This policy explains what personal information DidiCollective collects when you visit this site or place an order, why we collect it, who we share it with, and what rights you have over it. We are the data controller for that information.
How to contact us
Email [email protected] and a person will answer.
To confirm: the proprietor’s name and a service address. DidiCollective trades as a sole trader, so there is no company number, but a sole trader using a business name must disclose the individual’s name and an address where documents can be served. The address must not be the owner’s home. A virtual office or service address, around £30–60 a year and usually with mail forwarding, satisfies the requirement without publishing where the owner lives.
What we collect, and why
When you place an order we collect your name, delivery and billing address, email address and, if you give one, a phone number. We need this to take payment, send you the goods and account for the sale. The lawful basis is performance of a contract with you.
We never see or store your card details. Card payments are handled entirely by Stripe, and PayPal payments by PayPal. Your card number is entered directly into their systems and is never sent to this website or stored on our server. We receive only the result of the payment and the last four digits.
If you join our mailing list we store your email address until you unsubscribe. The lawful basis is your consent, which you can withdraw at any time using the unsubscribe link in any email we send.
Our server keeps standard technical logs (IP address, browser type, pages requested) to keep the site working and to detect fraud and abuse. The lawful basis is our legitimate interest in running a secure shop.
Who we share it with
We do not sell your personal information, and we never will. We share it only with the companies that make an order possible:
- Stripe and PayPal, which take and, where necessary, refund payment, and to check for fraud.
- Couriers, which receive your name, delivery address and, where the courier requires it, your phone number or email so they can arrange delivery.
- Brevo, which sends order confirmations and, if you have opted in, our newsletter.
- Our hosting provider and Cloudflare, which store and serve the site and its database on our behalf.
- HMRC, and our accountant, where the law requires us to keep and produce records of a sale.
Some of these companies process data outside the UK. Where they do, the transfer is covered by the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.
How long we keep it
We keep order records for six years after the end of the financial year they fall in, because UK tax law requires it. Mailing list entries are kept until you unsubscribe. Technical logs are kept for a short period and then discarded.
Your rights
Under UK data protection law you have the right to ask us for a copy of the information we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable format. Email us and we will respond within one month.
We cannot delete information we are legally required to keep, such as the record of a completed sale, but we will tell you when that applies and why.
If you think we have handled your information badly, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.
Cookies
Cookies we have to set. A few keep the shop working: the items in your basket, the fact you are signed in, and carrying your order safely through checkout. These cannot be switched off without breaking the shop, and they are not used to track you anywhere else.
Cookies you choose. We use Google Analytics to see which pieces people look at and where visitors arrive from. It sets cookies named _ga and _ga_<id>, which last up to two years and tell us how the site is used rather than who you are. IP addresses are anonymised, and we have switched off Google’s advertising and personalisation features.
Nothing analytical loads until you say yes. We ask on your first visit, refusing is one click and exactly as easy as accepting, and if you refuse the Google script is never requested at all. To change your mind later, use the Cookies link at the bottom of any page. We ask again after six months.
To confirm: paste the GA4 measurement id at Settings → General → Google Analytics ID. Until it is set, no analytics runs and no cookie banner appears; setting it turns both on together.