by the pixel, and for measuring our adverts, we and TikTok are joint controllers. TikTok is responsible as a separate controller for its own further use of the data. See TikTok's Privacy Policy.
- Professional advisers, such as an accountant, where needed to run the business.
- Authorities, such as HM Revenue and Customs, the police or a court, where the law requires it or to protect our legal rights.
- A buyer of our business, if we sell it, who would continue to use your data in line with this policy.
5. Transfers outside the UK
Some of our service providers are based outside the UK or may access data from other countries. For example, Stripe and Meta belong to groups based in the USA, and TikTok may transfer data outside the UK. When your data is transferred outside the UK, it is protected by one of the safeguards that UK law requires, such as UK adequacy regulations (for example the UK-US "data bridge" for certified US companies), the ICO's International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses. Contact us if you'd like more information.
6. How long we keep your data
| Data | How long we keep it |
|---|---|
| Order, payment, refund and delivery records, including any discount or referral code used | 6 years from the end of the tax year (which ends on 5 April) in which you placed your order, to meet tax rules and in case of legal claims |
| Emails and other customer service messages, including returns and complaints | 2 years from our last contact with you, or up to 6 years after your order if we need them for a legal claim |
| Your referral code | While the referral scheme runs and your code remains valid, then up to 2 years. Records of orders on which a code was used are kept with the order records above. |
| Marketing email list (only if you opted in) | Until you unsubscribe. After that, we keep your email address on a "do not contact" list so that we don't email you again. |
| Data protection requests and related messages | 2 years after we complete your request |
| Server logs kept by our hosting provider | [LOG RETENTION PERIOD] |
| Your cookie choice (stored in your browser) | Until you change it or clear your browser's site data |
| Data collected by marketing cookies | See our Cookie Policy for how long the cookies last. Meta and TikTok keep the data they receive in line with their own policies. |
7. Your rights
You have the right to:
- access your personal data and get a copy of it;
- correct data that is inaccurate or incomplete;
- erase your data in some circumstances, for example if we no longer need it;
- restrict how we use your data in some circumstances;
- object to our use of your data where we rely on legitimate interests, and to object at any time to direct marketing;
- data portability: to receive data you gave us in a commonly used, machine-readable format, or ask us to send it to another organisation, where we use it on the basis of consent or contract and by automated means;
- withdraw your consent at any time, where we rely on consent (for example for marketing cookies or marketing emails). This doesn't affect our use of your data before you withdrew it.
To use any of these rights, email us at [CONTACT EMAIL]. It's free. We may need to confirm your identity first. We'll respond within one month. If your request is complex, we may need up to two further months, and we'll tell you if so.
To change your cookie choice, use the cookie settings on our Cookie Policy page. To stop marketing emails, use the unsubscribe link in any marketing email, or email us.
8. Automated decisions
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects on you. Stripe runs automated fraud checks when you pay, which can occasionally lead to a payment being declined. If that happens and you think it's a mistake, contact us and we'll look into it with you.
9. Complaints
If you're unhappy with how we've handled your personal data, please tell us first, by emailing [CONTACT EMAIL] or writing to [BUSINESS ADDRESS]. We'll acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint, helpline 0303 123 1113.
10. Keeping your data secure
We use appropriate technical and organisational measures to protect your personal data, including limiting who can access it and using reputable service providers. Card payments are handled by Stripe, which is certified to the payment card industry data security standard (PCI DSS). No way of sending or storing data is completely secure, but we work hard to protect yours.
11. Children
Our website and products are intended for adults. We don't knowingly collect personal data from anyone under 18.
12. Changes to this policy
We may update this policy from time to time. We'll publish the new version on this page with a new "last updated" date and, if the changes are significant, we'll let you know where appropriate.
13. Contact us
For any question about this policy or your personal data, email [CONTACT EMAIL] or see our Contact page. You can also read our Terms of Sale or go back to the shop.