Who we are
Smock & Heirloom LTD is the controller of the personal information collected through this website. [company registration number and registered office to be added]
Contact: [email address to be added], [business address to be added]
What we collect
- Order details: your name, email address, phone number (optional), delivery address and the items you buy.
- Payment confirmation from PayPal (an order and transaction reference). We never receive or store card numbers or PayPal passwords.
- Messages you send us through the contact form, and return requests.
- Your email address if you join our mailing list.
- A technical session cookie that keeps your basket, saved items and checkout details while you browse.
Why we use it, and our lawful basis
- To take, fulfil and deliver your order, handle returns and answer questions about it (performance of a contract).
- To keep accounting and tax records (legal obligation).
- To prevent fraud and keep the website secure (legitimate interests).
- To send our mailing list updates, only if you sign up (consent — you can unsubscribe at any time by replying to any email or contacting us).
Who we share it with
- PayPal, to process your payment (PayPal acts as an independent controller for payment data — see PayPal’s own privacy statement).
- Our website hosting and email providers, who store data on our behalf.
- Couriers and Royal Mail, who receive your name and delivery address to deliver your parcel.
We do not sell your information and we do not use advertising trackers.
How long we keep it
Order and transaction records are kept for six years to meet tax and accounting rules. Contact messages are kept for up to two years. Mailing list details are kept until you unsubscribe.
Cookies
This website uses a single, strictly necessary session cookie to run the basket, saved items, checkout and owner login. It is deleted when you close your browser. At checkout, PayPal may set its own cookies to process your payment securely. We do not use analytics or advertising cookies.
Your rights
You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to how we use it, and to data portability. To make a request, email [email address to be added]. If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office (ico.org.uk), but we’d appreciate the chance to help first.
Last updated 10 October 2026. This does not affect your statutory rights.