Privacy Policy

1. Introduction and company information

This Privacy Policy explains how Hearth & Wick Atelier collects, uses, stores, shares, and protects personal data when you visit our website, place an order, contact us, or otherwise interact with us. We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), and other applicable UK data protection laws.

The data controller responsible for your personal data is:

Hearth & Wick Atelier
14 King Street, London, SW1A 2AA, UK
Email: [email protected]
Phone: +44 20 7946 8372

This policy applies to personal data collected in connection with our candle business, including online sales, customer service, marketing communications, and website use.

2. Data collection and processing

We may collect and process the following categories of personal data:

• Identity data: name, title, and account or profile details.
• Contact data: billing address, delivery address, email address, and telephone number.
• Transaction data: details of purchases, order history, payment status, refunds, and returns.
• Payment data: payment method details and limited payment-related information. We do not usually store full card details; these are typically processed by our payment service providers.
• Communication data: messages sent to us by email, contact forms, social media, or customer support.
• Technical data: IP address, browser type, device identifiers, operating system, and website usage information.
• Usage data: pages visited, products viewed, time spent on pages, and interaction with our website.
• Marketing data: preferences for receiving marketing from us and our third parties, and your communication preferences.

We collect personal data directly from you when you place an order, create an account, subscribe to marketing, contact us, or otherwise interact with us. We may also collect data automatically through cookies and similar technologies, and from third parties such as payment processors, delivery providers, analytics providers, and fraud prevention services.

We do not intentionally collect special category data unless you voluntarily provide it to us, and we ask that you do not share sensitive information unless it is necessary for a specific request.

3. Purpose of data processing

We use personal data for the following purposes:

• to process and fulfil orders for candles and related products;
• to arrange payment, delivery, returns, and refunds;
• to manage customer accounts and provide customer support;
• to communicate with you about your order, enquiries, or complaints;
• to send service messages and administrative notices;
• to provide marketing communications where permitted by law and where you have consented or otherwise opted in where required;
• to improve our website, products, services, and customer experience;
• to monitor website performance, usage, and security;
• to detect and prevent fraud, misuse, and other unlawful activity;
• to comply with legal and regulatory obligations, including tax, accounting, and consumer law requirements.

Where relevant, we may also use data to personalise product recommendations or promotions based on your browsing or purchase history, subject to applicable law and your preferences.

4. Legal basis for processing

We only process personal data where we have a lawful basis under UK GDPR. Depending on the context, our legal bases include:

• Contract: where processing is necessary to enter into or perform a contract with you, such as fulfilling an order or managing your account.
• Legal obligation: where processing is necessary to comply with legal obligations, such as tax, accounting, product safety, or consumer protection requirements.
• Legitimate interests: where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This may include fraud prevention, website security, business administration, service improvement, and limited direct marketing to existing customers where permitted.
• Consent: where you have given clear consent, for example for certain marketing communications or non-essential cookies where required.

Where we rely on legitimate interests, we carry out a balancing test to ensure that our interests do not unfairly impact your rights.

5. Data sharing and third parties

We may share personal data with trusted third parties where necessary for the purposes described in this policy. These may include:

• Payment service providers to process card and online payments securely;
• Delivery and logistics providers to deliver orders and manage returns;
• Website hosting, IT, and security providers to operate and protect our systems;
• Analytics and advertising providers to help us understand website usage and improve marketing, where permitted;
• Email and customer communication providers to send order updates and marketing communications;
• Professional advisers such as accountants, insurers, legal advisers, and auditors;
• Regulatory, law enforcement, or public authorities where required by law or necessary to protect our rights.

We require third parties to process personal data only in accordance with our instructions and applicable data protection law, and to implement appropriate security measures.

We do not sell your personal data.

6. Data transfer to third countries

Some of our third-party service providers may be located outside the United Kingdom. Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place to protect your data, such as:

• the UK adequacy regulations for the destination country;
• the UK International Data Transfer Agreement (IDTA);
• the UK Addendum to the EU Standard Contractual Clauses; or
• other lawful transfer mechanisms permitted under UK data protection law.

Where required, we assess the level of protection offered by the receiving country and implement supplementary measures where appropriate.

7. Storage duration

We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, tax, and reporting requirements.

• Order and transaction records: typically retained for up to 6 years after the end of the relevant financial year, to meet legal and tax obligations.
• Customer service correspondence: retained for as long as needed to resolve the matter and for a reasonable period thereafter.
• Marketing data: retained until you unsubscribe, withdraw consent, or object, or until it is no longer needed.
• Website analytics and technical data: retained for a limited period in line with our internal retention practices and provider settings.

When personal data is no longer required, we will delete it or anonymise it securely.

8. User rights

Under UK data protection law, you have the following rights in relation to your personal data, subject to certain conditions and exemptions:

• Right of access: you may request confirmation of whether we process your personal data and obtain a copy of it.
• Right to rectification: you may request correction of inaccurate or incomplete personal data.
• Right to erasure: you may request deletion of your personal data where there is no lawful reason for us to continue processing it.
• Right to restriction: you may request that we limit the processing of your personal data in certain circumstances.
• Right to data portability: you may request a copy of certain personal data in a structured, commonly used, machine-readable format and ask us to transfer it to another controller where technically feasible.
• Right to object: you may object to processing based on legitimate interests and to direct marketing at any time.

To exercise any of these rights, please contact us using the details in the Contact Information section. We may need to verify your identity before responding. We aim to respond within one month, though this may be extended where requests are complex or numerous.

9. Withdrawal of consent

Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing carried out before withdrawal.

You can withdraw consent by:

• using the unsubscribe link in marketing emails;
• adjusting your cookie or privacy settings where available;
• contacting us directly using the details below.

If you withdraw consent, we may still be able to process your data where another lawful basis applies.

10. Right to complain

If you have concerns about how we handle your personal data, please contact us first so we can try to resolve the issue.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO):

Information Commissioner’s Office (ICO)
Website: https://ico.org.uk/
Telephone: 0303 123 1113

We would appreciate the chance to address your concerns before you contact the ICO.

11. Data security

We use appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction. These measures may include:

• access controls and role-based permissions;
• secure hosting and encrypted connections where appropriate;
• regular software updates and security monitoring;
• data minimisation and retention controls;
• staff awareness and confidentiality obligations;
• procedures for responding to suspected data breaches.

While we take reasonable steps to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

12. Contact information

If you have any questions about this Privacy Policy or our data practices, or if you wish to exercise your rights, please contact:

Hearth & Wick Atelier
14 King Street, London, SW1A 2AA, UK
Email: [email protected]
Phone: +44 20 7946 8372

13. Changes to privacy policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Any updates will be posted on this page with a revised effective date where appropriate.

We encourage you to review this Privacy Policy periodically to stay informed about how Hearth & Wick Atelier protects your personal data.