This explains what we do with your information when you visit the site, buy a piece, join the Mail Club, or sign up to the mailing list. We've tried to keep it readable - if anything is unclear, just ask.

who we are

Gabriela Mac’Allister Darwisch, trading as fuller wells, a sole trader based in London. We are the data controller for everything described here.

Email: support@fullerwells.com

Address: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF

what we collect, and why

• When you buy a piece or join the Mail Club, we collect your name, email address, delivery and billing address, your phone number if you give one, and a record of what you've ordered — including your subscription status and renewal dates for the Mail Club. We need this to take your payment, get your order to you and deal with any returns, so our legal basis is performing our contract with you. We also keep these records to meet HMRC requirements, which is a legal obligation.

• We never see or store your full card number. Our payment provider passes us only the card type, the last four digits and the expiry date.

• When you join the mailing list, we collect your name email address, country, and date of birth, a record of when and how you signed up, and whether you opened our emails and what you clicked. We use this to tell you about new work, releases and events, and to understand what's worth sending. We rely on your consent - or, if you've bought from us before and we're writing about similar pieces, on the "soft opt-in" allowed under the Privacy and Electronic Communications Regulations. Every email has an unsubscribe link, and you can opt out at any time without affecting anything you've ordered.

• When you visit the site, we collect your IP address, device and browser type, the pages you look at and where you arrived from. Some of this involves cookies - our Cookie Policy sets out the detail and lets you change your choices.

• When you contact us, we keep your message and our reply, along with your name and email address, so we can help you and pick up the thread if you write again. Our legal basis here is our legitimate interest in running the shop and answering people properly.

• We also use information to spot and prevent fraudulent transactions, which is another legitimate interest. Where we rely on legitimate interests, we've considered whether our interests are outweighed by your rights, and you can ask us for the detail.

We do not sell your information, and we do not use it to make automated decisions about you.

who else sees it

Our website and shop run on Squarespace. Card payments and Mail Club billing are handled by Squarespace Payments, which processes payments through Stripe, Inc. Our mailing list is hosted by Mailchimp (The Rocket Science Group LLC, part of Intuit). Your order is delivered by Royal Mail.

Each of these acts on our instructions under a data processing agreement. We may also share information where the law requires it, or to establish or defend a legal claim.

information sent outside the UK

Some of these providers are based in the United States, so your information may travel there.

Mailchimp and Stripe are certified under the UK Extension to the EU–U.S. Data Privacy Framework, which the UK government has approved as offering an adequate level of protection. Where a transfer isn't covered by that, we rely on the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses. Ask us if you'd like more detail about a particular transfer.

how long we keep it

• Order and subscription records are kept for six years from the 31 January filing deadline for the tax year they relate to, so we can meet HMRC requirements. That includes Mail Club records once a subscription ends.

• Mailing list data stays with us until you unsubscribe. We look through inactive subscribers after two years and remove anyone who hasn't engaged.

• Unsubscribe records we keep indefinitely, so that we don't accidentally email you again.

• Messages and enquiries are kept for two years after our last exchange, unless they relate to an order.

• Website analytics is kept for the periods set out in our Cookie Policy.

your rights

You can ask us to give you a copy of the information we hold about you, correct anything that's wrong, delete it where we no longer need it, restrict what we do with it while a concern is sorted out, or send it to you or another provider in a portable format. You can object to us using information for our legitimate interests, and you can object to direct marketing at any time - that one is absolute, and we'll always act on it. Where we rely on your consent, you can withdraw it whenever you like.

Email support@fullerwells.com and we'll respond within a month. There's no charge, though we may ask you to confirm who you are first.

complaints

If you're unhappy with how we've handled your information, please tell us first at support@fullerwells.com. We'll acknowledge it within 30 days and do our best to put it right.

You can also complain to the Information Commissioner's Office at any time:

• Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

• Helpline: 0303 123 1113

• Website: ico.org.uk/make-a-complaint

security

We use providers that maintain appropriate technical and organisational security measures, including encryption in transit and access controls on our accounts. No system is completely secure, but we take reasonable steps to protect your information, and if a breach happens that's likely to affect your rights we'll tell you and the ICO as required.

children

The shop is intended for adults, and we don't knowingly collect information from anyone under 18. If you think a child has given us their information, contact us and we'll delete it.

changes

We update this policy from time to time. The date at the top shows the last revision, and if a change is significant we'll let mailing list subscribers know by email.