Privacy policy

At Edith, Nell & Rose we take your privacy seriously. This policy explains what personal data we collect, why we collect it, who we share it with and what rights you have over it.

It is written to meet the UK GDPR and the Data Protection Act 2018.

Who is responsible for your data

The data controller is:

Base Works, trading as Edith, Nell & Rose
Email: info@edithnellrose.com

What we collect

Your name
Your delivery and billing address
Your email address and, if you give it, your phone number
Your order history and any correspondence with us
Payment confirmation details. We never see or store your full card number: payments are handled by our payment providers
Technical information such as your IP address, device, browser and how you use the site

Why we use it, and our lawful basis

What for	Lawful basis
Taking and delivering your order, handling returns and refunds	Performance of our contract with you
Answering your questions and providing support	Performance of our contract, or our legitimate interest in helping customers
Preventing and detecting fraud	Our legitimate interest in protecting the business
Keeping accounting and tax records	Legal obligation
Sending marketing emails about new pieces and offers	Your consent, which you can withdraw at any time
Improving the website and understanding how it is used	Your consent for non-essential cookies

Marketing

We only send marketing emails if you have asked us to. Every email has an unsubscribe link, and you can also email us to opt out. Unsubscribing does not affect emails about an order you have already placed.

Who we share it with

We never sell or rent your personal data. We share it only with:

Shopify, which hosts this shop
Our payment providers, who process your payment
Our supplier and the carriers who pack and deliver your order
Our email and analytics providers
Our accountant, and any authority we are legally required to disclose to

Each of them may only use your data to provide their service to us.

Sending data outside the UK

Our supplier and some of our service providers are based outside the United Kingdom. When your data goes to them, we rely on the safeguards recognised under UK data protection law, such as UK adequacy regulations or the International Data Transfer Agreement, so that your data keeps the same protection it has here.

You can ask us for details of the safeguards that apply.

How long we keep it

Order and transaction records: 6 years, to meet HMRC requirements
Customer service correspondence: 2 years after the enquiry closes
Marketing consent records: until you unsubscribe, and then a minimal record so we do not contact you again

How we keep it safe

We use technical and organisational measures appropriate to the risk, including encrypted connections across the whole site, encrypted payment processing, and access limited to the people who need it. No system is perfectly secure, but we take this seriously and review it.

Your rights

You have the right to:

Ask for a copy of the personal data we hold about you
Have inaccurate or incomplete data corrected
Ask us to delete your data, where we have no continuing reason to keep it
Ask us to restrict how we use it, or object to us using it
Receive your data in a portable format, or have it sent to another provider
Withdraw consent at any time, where we rely on consent

Email info@edithnellrose.com to exercise any of these. We respond within one month.

Cookies

We use cookies to keep your basket working, remember your preferences and understand how the site is used.

Essential cookies are needed for the shop to function. Analytics and marketing cookies are only set if you agree to them, and you can change your mind at any time through the cookie settings on this site or your browser settings. Blocking essential cookies may stop parts of the shop working.