Privacy Policy

Who we are

Brambles Glass is a sole trader business owned and operated by Bethan Clarke ("I", "me", "we", "our"). As a sole trader, I am the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact: hello@bramblesglass.com

If you have any questions about this policy or how your data is handled, please email me at the address above.

What personal data I collect

I collect personal data when you place an order through my online shop or submit a bespoke commission enquiry. I only collect what I need to fulfil orders, respond to enquiries, and meet my legal obligations.

Shop orders

  • Name

  • Email address

  • Delivery address (and billing address, if different)

  • Payment details (processed by my payment provider — see "Payment processing" below; I do not store full card numbers)

  • Order history and any notes you add to an order

Commission enquiry form

  • Name

  • Email address

  • Details you provide about the piece you'd like commissioned (e.g. size, colour, budget, inspiration images)

  • Delivery address and payment details, if the enquiry proceeds to an order

Why I collect it and my legal basis

Under UK GDPR (https://www.legislation.gov.uk/eur/2016/679/contents), I must have a lawful basis for processing your data. The table below sets out why I collect each type of data and which basis applies.

  • Fulfilling your order (making, packing and delivering glass art, and dealing with any returns or issues) — necessary to perform our contract with you (Article 6(1)(b)) and, for payment card handling, my legitimate interest in preventing fraud (Article 6(1)(f))

  • Responding to and quoting for bespoke commission enquiries — necessary to take steps at your request before entering into a contract (Article 6(1)(b))

  • Keeping records of sales, invoices and payments for accounting and tax purposes — necessary to comply with a legal obligation (Article 6(1)(c)), including HMRC record-keeping requirements

  • Sending you order confirmations and delivery updates — necessary to perform our contract with you (Article 6(1)(b))

  • Sending marketing emails about new work, collections or commissions — only with your consent (Article 6(1)(a)); you can opt in when ordering or enquiring, and opt out at any time

  • Preventing fraud and resolving disputes — legitimate interest (Article 6(1)(f))

Payment processing

Payments are handled securely through my website provider (Wix or Squarespace) together with a third-party payment processor such as Stripe or PayPal. I do not see or store your full card number, expiry date or CVV — these are collected and processed directly by the payment processor, who acts as an independent data controller for that information and has its own privacy policy. I retain only a record of the transaction (amount, date, order reference and payment status) for accounting purposes.

How long I keep your data

I keep personal data only for as long as necessary for the purposes it was collected, and no longer. In general:

  • Order and transaction records (name, contact and delivery details, and records of payment): retained for 6 years after the end of the relevant tax year, in line with HMRC record-keeping requirements for sole traders

  • Commission enquiries that do not proceed to an order: retained for up to 12 months, then deleted, unless you ask me to keep them for a future enquiry

  • Marketing consent and contact details for marketing emails: retained until you unsubscribe or withdraw consent, at which point I stop sending you marketing emails and update my records accordingly

  • Correspondence (e.g. queries, complaints): retained for up to 2 years after the matter is resolved, unless a longer period is needed to deal with a dispute

After the relevant retention period, personal data is securely deleted or anonymised.

Who I share your data with

I do not sell your personal data to third parties, ever. I only share data with the following categories of recipient, and only where necessary:

  • My website hosting and e-commerce platform (Wix or Squarespace), which stores order and enquiry data on my behalf

  • My payment processor (such as Stripe or PayPal), to process your payment

  • Delivery couriers and postal services, to deliver your order — limited to your name, delivery address and contact details

  • HMRC and my accountant/bookkeeper (if applicable), for tax and accounting purposes

  • Law enforcement or regulators, where I am legally required to disclose information

Any third party who processes data on my behalf does so under a data processing agreement and only in accordance with my instructions.

International transfers

Some of the service providers I use (such as payment processors or hosting platforms) may store or process data outside the UK, including in the United States. Where this happens, I only use providers that offer appropriate safeguards, such as the UK's International Data Transfer Addendum, an adequacy decision, or equivalent standard contractual clauses.

Marketing emails

I only send marketing emails to customers who have opted in, for example by ticking a box at checkout or on the commission enquiry form. Every marketing email includes an unsubscribe link, and you can withdraw consent at any time by clicking that link or emailing me directly. Withdrawing consent does not affect order confirmations or other emails necessary to fulfil an existing order.

Cookies

My website may use essential cookies needed for the shop and checkout to function (e.g. remembering items in your basket), provided by my website platform (Squarespace). If this ever expands to include analytics or marketing cookies, this policy will be updated and, where required, I will ask for your consent via a cookie banner.

Your rights

Under UK GDPR, you have the right to:

  • Access the personal data I hold about you

  • Ask me to correct inaccurate or incomplete data

  • Ask me to delete your data, where there is no legal reason for me to keep it

  • Ask me to restrict or object to certain processing

  • Ask for your data in a portable format, where technically feasible

  • Withdraw consent at any time, where processing is based on consent (e.g. marketing emails)

To exercise any of these rights, email hello@bramblesglass.com. I will respond within one month, as required by law.

If you're unhappy with how I've handled your data, you also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk or by calling 0303 123 1113.

Keeping your data secure

I take reasonable technical and organisational measures to protect your personal data, including using a reputable, secure e-commerce platform and payment processor, and limiting access to your data to what's needed to run the business.

Changes to this policy

I may update this policy from time to time, for example if I change my website platform or payment processor. The "Last updated" date at the top of this page will reflect the most recent version. Please check back periodically.