DRAFT — for Emma’s review. This page was put together from WordPress/WooCommerce’s standard suggested privacy-policy text plus the specific apps this shop actually uses, so the checkout links work and something accurate is live straight away. It has not been checked by a solicitor. Please read it through (or have someone qualified check it) and let your developer know if anything needs changing.
Who we are
This is the privacy policy for craftedcharm.co.uk (“Crafted Charm”, “we”, “us”). Crafted Charm is a UK-based small business selling handmade beaded gifts and craft supplies. If you have any questions about this policy or your data, contact us at support@craftedcharm.co.uk.
What personal data we collect and why
Orders
When you place an order we collect information including your name, billing and delivery address, email address, phone number, and details of what you purchased. We use this to fulfil your order, communicate with you about it, and for legal purposes such as accounting and tax. Order information is retained for as long as needed for these purposes, including UK tax and accounting record-keeping requirements.
Accounts
If you create an account, we store the name, address and email information you provide. You can view and update this at any time from your account, or ask us to delete your account.
Payment
We accept payment by card (via WooCommerce Payments, powered by Stripe) and PayPal. We do not see or store your full card details — these are handled directly by our payment providers, who are independently responsible for the security of that data.
If you don’t complete an order
If you add items to your basket and enter your email address but don’t complete checkout, we may email you a reminder about your basket using our abandoned cart tool. You can unsubscribe from these emails at any time.
Fraud prevention
To protect our business and customers from fraudulent orders, order details (such as IP address, billing/delivery address and order value) may be screened by a fraud-prevention service.
Who we share your data with
We share data with trusted third parties only where necessary to run the shop:
- Royal Mail — your name and delivery address, to deliver your order.
- WooCommerce Payments (Stripe) and PayPal — payment details, to process payment.
- Our transactional email provider — your email address, to send order confirmations and account emails.
- A fraud-prevention service — order and address details, to screen for fraudulent orders.
- Google — if you interact with our Google Ads, anonymised/aggregated conversion data is shared with Google for advertising measurement.
We do not sell your personal data to anyone.
Cookies
Like most websites, we use cookies to make the site work (e.g. remembering what’s in your basket) and, if you consent, for advertising measurement (Google Ads). Strictly necessary cookies (for the basket and checkout to function) are set automatically. Non-essential cookies are only set with your consent.
Your rights
Under UK GDPR you have the right to access the personal data we hold about you, ask us to correct or delete it, object to or restrict certain processing, and request a copy of your data in a portable format. To exercise any of these rights, email support@craftedcharm.co.uk. If you’re unhappy with how we’ve handled your data, you can also complain to the UK Information Commissioner’s Office (ico.org.uk).
Other technical notices
Comments
If you leave a comment on the site (e.g. on a blog post) we collect the data shown in the comment form, plus your IP address and browser user agent string to help spam detection. An anonymised string created from your email address (a hash) may be sent to the Gravatar service to check if you use it; the Gravatar privacy policy is at https://automattic.com/privacy/. After a comment is approved, your profile picture is visible publicly next to your comment. Comments and their metadata are retained indefinitely so follow-up comments can be recognised automatically.
Media
If you upload images to the website, avoid uploading images with embedded location data (EXIF GPS) included, as visitors can download and extract this from images on the site.
Embedded content
Pages on this site may include embedded content (e.g. videos). Embedded content behaves as if you visited the other website directly — those sites may collect data about you, use cookies, and monitor your interaction with the embedded content.
Password resets
If you request a password reset for your account, your IP address is included in the reset email.
Changes to this policy
We may update this policy from time to time. The date below shows when it was last changed.
Last updated: 8 August 2026