Privacy policy

Last updated: 8 October 2025

Who we are: Westhaven ("we", "us", "our") operates the online store at westhaven.uk.
Contact: support@westhaven.uk

This Privacy Policy explains how we collect, use, share and protect your personal information when you shop with us or otherwise interact with Westhaven. We comply with the UK GDPR and the Data Protection Act 2018. If you are located in the EEA, the EU GDPR may also apply.

1) The controller

Westhaven is the data controller for data processed via westhaven.uk and related channels (email, customer support, social media messages). If you have questions, email support@westhaven.uk.

If you are required to provide a postal address for privacy requests, add it here:
Address (optional to publish): [Your registered business address]

2) What we collect

We collect the minimum data needed to run our store, for example:

  • Identity & contact — name, email, phone, billing and shipping addresses.

  • Order & payment — items purchased, order value, chosen payment method, partial card details/token from the payment provider (we do not store full card numbers).

  • Account data (if you create one) — password (hashed), order history, saved addresses.

  • Support & communications — messages you send us, reviews you leave.

  • Device & usage — IP address, device identifiers, browser type, pages visited, cookies/SDK data.

  • Marketing preferences — your choices for email/SMS/ads cookies.

  • Fraud prevention — signals from anti‑fraud tools and chargeback information.

We collect information you provide, automatically via cookies/SDKs, and from service providers (e.g., payment processors confirming a transaction).

3) Why we use your data (lawful bases)

We process personal data only when we have a legal basis:

  • Contract — to take payment, fulfil and deliver your order, provide customer service, manage returns/warranties.

  • Legal obligation — to keep tax and accounting records; to handle statutory consumer rights.

  • Legitimate interests — to run and improve our website, prevent fraud, keep our services secure, and show limited non‑intrusive marketing to existing customers. We balance these interests against your rights.

  • Consent — for optional activities like email/SMS marketing to non‑customers or the use of non‑essential cookies/advertising cookies. You can withdraw consent at any time.

We do not use your data for fully automated decisions that have legal or similarly significant effects. Fraud checks may use automated scoring to keep transactions safe; you can request a human review.

4) Cookies & similar tech

We use cookies and similar technologies to:

  • keep the site secure and functional (strictly necessary),

  • remember your basket and preferences (functional),

  • measure performance (analytics),

  • show relevant offers (advertising, only with consent where required).

You can manage cookie choices via our cookie banner and your browser settings. Blocking some cookies may affect site functionality.

Tip for your team: if you use Shopify’s Customer Privacy/Consent tools or a CMP, link the cookie banner to this policy.

5) Sharing your data

We share data only with trusted service providers acting under contract and only for the purposes described above, for example:

  • E‑commerce platform & hosting: Shopify (store operation, checkout security).

  • Payments: your chosen payment provider(s) (e.g., Shopify Payments/Stripe, PayPal, Apple Pay/Google Pay).

  • Delivery & returns: postal/courier partners to deliver your order and process returns.

  • Customer support & communications: email/SMS providers, helpdesk tools.

  • Analytics & marketing: analytics platforms, ad platforms and affiliates (only where cookies/consent permit).

  • Fraud prevention & security: anti‑fraud and security tools.

  • Professional services: accountants, auditors, legal advisors where necessary.

We do not sell your personal data. If required by law (e.g., to a regulator or court), we may disclose data when legally compelled.

6) International transfers

Some providers process data outside the UK (for example, in the EU, US or other countries). When we transfer data internationally, we use appropriate safeguards such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or rely on an adequate decision where applicable. You can contact us for copies of the relevant safeguards.

7) How long we keep data (retention)

We keep personal data only as long as needed for the purpose collected, including to comply with legal, accounting or reporting requirements. Typical periods:

  • Orders & invoices: 6 years (tax/accounting).

  • Customer accounts: as long as the account is active; we delete or anonymise on request.

  • Support tickets & emails: up to 2 years after last contact.

  • Marketing consents & opt‑outs: as long as necessary to honour your choices.

  • Analytics data: per tool’s settings, generally 14–26 months.

8) Your rights

Under the UK GDPR you have the right to access, rectify or erase your data, to restrict or object to certain processing, and to data portability. Where we rely on consent, you may withdraw it at any time (this won’t affect processing that already happened). You also have the right not to be subject to a decision based solely on automated processing where it produces legal or similarly significant effects.

To exercise your rights, email support@westhaven.uk. We may need to verify your identity. We aim to respond within one month.

If you’re not satisfied, you can complain to the UK regulator: the Information Commissioner’s Office (ICO) at ico.org.uk or +44 303 123 1113.

9) Marketing

  • Email/SMS: We send marketing only with your consent (or to existing customers within PECR rules). You can unsubscribe at any time via the link in our messages or by emailing us.

  • Ads & profiling: We may use cookies to understand performance and reach people likely to be interested in Westhaven. Advertising cookies only run with consent where required.

10) Children’s privacy

Our site is not directed to children, and we do not knowingly collect data from anyone under 13. If you believe a child has provided personal data, contact us to delete it.

11) Security

We use technical and organisational measures appropriate to the risks (TLS encryption, access controls, minimisation). No method is 100% secure; please keep your account credentials safe and contact us immediately if you suspect misuse.

12) Changes to this policy

We may update this policy from time to time. We’ll post any changes here and adjust the “Last updated” date. If the changes are material, we’ll give a more prominent notice.

13) Short version (for your PDP/footer)

Privacy at Westhaven: we collect only what we need to take payment, fulfil orders and improve our site. We never sell personal data. You’re in control: access/correct/delete your data or opt out of marketing at any time. Questions: support@westhaven.uk.