Privacy Policy

1. Who We Are

Aurum & Relics Ltd is the data controller responsible for the personal information described in this Privacy Policy.

2. Information We Collect

Depending on how you use our website, we may collect and process:

• Your name and contact details.
• Your billing and delivery addresses.
• Your email address and telephone number.
• Your account username and securely hashed login credentials.
• Your order details, purchase history, returns and refunds.
• Payment and transaction information, such as payment status, transaction reference and payment method.
• Messages, contact-form submissions and customer-service enquiries.
• Product reviews, comments and other content you submit.
• Your IP address, browser type, device information, approximate location and website activity.
• Cookie choices, marketing preferences and consent records.
• Information used to detect fraud, misuse or security incidents.

Where this information comes from

We may receive personal information:

• Directly from you when you order, register or contact us.
• Automatically from your browser or device when you use the website.
• From payment, fraud-prevention, delivery and technical providers.
• From advertising or social-media services when you interact with our adverts or permitted tracking technologies.

3. How We Use Your Information

• Process, confirm and fulfil purchases.
• Take payment and carry out fraud and security checks.
• Pack, dispatch, track and deliver orders.
• Send order, payment and delivery communications.
• Manage accounts, returns, refunds and customer support.
• Respond to messages, complaints and legal requests.
• Maintain accounting, VAT, tax and business records.
• Protect and improve our website, store and services.
• Measure website performance and advertising effectiveness.
• Send marketing messages where you have consented or where otherwise permitted by law.
• Comply with legal and regulatory requirements.

Our lawful bases

Where we rely on consent, you can withdraw that consent at any time without affecting processing that took place before withdrawal.

4. Who We Share Information With

We only share information where it is reasonably necessary to operate the store, fulfil an order, protect our business or comply with the law.

Service providers may act as our processors or as separate controllers under their own privacy terms. We do not sell your personal information.

5. Payments and Delivery

Payments

Payments may be processed through WooPayments, Stripe and their payment-processing partners. They may receive your name, billing details, contact information, order value, payment method, device information and other information needed to process and protect the transaction.

Delivery

We provide Royal Mail, Royal Mail Click & Drop or another delivery provider with the information required to deliver your purchase. This may include your name, address, email address, telephone number and parcel or order information.

6. Cookies, Analytics and Advertising

Our website uses cookies and similar technologies. Necessary cookies support functions such as the shopping basket, checkout, account sessions, security and privacy preferences.

Subject to your choices and applicable consent requirements, the website may also use:

• Google Analytics for website measurement.
• Meta/Facebook Pixel for advertising measurement.
• Pinterest Tag and Pinterest integrations.
• Reddit for WooCommerce advertising integrations.
• Snapchat for WooCommerce advertising integrations.
• Jetpack and WordPress.com website statistics and services.

These services may process identifiers, IP addresses, device information, viewed pages, shopping activity and information about interactions with advertisements.

For more information about the technologies used and your available choices, please read our Cookie Policy.

7. Marketing Communications

Where you have agreed to receive marketing, we may use your contact details to send information about products, offers or store updates.

You can unsubscribe using the link in a marketing message or by contacting us. We may retain a limited suppression record so that we can respect your request not to receive further marketing.

8. How Long We Keep Information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected.

• Order, payment, refund, VAT and accounting records are normally retained for at least six years where required for tax, accounting and legal purposes.
• Account information may be retained while the account remains active and for a reasonable period afterward where necessary.
• Enquiries and customer-service records are retained for a reasonable period based on the nature of the request and any possible dispute.
• Marketing information is kept until consent is withdrawn or it is no longer required, subject to limited suppression records.
• Cookie and analytics information is retained according to the relevant cookie or service-provider settings.

Information may be retained longer where required by law, a legal claim, fraud prevention, an official investigation or protection of legal rights. When no longer required, information is deleted, anonymised or securely disposed of.

9. International Data Transfers

Some payment, analytics, advertising, website or technical providers may process personal information outside the United Kingdom.

Where UK data protection law requires it, international transfers must use an approved safeguard, such as a UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses or another legally recognised mechanism.

You may contact us if you would like more information about the safeguards relevant to your personal information.

10. Security

We use reasonable technical and organisational measures intended to protect personal information against unauthorised access, loss, alteration, disclosure or misuse.

These measures may include secured connections, access controls, account protection, software updates, backups and appropriate service providers. However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

11. Automated Decision-Making

We do not normally make decisions about customers solely by automated means where those decisions would produce legal or similarly significant effects.

Payment and fraud-prevention providers may use automated systems to assess transactions. Their use of information is also governed by their own privacy terms and legal responsibilities.

12. Your Data Protection Rights

Depending on the circumstances, UK data protection law may give you the right to:

• Request access to your personal information.
• Ask us to correct inaccurate or incomplete information.
• Ask us to delete information in certain circumstances.
• Ask us to restrict how information is used.
• Object to processing based on legitimate interests.
• Object to direct marketing at any time.
• Request transfer of certain information.
• Withdraw consent where processing relies on consent.
• Raise a concern about how your information has been processed.

These rights are not absolute. We may need to retain or continue processing certain information to fulfil a contract, comply with the law, prevent fraud, resolve a dispute or protect legal rights.

We may need to verify your identity before responding. We normally respond to valid requests within one month, although the law allows additional time in certain complex circumstances.

13. Complaints

You can contact us if you have concerns about how your personal information has been handled. You also have the right to complain directly to the Information Commissioner’s Office.

Information Commissioner’s Office:
Make a data protection complaint to the ICO

You do not have to contact us before making a complaint to the ICO.

14. Changes to This Policy

We may update this Privacy Policy when our services, providers, legal obligations or data-handling practices change. The latest version will be published on this page with the revised update date.