Privacy and cookies

Who we are

The controller of your personal data is Kathryn Tatham, trading as Hippy Crystal Vibes, a sole trader. Our address is Unit 156154, PO Box 7169, Poole, BH15 9EL. For anything about your data, email hippycrystalvibes@gmail.com.

What we collect and why

When you place an order

Checkout is run by Stripe. You give Stripe your name, email address, billing and delivery addresses and payment details. We receive your name, email address, addresses and what you bought, so we can send your order, email you a confirmation and deal with any questions or returns. We never see your full card details. Our lawful basis is performing our contract with you, and keeping records the law requires (for example for tax).

When you send an enquiry

When the shop takes enquiries instead of orders, you give us your name, email address and the pieces you are interested in. We email them to ourselves, send you an acknowledgement and reply to you. Our lawful basis is taking the steps you ask for before an order.

When you email us

We keep your messages so we can reply and keep a record of what was agreed. Our lawful basis is our legitimate interest in answering you.

Analytics, with your consent

If you allow analytics cookies, Google Analytics (through Google's Firebase library) records the pages you visit, roughly where you are, your device and browser, how you found us and, if you order, the order value and items. We also remember how you first found us, and if you then order, we attach that to the order in Stripe. Our lawful basis is your consent, which you can withdraw at any time.

Marketing, with your consent

If we run ads on Meta, Google or TikTok, their tags measure which ads lead to visits and orders. They run only if you allow marketing cookies. Our lawful basis is your consent.

Running the site safely

To deliver the site and keep it secure, our hosting and network providers process your IP address and the requests your browser makes. We also count page views and measure page speed with Vercel Web Analytics and Speed Insights, which use no cookies and do not identify you. When something on the site breaks, Sentry receives a technical error report. We have set it not to collect user details, cookies or the contents of forms and requests, and its replays of the moments before an error mask all text and inputs and block images. Our lawful basis is our legitimate interest in running a secure, working shop.

Who processes your data for us

Each provider handles your data under a contract with us, or as a controller under its own privacy policy for its own purposes (Stripe, for example, to prevent fraud). We do not sell your data.

International transfers

Several of these providers are based in, or use servers in, the United States and the European Union. Where your data leaves the UK, it is protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified companies) or by the ICO's International Data Transfer Agreement or Addendum.

How long we keep it

• Orders: 6 years, to meet HMRC record-keeping rules
• Enquiries: 12 months after our last reply
• Google Analytics data: 14 months
• Data in your browser: as set out in the table below

Your rights

Under UK data protection law (the UK GDPR), you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted, where we have no need or legal duty to keep it;
• restrict or object to how we use it;
• receive it in a portable format;
• withdraw your consent at any time, without affecting what we did before.

Email hippycrystalvibes@gmail.com to use any of them. We reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to put things right first.

Cookies and browser storage

We store a few things in your browser. Those that keep the shop working are set without asking. The rest are only set if you say yes.

Changing your cookie choices

Use Cookie settings at the bottom of any page to change your choices. When you withdraw consent, we delete the analytics and marketing cookies and the record of how you found us, and reload the page.

Changes to this policy

If we change how we use your data, we will update this page and the date at the top. See also our terms.