Your privacy.

DECANT EDIT (“we”, “us”) operates the decantedit.co.uk store and website, including all related information, content, features, tools, products and services, to provide you, the customer, with a curated shopping experience (the “Services”). We are the controller of the personal information described in this policy. This Privacy Policy describes how we collect, use and disclose your personal information when you visit, use, or make a purchase using the Services, or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use and disclosure of your information as described in it.

Personal information we collect or process

“Personal information” means information that identifies or can reasonably be linked to you or another person. It does not include information that is collected anonymously or has been de-identified so that it cannot identify you. Depending on how you use the Services, we may collect or process:

• Contact details: your name, delivery address, email address and, if you give it, phone number.
• Payment information: payments are processed by Stripe. Your card details are entered on Stripe’s secure payment page and are never received or stored by us. We receive only the payment confirmation, amount, payment reference and the fee charged.
• Account information (if you create an account): your name, email address, a securely hashed password (we cannot see your password), whether you have confirmed your email, and your marketing preference.
• Order information: the decants you order, prices paid, delivery method, order status, tracking number, and any refunds or cancellations.
• Communications: messages you send us through the contact form or by email.
• Technical information: your IP address and basic request information, used briefly to protect the site against abuse (for example, limiting repeated sign-in attempts), and the essential cookies described below.

Where we get it from

• Directly from you, when you place an order, create an account or contact us.
• From our service providers, for example payment confirmation from Stripe and delivery status from Royal Mail.
• Automatically, through essential cookies and the technical information your browser sends.

Cookies and similar technologies

We only use what is strictly necessary for the site to work. We do not use advertising or tracking cookies.

• Your bag: the items in your bag are saved in your browser’s local storage so they are still there when you return.
• Sign-in: if you sign in, a secure cookie keeps you signed in for up to 30 days, or until you sign out.
• Payment security: Stripe’s payment page may set its own cookies to prevent fraud.

If we ever add analytics or marketing cookies, we will ask for your consent first and update this policy.

How we use your personal information

• To provide the Services and fulfil your order: to take payment, pour and dispatch your decants, send your order confirmation and dispatch emails, handle cancellations, refunds and returns, and manage your account.
• Marketing (only if you opt in): if you tick the box to hear about new fragrances, we may email you about them. We do not send marketing by text or post, do not use targeted online advertising, and never sell your information. You can withdraw consent at any time.
• Security and fraud prevention: to protect your account and our store, and to detect and prevent fraudulent or abusive activity. If you create an account, please keep your password safe and don’t share it.
• Customer service: to answer your questions and resolve problems with an order.
• Legal reasons: to comply with the law, including keeping tax and accounting records, responding to valid legal requests, and establishing or defending legal claims.

Lawful bases for processing

Under UK data protection law we rely on the following lawful bases:

• Contract: to process your order and run your account.
• Legal obligation: to keep financial records and meet other legal duties.
• Legitimate interests: to keep the store secure, prevent fraud and improve our service, where those interests are not overridden by your rights.
• Consent: for marketing emails. You may withdraw consent at any time.

Who we share it with

We share personal information only with the service providers we need to run the store, who act on our instructions, and never sell it:

• Stripe: payment processing and fraud prevention.
• Royal Mail: your name and delivery address, to deliver your order.
• Resend: to send order and account emails.
• Our website hosting and database providers: to run the site and securely store order and account data.
• Professional advisers and authorities, such as our accountant, HMRC, or law enforcement, where required by law or to protect our rights.
• A buyer of our business, if the business is ever sold, in which case this policy would continue to apply.

Third-party websites and links

The Services may link to websites operated by others, such as fragrance houses or Royal Mail’s tracking page. We are not responsible for their privacy practices, so please review their policies. A link does not imply endorsement.

Children

The Services are intended for adults and are not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us their information, contact us and we will delete it.

Security and how long we keep it

We protect your information with encryption in transit, hashed passwords, access limited to authorised staff with two-step verification, and card data handled only by Stripe. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

• Orders and payment records: 6 years, as required for UK tax and accounting purposes.
• Your account: until you ask us to delete it. Order records we must keep are retained as above.
• Contact-form messages: up to 2 years after we last dealt with your query.
• Marketing preferences: until you unsubscribe, after which we keep a record that you opted out.
• Security information such as IP addresses: held only briefly to prevent abuse.

Your rights and choices

Under UK data protection law you have the following rights. They are not absolute and may apply only in certain circumstances:

• Access: to request a copy of the personal information we hold about you.
• Correction: to ask us to correct inaccurate information.
• Deletion: to ask us to delete your information, subject to records we must keep by law.
• Portability: to receive your information in a portable format, or have it transferred to another organisation.
• Objection and restriction: to object to, or ask us to restrict, certain processing.
• Withdraw consent: where we rely on consent, such as marketing, you may withdraw it at any time. This does not affect processing already carried out.
• Marketing: you can opt out of marketing emails at any time by replying to one or emailing us. We will still send essential emails about your orders and account.

To exercise any of these rights, email orders@decantedit.co.uk. We may need to verify your identity first. You may ask someone to act on your behalf, in which case we will ask for proof of their authority. We will respond within one month, as required by law, and will not treat you differently for exercising your rights.

International transfers

Some of our service providers (for example Stripe and our email provider) may process information outside the UK. Where they do, we rely on recognised safeguards: UK adequacy regulations (including the UK–US data bridge), or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

Complaints

If you are unhappy with how we use your personal information, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or by calling 0303 123 1113. If you live in the European Economic Area, you may also contact your local data protection authority.

Changes to this policy

We may update this policy from time to time, for example to reflect changes to our practices or for legal or regulatory reasons. We will post the revised policy on this page, update the “Last updated” date, and tell you directly about significant changes where required by law.

Contact

If you have any questions about this policy or our privacy practices, or want to exercise your rights, email us at orders@decantedit.co.uk. You can also use our contact form.