Who is responsible for your information?

Seed Bomb Shop UK is responsible for deciding how personal information collected through www.seedbombshop.co.uk is used.

For privacy questions or requests, email enquiry@seedbombshop.co.uk.

This policy applies to information collected through our website, online shop, checkout, order administration and direct email enquiries. A third-party website reached through one of our links will operate under its own privacy information.

What information may we collect?

How and why we use personal information

UK data-protection law requires a lawful basis for each use of personal information. The basis depends on the purpose:

How website usage is measured

We use Google Analytics, connected through MonsterInsights, to understand how visitors find and use the website. Depending on your consent choices, analytics information may include online identifiers, device and browser details, approximate location, referral source, pages viewed and interaction events.

We rely on consent for non-essential analytics cookies. You can accept or reject these using the cookie choices presented on the website, and you can also control cookies through your browser settings. Withdrawing consent does not affect processing that took place before withdrawal.

Strictly necessary technologies may be used without consent where permitted by law, including technologies required to remember basket contents, operate checkout, maintain security and provide a service you request.

Google processes analytics information under its own terms. You can read Google's Privacy Policy for further information.

Who may receive personal information?

We share personal information only where it is reasonably necessary for the purposes described in this policy. Recipients may include:

• PayPal and the financial organisations involved in processing a payment;
• postal, courier and fulfilment providers needed to deliver an order;
• website hosting, maintenance, security, email and technical-service providers;
• Google in connection with consented analytics;
• accountants, insurers, legal advisers and other professional advisers where required; and
• public authorities, regulators, courts or law-enforcement bodies where disclosure is required or permitted by law.

Some providers act as processors working on our instructions. Others, including PayPal, may act as independent controllers for aspects of their services and explain their own processing in their privacy notices.

Information processed outside the United Kingdom

Some technology and payment providers may process information in countries outside the United Kingdom. Where UK law treats this as a restricted transfer, appropriate safeguards must be used. These may include UK adequacy regulations, approved contractual safeguards or another lawful transfer mechanism.

You can contact us if you would like more information about the safeguards relevant to personal information we control.

How long do we keep personal information?

We keep personal information only for as long as it is reasonably needed for the purpose for which it was collected, including legal, tax, accounting, warranty, dispute-resolution and fraud-prevention requirements.

• Order and transaction records: retained for the period required by applicable tax, accounting and consumer laws and, where necessary, to establish or defend legal claims.
• Enquiries: retained while the enquiry is active and for a reasonable period afterwards where a record is needed for service, quotation or dispute purposes.
• Analytics information: retained according to the settings applied within Google Analytics and then deleted or aggregated.
• Security logs and backups: retained for appropriate operational cycles and removed or overwritten when no longer required.

We use reasonable organisational and technical safeguards designed to protect personal information against loss, misuse, unauthorised access, alteration or disclosure. No internet service can guarantee absolute security.

Your UK data-protection rights

Depending on the circumstances and the lawful basis being used, you may have the right to:

• ask whether we process your personal information and receive a copy;
• have inaccurate or incomplete information corrected;
• ask for information to be deleted;
• ask us to restrict how information is used;
• object to processing based on legitimate interests or to direct marketing;
• receive certain information in a portable format;
• withdraw consent where processing relies on consent; and
• raise a concern with the Information Commissioner's Office.

These rights are not absolute and exemptions may apply. To make a request, email enquiry@seedbombshop.co.uk. We may ask for information needed to verify your identity and understand the request.

How to raise a privacy concern

Please contact Seed Bomb Shop UK first so that we have an opportunity to consider and respond to your concern.

You also have the right to complain to the Information Commissioner's Office, the UK's independent data-protection regulator.

Changes to this Seed Bomb Shop UK Privacy Policy

We may update this policy when our services, suppliers, technology or legal obligations change. The review date at the top of this page shows when this version was last checked. Material changes will be presented on this page and, where appropriate, communicated by another suitable method.