Strictly Necessary
Required for sessions, CSRF protection, account sign-in, basket continuity, checkout flow, and remembering your cookie preferences.
Privacy
Privacy Policy
This policy explains what personal data Azuronn collects, why we collect it, how long we keep it, and the rights you have over it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
This website is operated by Azuronn Ltd, trading as Azuronn.
| Trading name | Azuronn |
|---|---|
| Registered name | Azuronn Ltd |
| Registered address | 123 Diamond Street, London, United Kingdom |
| Azuronn@example.com | |
| Telephone | 9876543210 |
| Support hours | Monday to Friday, 9am to 6pm (UK time) |
Data controller
Azuronn Ltd is the data controller for the personal data described in this policy. That means we decide what data is collected and why. If you have any question about this policy, or want to exercise any of the rights set out below, email Azuronn@example.com.
What we collect and why
We only collect what we need to run the shop. The table below lists every category of personal data this website holds, the lawful basis we rely on, and how long we keep it.
| What we collect | When | Why | Lawful basis | Retention |
|---|---|---|---|---|
| Name, email address, telephone number, town or city, and a securely hashed password | When you create an account | To identify you, let you sign in, and contact you about your account | Performance of a contract | Until you ask us to close your account |
| Delivery address (address lines, town or city, county, postcode, country) and saved addresses you choose to store | At checkout, or when you add an address in your account | To deliver your order and to prefill future checkouts | Performance of a contract | Order addresses are kept for 6 years (see below); saved addresses until you delete them |
| Order details: items, options, quantities, prices, delivery choice, discount codes, order status, tracking reference, and any delivery or gifting note you write | When you place an order | To fulfil, deliver and support your order, and to handle returns | Performance of a contract, and legal obligation for the accounting record | 6 years from the end of the tax year, as UK tax law requires |
| Return or cancellation requests, including the reason you give | When you request a return or cancellation | To assess and process your request | Legal obligation and performance of a contract | Held with the order record |
| Your wishlist | When you save a product while signed in | To show you the items you saved | Performance of a contract | Until you remove the item or close your account |
| Basket contents and a random basket token stored in a cookie | When you add something to your basket | So your basket survives between visits | Strictly necessary for a service you requested | Up to 12 months from last use |
| Email address for the newsletter, plus the date you subscribed and whether you subscribed as a guest or account holder | When you submit the newsletter form | To send you marketing emails about new pieces and private sales | Consent | Until you withdraw consent |
| Appointment bookings: first and last name, email, mobile number with country code, chosen service, date and time, your notes, and your marketing preferences | When you book a consultation | To confirm and hold your appointment and to prepare for it | Performance of a contract, plus consent for any marketing you opt into | 24 months from the appointment date |
| Technical session data, including a hashed combination of your IP address and browser identifier | Whenever you use the site | To keep your session secure and detect session hijacking | Legitimate interests — securing the website | Deleted when your session ends |
| IP address of failed sign-in attempts to our staff areas | On a failed staff sign-in | To rate-limit and block brute-force attacks | Legitimate interests — securing the website | Cleared once the lockout period expires |
We do not collect special category data (such as health, ethnicity, or religious belief), and we do not carry out profiling or automated decision-making that has a legal or similarly significant effect on you.
Payments — we never see your card
Card payments are handled entirely by Stripe. When you pay, you are taken to Stripe's own secure checkout page and you enter your card details there, on Stripe's systems. Your card number, expiry date and security code are never sent to, processed by, or stored on our servers.
We send Stripe only the order total, a short description of the purchase, your email address, and our internal order reference. Stripe returns a payment reference which we store against your order so we can confirm the payment and issue refunds. Stripe acts as an independent controller for the payment data it collects; see the Stripe Privacy Policy.
Who we share data with
We do not sell your personal data, and we do not share it for anyone else's marketing. We share it only with:
- Stripe Payments Europe, Ltd. — to take payment and process refunds.
- Our delivery partners — the recipient name, delivery address and contact number needed to get your parcel to you.
- Our hosting and database provider — the servers that store this website's data, acting as a processor under contract.
- Professional advisers and authorities — our accountants, and law enforcement or regulators where we are legally required to disclose.
Some pages load fonts and icons from Google Fonts and Cloudflare. When your browser requests those files, your IP address and browser details are visible to those providers. This happens for presentation only; no account or order data is shared with them.
International transfers
Our data is stored on servers within the UK or the European Economic Area wherever possible. Where a provider such as Stripe processes data outside the UK, that transfer is protected by an adequacy decision or by the UK International Data Transfer Agreement or Addendum, together with appropriate technical safeguards.
Marketing and how to opt out
We only send marketing email if you asked us to — by subscribing to the newsletter or by ticking the marketing box when you book an appointment. Consent is never bundled into placing an order.
You can withdraw consent at any time, and it is free. Use the unsubscribe link in any marketing email, or email Azuronn@example.com asking to be removed. We will stop sending marketing promptly. Withdrawing marketing consent does not affect emails we must send about an order you have placed, such as a dispatch or refund confirmation.
Cookies
We use strictly necessary cookies for security, sign-in, your basket, checkout, and to remember your cookie choice. Non-essential cookies stay switched off unless you opt in. The full list of cookies, their purposes and durations is in our Cookie Policy, and you can change your choices at any time using the Cookie Settings button in the footer.
How we protect your data
- Passwords are stored as one-way hashes, never as readable text — not even we can read your password.
- The site is served over HTTPS with security headers and a content security policy.
- Forms are protected against cross-site request forgery, and sessions are bound to a hashed device fingerprint.
- Staff areas are separately authenticated and rate-limited against brute-force attempts.
- Data files are held outside the publicly reachable part of the website.
No system is perfectly secure. If a breach occurs that risks your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours and tell you where we are required to.
How long we keep your data
Retention periods are listed per category in the table above. In summary: order and payment records are kept for 6 years after the end of the relevant tax year because UK tax law requires it; account details are kept until you ask us to close your account; marketing consent records are kept until you withdraw consent. When a retention period ends, data is deleted or irreversibly anonymised.
If you ask us to delete your account, we will remove your profile, saved addresses and wishlist. We must keep the underlying invoice and order records for the statutory 6-year period, so those are retained and restricted from further use rather than erased.
Your rights
Under UK GDPR you have the right to:
- Be informed — which is what this policy is for.
- Access a copy of the personal data we hold about you.
- Rectification — have inaccurate data corrected. You can edit most of it yourself in your account.
- Erasure — ask us to delete your data where we have no overriding legal reason to keep it.
- Restrict processing — ask us to pause how we use your data while a concern is resolved.
- Data portability — receive the data you gave us in a structured, machine-readable format.
- Object — to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent — where we rely on consent, you can withdraw it at any time.
To exercise any right, email Azuronn@example.com. We respond within one month. There is no charge, and we may ask you to confirm your identity first so we do not disclose your data to someone else.
Complaints
If you are unhappy with how we have handled your data, please tell us first at Azuronn@example.com so we can put it right. You also have the right to complain to the UK supervisory authority:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113 ·
ico.org.uk/make-a-complaint
Children
This website is intended for customers aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has given us their data, contact us and we will delete it.
Changes to this policy
We may update this policy as the shop changes or the law changes. The date at the top always shows when it was last revised. If a change materially affects how we use your data, we will make that clear before it takes effect. Related pages: Terms & Conditions, Returns & Refunds (30-day window), and Cookie Policy.