Privacy Notice & Cookies Policy

Important Information and Who I Am

Data Controller

For the purpose of the UK General Data Protection Regulation (UK GDPR), I, Chetana Bangera, trading as SoapStory, am the data controller and am responsible for your personal data. If you have any questions about this privacy policy or my privacy practices, please contact me using the details below:
1. Trading Name: SoapStory
2. Sole Trader Name: Chetana Bangera
3. Email Address: [email protected]
4. Postal Address: [Your Edinburgh Business/Postal Address, Scotland]
5. ICO Registration Number: [Your ICO Registration Number, or delete this line if you are currently exempt/registering]

The Data I Collect About You

Personal data means any information about an individual from which that person can be identified. I may collect, use, store, and transfer different kinds of personal data about you, which I have grouped together as follows:
1. Identity Data: Includes your first name and last name.
2. Contact Data: Includes your billing address, delivery address, email address, and telephone numbers.
3. Financial Data: Payment card processing details. Please note: I do not store your raw credit or debit card details. All transactions are securely handled by our third-party payment processors [Stripe, PayPal].
4. Transaction Data: Includes details about payments to and from you and other details of products you have purchased from me.
5. Technical Data: Includes your internet protocol (IP) address, browser type and version, time zone setting, operating system, and platform when you browse this website.
6. Marketing and Communications Data: Includes your preferences in receiving marketing from me and your communication preferences.

How I Use Your Personal Data

I will only use your personal data when the law allows me to. Most commonly, I will use your personal data in the following circumstances:
1. Performance of a Contract: Where I need to perform the contract I am about to enter into or have entered into with you (e.g., to process your payment and post your handmade soap order to your address).
2. Consent: Where you have explicitly opted-in to receive my email newsletter or marketing updates. You can withdraw your consent at any time.
3. Legitimate Interests: Where it is necessary for my legitimate business interests (e.g., running my business, preventing fraud, managing website security, and improving my product range), and your interests and fundamental rights do not override those interests.

Who I Share Your Personal Data With

To run my small family business and deliver your soaps, I must share your data with trusted third-party service providers. These include:
1. My website host and e-commerce platform provider ( WooCommerce).
2. Payment gateways to securely process your money. (Stripe,Paypal)
3. Delivery and courier companies (Royal Mail) to ship your soap parcels.
4. Professional advisors, including accountants, if required for tax compliance.
5. IT and system administration services that keep my website running smoothly.
6. I require all third parties to respect the security of your personal data and to treat it in accordance with the law.

International Transfers

Some of my external third-party service providers (such as website hosts or email marketing software providers) may be based outside the UK. Whenever your personal data is transferred out of the UK, I ensure a similar degree of protection is afforded to it by ensuring standard contractual clauses or UK-approved data transfer mechanisms are in place.

Cookies and Tracking Technologies

My website uses cookies to distinguish you from other users. Essential cookies are required for core functionality (e.g., keeping items in your shopping cart). Non-essential cookies (such as analytics or marketing tools) are only set if you give consent via our cookie banner. You can set your browser to refuse all or some browser cookies, but parts of this website may become inaccessible or not function properly.

Data Security

I have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. In addition, I limit access to your personal data to myself and those strictly required to process it for business operations.

Data Retention

I will only retain your personal data for as long as reasonably necessary to fulfil the purposes I collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements.For tax purposes, HM Revenue & Customs (HMRC) requires me to keep basic information about my customers and transactions (including Contact, Identity, Financial, and Transaction Data) for six years after they cease being customers.

Your Legal Rights

Under UK data protection laws, you have the following rights in relation to your personal data:
1. Request access to your personal data (a “data subject access request”).
2. Request correction of the personal data that I hold about you.
3. Request erasure of your personal data (the right to be forgotten), where there is no good legal reason for me to continue processing it.
4. Object to processing of your personal data where I am relying on a legitimate interest.
5. Request restriction of processing of your personal data.
6. Request the transfer of your personal data to you or to a third party.
7. Withdraw consent at any time where I am relying on consent to process your personal data (such as unsubscribing from marketing emails).If you wish to exercise any of these rights, please contact me directly using the contact details provided in Section 1.

Complaints

If you have a concern or complaint regarding how I handle your data, please contact me directly at the email address listed above. I aim to review, investigate, and resolve all internal complaints promptly and without undue delay.You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). I would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact me first