Privacy Policy.

Who we are

The Resin Bureau (Finlay Spenceley, trading as The Resin Bureau) is the data controller for personal data collected through resinbureau.org. We're a small, family-run business based at 19 Sandon Street, Nottingham NG7 7AN, United Kingdom. For anything relating to your data, email [email protected].

What we collect

We only collect what we need to take and deliver your order, and to answer you if you get in touch:

• When you order: your name, email address, billing address, shipping address and, if you choose to give it, your phone number, plus what you bought and how much you paid.
• When you contact us: your name, email address, any order number and your message.
• When you browse: if you accept analytics cookies, anonymised usage data (pages visited, device type, rough location) through Google Analytics. See "Cookies" below.

We never see or store your card details. Payments are taken directly by Stripe on their secure checkout page.

Why we use it, and our lawful basis

• To process, ship and support your order, including your order confirmation and dispatch/tracking emails. Lawful basis: performance of a contract.
• To keep accounting and tax records as UK law requires. Lawful basis: legal obligation.
• To reply to your enquiries. Lawful basis: our legitimate interest in helping our customers.
• To understand how the site is used (analytics). Lawful basis: your consent, which you can withdraw at any time.

We don't send marketing emails, we don't sell your data, and we don't use it for profiling or automated decision-making.

Who we share it with

Only the services we need to run the shop, each acting under their own data protection obligations:

• Stripe processes payments and holds your order record. Stripe's privacy policy.
• Royal Mail receives your name and shipping address so they can deliver your parcel.
• Google Workspace hosts our email, so order and support emails pass through it.
• Google Analytics, only if you accept analytics cookies.
• Hetzner (Germany) hosts this website; like any web server it keeps short-lived technical logs.

Some of these providers may process data outside the UK. Where they do, they use legally approved safeguards such as the UK International Data Transfer Addendum or adequacy regulations.

How long we keep it

Order records are kept for six years from the end of the financial year they relate to, because HMRC requires it. Enquiry emails are kept for up to two years, then deleted. Analytics data is retained by Google for 14 months.

Cookies

Your basket is saved in your browser's local storage so it's still there when you come back. That's strictly necessary and never leaves your device until you check out. Google Analytics cookies are only set if you click "Accept" on our cookie banner. You can change your mind at any time using the "Cookie settings" link in the footer.

Your rights

Under UK GDPR you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive a copy in a portable format, and to withdraw consent. Email [email protected] and we'll respond within one month. We may need to keep some order data for tax purposes even if you ask us to delete it.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to put it right first.