This policy explains what personal information we collect when you use stlow.co.uk and our Shopify-powered store, why we collect it, how long we keep it, and what your rights are. We've kept it plain. Where the law uses specific terms — "data controller", "legal basis" — we've used them too, but with explanations.
1. Who controls your data
The data controller for personal information collected on stlow.co.uk is[REGISTERED COMPANY NAME LTD] (Company No. [######]), trading as St Low, registered in England and Wales.
Registered address: [FARM ADDRESS, POSTCODE]. Contact: hello@stlow.co.uk.
2. What we collect
When you place an order, sign up to our newsletter, or contact us, we collect:
- Your name and email address
- Your delivery and billing address
- Your phone number (only if you provide it for delivery)
- Order details, payment confirmation reference, and purchase history
- Any messages you send us
- Anonymous analytics data about how you use the site (pages visited, device type, approximate location from IP)
We do not store payment card details. Card data is captured and processed directly by Shopify Payments (or its payment processor, Stripe), which is PCI-DSS compliant.
3. How we use it
We use your information to:
- Process and fulfil your orders, including handing off your delivery details to our courier
- Send you order confirmations, dispatch notifications, and tracking links
- Respond to questions or complaints
- Send marketing emails — but only if you've opted in
- Understand site usage so we can improve it (anonymised analytics only)
- Detect and prevent fraud
- Comply with our legal and tax obligations
4. Legal basis
Under UK GDPR we have to tell you the legal basis on which we process your data. The bases we rely on are:
- Contract — to fulfil an order you've placed with us
- Consent — for marketing emails, and for non-essential cookies
- Legitimate interest — to run and improve the business, and for fraud prevention
- Legal obligation — to keep tax and accounting records (HMRC requires this for six years)
6. How long we keep it
- Order and accounting records — six years after the order date, to comply with HMRC requirements
- Customer accounts — until you ask us to close them
- Marketing list — until you unsubscribe
- Support emails — typically two years, longer if relevant to an open issue
7. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Rectify data that's inaccurate or out of date
- Erase data we no longer need to hold (subject to our tax-record obligations)
- Restrict or object to our processing of your data
- Withdraw consent for marketing emails at any time — every email contains an unsubscribe link, and you can also email us
- Data portability — receive a copy of your data in a portable format
To exercise any of these rights, email hello@stlow.co.uk. We aim to respond within 30 days.
9. Complaints
If you're not happy with how we've handled your data, please contact us first so we can put it right. You also have the right to complain to the UK's data protection regulator:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113 · ico.org.uk
10. Contact
Questions about your data, or this policy? Emailhello@stlow.co.uk or write to us at the registered address above.