Privacy Policy

Grace Windsor ("we", "us", "our") operates this shop and website, including all related information, content, features, tools, products and services (the "Services"). This Privacy Policy describes how we collect, use and share personal data when you visit, use, shop on, or otherwise communicate with us through our Services.

Where there is a conflict between our Terms of Service and this Privacy Policy regarding data collection and sharing, this Privacy Policy takes precedence.

1. Data Controller

The data controller is Grace Windsor, under the UK GDPR and the Data Protection Act 2018.

Contact: info@gracewindsor.uk

2. Personal Data We Process

We process the following categories of personal data:

  • Contact details: name, address, billing and shipping address, phone number and email address.
  • Payment details: payment method, transaction details and payment confirmations. Full card or bank details are handled by our payment providers only.
  • Account details: username, password, settings and preferences.
  • Order details: items viewed, basket contents, purchases, returns, exchanges and cancellations.
  • Communication data: the content of messages you send to our support team.
  • Device data: device information, browser data, network information, IP address and identifiers.
  • Usage data: information about how and when you use and navigate our Services.

3. Source of Data

We obtain personal data from:

  • you directly, when you create an account, use our Services or contact us;
  • our Services automatically, through your device and cookies or similar technologies;
  • service providers that process data on our behalf; and
  • partners or other third parties.

Providing the Services: we use your data to fulfil orders, process payments, arrange delivery, handle returns, exchanges and cancellations, and manage your account. Legal basis: Article 6(1)(b) UK GDPR (performance of a contract).

Marketing and advertising: we use your data to send newsletters and promotional content, and to show advertisements on our Services or other websites. Legal basis: Article 6(1)(a) UK GDPR (consent). Marketing emails and SMS are only sent with your prior consent.

Security and fraud prevention: we use your data to authenticate accounts, secure payments, and detect and prevent potentially fraudulent or unlawful activity. Legal basis: Article 6(1)(f) UK GDPR (legitimate interests).

Communicating with you: we use your data to handle support enquiries and maintain our business relationship with you. Legal basis: Article 6(1)(b) and 6(1)(f) UK GDPR.

Legal obligations: we use your data to comply with commercial, tax and other legal requirements and to respond to requests from public authorities. Legal basis: Article 6(1)(c) UK GDPR.

5. Recipients and Data Processors

We share personal data with:

  • service providers that perform services for us, including shop hosting, IT operations, payment processing, data analytics, customer service, cloud storage, warehousing and shipping;
  • advertising and marketing partners, who process data under their own privacy notices;
  • third parties where you instruct us or consent, for example through social media widgets or login integrations;
  • affiliated companies within our corporate group; and
  • third parties in connection with corporate transactions, legal compliance and the enforcement of our rights.

6. Services We Use

Shopify: our Services are hosted by Shopify, which collects and processes personal data relating to your access to the Services in order to provide and improve them. Data you submit through the Services is transferred to Shopify and third parties, potentially outside the United Kingdom. For more information, see Shopify's Consumer Privacy Policy.

Shopify Payments: card payments are processed by Shopify Payments. Your full card details are processed exclusively by Shopify Payments and not by Grace Windsor.

Strictly necessary cookies required for the shop to function are set on the basis of our legitimate interest in operating the site. All other cookies, in particular for analytics and marketing, require your consent under PECR and Article 6(1)(a) UK GDPR. You can withdraw your consent at any time through the cookie settings on our website.

8. Newsletter

Newsletter signup uses a double opt-in: you will receive a confirmation email after signing up. The legal basis is your consent under Article 6(1)(a) UK GDPR. You can unsubscribe at any time using the unsubscribe link in our emails.

9. Contacting Us

When you contact us by contact form or email, we process your details to handle your enquiry. The legal basis is Article 6(1)(b) UK GDPR for contract-related enquiries and Article 6(1)(f) UK GDPR otherwise.

Our Services may contain links to third-party websites or platforms. Please review their privacy notices and terms of use. Grace Windsor is not responsible for the privacy practices or security of these websites.

11. Children's Data

Our Services are not directed at children. We do not knowingly collect personal data from children under 16. If you are the parent or guardian of a child who has provided us with personal data, please contact us so that we can delete it.

12. International Data Transfers

Your personal data may be transferred to, processed and stored outside the United Kingdom. Where this happens, we rely on appropriate safeguards under the UK GDPR, such as the UK International Data Transfer Agreement (IDTA), the Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-U.S. Data Privacy Framework.

13. Security and Retention Period

13.1 No security measure is completely fail-safe. We recommend that you avoid sending confidential or sensitive information over unsecured channels.

13.2 We keep personal data for the following periods:

  • Order and transaction data: 6 years, to meet accounting and tax record-keeping obligations under UK law, including HMRC requirements.
  • Account data: for as long as your account is active, and up to 2 years after your last activity.
  • Newsletter and marketing data: until you unsubscribe or withdraw your consent.
  • Customer service data: up to 3 years after your last enquiry.

14. Your Rights

Under the UK GDPR, you have the following rights:

  • Right of access (Article 15): to request information about the personal data we process about you.
  • Right to rectification (Article 16): to request correction of inaccurate data.
  • Right to erasure (Article 17): to request deletion of your data, where no legal retention obligation prevents it.
  • Right to restriction of processing (Article 18): to request that we restrict how we process your data.
  • Right to data portability (Article 20): to receive your data in a structured, commonly used, machine-readable format, or to have it transmitted to a third party.
  • Right to object (Article 21): to object to processing based on legitimate interests, and to object to direct marketing at any time without giving a reason.
  • Right to withdraw consent (Article 7(3)): to withdraw any consent you have given at any time, with effect for the future. This does not affect the lawfulness of processing carried out before withdrawal.

To exercise your rights, email info@gracewindsor.uk. We will respond within the legally required timeframes. We may need to verify your identity. You will not suffer any disadvantage for exercising your rights.

15. Right to Complain to a Supervisory Authority

If you believe that our processing of your personal data violates the UK GDPR, you can lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect operational or legal changes. The current version is always available on our website, with an updated "last updated" date.

17. Contact

If you have questions about this Privacy Policy or how we handle your personal data, please contact us at info@gracewindsor.uk.

Customer service hours: Monday to Friday, 9:00am to 5:00pm (UK time)

© 2026 Grace Windsor