What we hold, why, and how to make us stop.

That is the list. There is no account to create, no profile built about you, no advertising pixel, and no third-party tracker on this site.

Performance of a contract for everything needed to get you your order. Legal obligation for the order records HMRC requires us to keep. Consent — and only consent — for marketing email.

The checkbox at checkout starts unticked, buying is never conditional on it, and we record the exact sentence you agreed to alongside the date. If we ever reword it, your record keeps the wording you actually saw. You can stop the emails from any message or by replying to one, and stopping them changes nothing about your order.

Transactional email is separate and does not ask permission. Your receipt, your dispatch note and the news that an order was cancelled are part of the thing you bought, so they are sent whether or not you wanted marketing.

The studio that made your piece gets your name and address, because they are the ones posting the parcel. They get nothing else. Beyond that: our payment processor, our email provider, and our hosting provider — each doing one job, none of them selling anything on. We do not sell or share your data for anyone else's marketing.

Order records for six years after the tax year they fall in, because HMRC requires it. Marketing consent records for as long as we might need to evidence the decision, and then destroyed. Nothing kept "just in case".

Your receipt lives at an unguessable web address rather than behind a login. Holding the link is the permission, which is why the link is not a short number and why we do not post it anywhere. Treat it like a ticket: anyone you forward it to can see that order.

You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, object to how we use it, or withdraw consent. Email us and we will do it within one month, usually far sooner. You can also complain to the Information Commissioner's Office at ico.org.uk — you do not have to come to us first, though we would rather you did.

One, and it holds your bag and your sign-in for this visit. It is strictly necessary for the site to work, so there is no banner asking you to accept it — a consent popup for a cookie you cannot decline is theatre. No analytics cookie, no advertising cookie.