Privacy

Last updated 23 October 2026

We ask for as little as we can and we do not sell it to anyone. This page says what we collect, why we are allowed to hold it, who else touches it, how long we keep it, and what you can make us do about it.

Who is responsible

MARTZEY LTD is the data controller for this site. We are registered in England and Wales under company number 14466643.

For anything about your data, contact [TO CONFIRM: data protection contact email address]. Our registration with the Information Commissioner’s Office is [TO CONFIRM: ICO registration number].

What we collect, and why

Your order

Name, email address, delivery address, billing address, telephone number if you give one, what you bought and what you paid. We need this to take the order, send the parcel and deal with you afterwards. Without it there is no contract to perform.

Payment

Your card details go directly to Stripe and never reach our systems. From Stripe we receive confirmation that a payment succeeded, the amount, and a reference — enough to match the payment to your order and to issue a refund.

Correspondence

Emails you send us and our replies, so we have a record of what was agreed if you come back about an order.

Technical data

Our hosting and database providers log requests to the site, including IP address, approximate location, browser and the pages requested. This keeps the site up and helps us see abuse and errors.

Your basket

Your basket is kept in your own browser’s local storage, under the key fq.cart.v1. It stays on your device, we cannot read it, and clearing your browser data removes it. It only reaches us when you check out.

Your account, if you make one

Your email address, the first name you give, and your password, which our database provider Supabase stores only in scrambled (hashed) form, so no one can read it back. If you sign in with Google instead, Google tells us your name, email address and profile picture and nothing else. An account is never needed to buy, and we delete it when you ask.

Our newsletter, if you join it

Your email address, the words you agreed to and when, and the welcome discount code we sent you, with whether it has been used. We use your address only to send our newsletter - new arrivals, gifts and offers - until you unsubscribe, which every email lets you do in one click. Unsubscribing does not cancel an unused code.

The chat assistant, if you use it

What you type into the chat, and the address of the page you are on, are sent to Anthropic, whose AI writes the replies. We do not keep a record of chats: the conversation is held in your browser’s session storage until you close the tab. Please do not type card details or anything private into it.

Our lawful bases

• Performance of a contract — taking payment, dispatching your order, handling returns and refunds.
• Legal obligation — keeping VAT and accounting records of what we sold and to whom.
• Legitimate interests — keeping the site running and secure, and preventing fraudulent orders. We think this is a fair use of your data because it protects you as much as it protects us.
• Consent — anything optional, such as our newsletter, which you join by giving your email address in our sign-up box. You can withdraw it at any time with the unsubscribe link in any email, and withdrawing it does not affect an order already placed.

Who processes it for us

These companies handle your data on our instructions, under contract, and may not use it for their own purposes.

• Stripe — payment processing. Stripe handles your card details as a processor for us and, for its own regulatory and fraud-prevention purposes, as a controller in its own right. It carries out automated checks on payments to spot fraud, which can cause a payment to be declined.
• Supabase — the database holding orders and the catalogue, hosted in the London (eu-west-2) region.
• Vercel — hosting for this site.
• Resend — sends our emails, such as your welcome code and our newsletter.
• Anthropic — the AI behind the chat assistant. It processes what you type in the chat to write each reply and does not use it to train its models.
• Royal Mail — delivery. They receive the name and address on the parcel, and nothing about what is inside it or what you paid.
• [TO CONFIRM: the email provider used to send order confirmations.]

We do not sell or rent your data, and we do not share it for anyone else’s advertising. We will disclose it where the law requires it.

Data leaving the UK

Our database is hosted in the UK. Some of our providers are based in the United States and may process data there or elsewhere. Where that happens we rely on the UK’s adequacy regulations or on the International Data Transfer Agreement or Addendum, so your data keeps essentially the same protection it has here.

How long we keep it

• Order and payment records: six years from the end of the accounting period they fall in, because HMRC requires us to keep VAT records that long. We cannot delete these on request before then.
• Correspondence: kept while it may still be needed for a complaint, return or claim, then deleted.
• Anything else: deleted once the reason we collected it has gone.

Cookies and similar storage

We use only what the site needs to work: your basket in local storage and any chat in session storage, as described above, and the cookies Stripe sets on its own payment pages for security and fraud prevention. We do not use advertising cookies. [TO CONFIRM: whether any analytics are enabled on the site. If they are, name the provider here and add a consent banner — analytics cookies need consent.]

Your rights

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct it if it is wrong or incomplete;
• delete it, where we have no continuing reason or legal duty to keep it;
• restrict what we do with it while a dispute about it is sorted out;
• send it to you or another provider in a portable form, where we hold it on the basis of your consent or our contract with you;
• stop processing it where we rely on our legitimate interests; and
• withdraw any consent you have given.

Email [TO CONFIRM: data protection contact email address]. We will respond within one month, and there is no charge. We may ask you to confirm who you are first, so that we do not hand your order history to someone else.

Complaining

If you are unhappy with how we have handled your data, please tell us first so we can try to fix it. You can also complain to the Information Commissioner’s Office, the UK regulator, at ico.org.uk. Complaining to us does not affect your right to go to the ICO.

Children

This shop is not aimed at children, and under our terms of sale you must be 18 to order. We do not knowingly collect data about children. If you think we hold any, tell us and we will delete it.

Changes

If we change how we use your data we will update this page and change the date at the top. Where a change is significant we will tell you directly.