Privacy Policy

Last updated: 08/08/2026

1. Who we are

This Privacy Policy explains how SJ’s Gift Shop (“we”, “us”, or “our”) collects, uses, stores and protects your personal data when you visit or purchase from www.sjsgiftshop.co.uk, use our services, or otherwise interact with us.

We are the data controller responsible for your personal data.

Business name: SJ’s Gift Shop
Address: Chestnut Cottage, Birchfield Road, Nordelph, Norfolk, PE38 0BP

Email: info@sjsgiftshop.co.uk
 

If you have questions about how we process your personal data, contact us using the details above.

2. The personal data we collect

Depending on how you use our website and services, we may collect the following categories of personal data:

Information you provide to us

This may include:

• your name;
• billing and delivery address;
• email address;
• telephone number;
• account login details;
• order and transaction information;
• information contained in communications with us;
• information you provide when requesting customer support;
• preferences relating to our products and services; and
• any other information you voluntarily provide.

Payment information

When you purchase products or services from us, payment information may be processed by our payment service providers.

Depending on the payment method used, this may include payment card details, transaction identifiers, billing information and other information required to process or verify a payment.

Where possible, we use established third-party payment providers to process payment card information rather than storing full payment card details ourselves.

Third-party payment provider used is Stripe

We do not intend to store complete payment card numbers or security codes on our own systems unless this is specifically necessary and lawful.

Sensitive and special-category data

We may process sensitive personal data, where you provide it to us or where processing is otherwise necessary for the operation of our business.

Special-category personal data receives additional protection under UK data-protection law. We will only process such information where we have a lawful basis and an applicable additional condition under UK GDPR and the Data Protection Act 2018.

Where we do not need sensitive information for a particular purpose, please do not provide it to us.

Information collected automatically

When you use our website, we may automatically collect information such as:

• IP address;
• browser and device information;
• operating system;
• approximate location derived from IP address;
• pages visited;
• products viewed;
• referring website;
• dates and times of visits;
• website interactions; and
• cookie and similar technology information.

3. How we use your personal data

We may use your personal data to:

• create and manage your customer account;
• process and fulfil orders;
• provide physical and digital products;
• process payments;
• arrange delivery of physical products;
• provide access to digital products;
• provide customer service and support;
• communicate with you about your orders;
• send transactional and service-related communications;
• prevent and detect fraud, abuse and other unlawful activity;
• maintain the security of our website and systems;
• improve our products, website and services;
• keep business and financial records;
• comply with legal and regulatory obligations;
• establish, exercise or defend legal claims; and
• send marketing communications where permitted by law and, where required, with your consent.

We will not use your personal data for purposes that are incompatible with the purposes described in this Privacy Policy unless we have a lawful basis to do so.

4. Our lawful bases for processing

Under UK GDPR, we rely on one or more of the following lawful bases:

Contract

We may process personal data where it is necessary to enter into or perform a contract with you, including processing and fulfilling your orders and providing digital products.

Legal obligation

We may process personal data where necessary to comply with a legal obligation, such as accounting, tax, consumer-protection or regulatory requirements.

Legitimate interests

We may process personal data where this is necessary for our legitimate interests, provided that those interests are not overridden by your rights and interests.

This may include:

• operating and improving our business;
• website security;
• fraud prevention;
• maintaining customer records;
• responding to enquiries;
• enforcing our terms; and
• defending legal claims.

Consent

Where required by law, we will ask for your consent before processing your personal data, including for certain forms of electronic marketing and certain cookies or similar technologies.

You may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Special-category data

Where we process special-category personal data, we will also rely on an applicable condition under UK GDPR and the Data Protection Act 2018, as appropriate to the circumstances.

5. Marketing

We may send you information about our products, services, offers and promotions where permitted by applicable law.

Where consent is required, we will ask for your consent before sending marketing communications.

You can unsubscribe from marketing emails at any time by using the unsubscribe link in the relevant communication or by contacting us at info@sjsgiftshop.co.uk

Even if you opt out of marketing, we may continue to send essential service communications, such as order confirmations, delivery updates, security notices and information relating to your purchases.

6. Cookies and similar technologies

Our website uses cookies and similar technologies.

Some cookies are necessary for the operation of the website, including functions such as shopping baskets, account authentication, checkout and security.

Other cookies may be used for purposes such as analytics, personalisation or advertising.

Where required, we will obtain your consent before placing or using non-essential cookies and similar technologies.

 

7. Who we share your personal data with

We may share personal data with trusted third parties where necessary to operate our business and provide our products and services.

These may include:

• payment processors;
• banks and financial institutions;
• delivery and courier companies;
• e-commerce and website hosting providers;
• cloud-storage providers;
• customer-service and communication platforms;
• analytics providers;
• fraud-prevention and security providers;
• accounting and professional advisers;
• legal advisers;
• IT and technical service providers;
• marketing providers, where lawful; and
• regulators, government bodies, courts or law-enforcement authorities where required or permitted by law.

We require service providers processing personal data on our behalf to provide appropriate contractual and security protections.

We do not sell your personal data.

8. International transfers

Some of our service providers may process personal data outside the United Kingdom.

Where personal data is transferred outside the UK, we will take appropriate steps to ensure that the transfer is lawful under applicable UK data-protection law.

Depending on the circumstances, this may include relying on UK adequacy regulations, appropriate safeguards such as the International Data Transfer Agreement or UK Addendum, or another lawful transfer mechanism.

You can contact us using the details in section 1 if you would like further information about relevant international transfers.

9. How long we keep your personal data

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including to satisfy legal, accounting, tax, regulatory and reporting requirements.

Different categories of information may be retained for different periods.

For example:

• order and transaction records may be retained for the period required by tax and accounting laws;
• customer-account information may be retained while your account remains active and for a reasonable period afterwards;
• customer-support correspondence may be retained for as long as necessary to deal with the relevant matter and any resulting claims; and
• marketing information may be retained until you withdraw consent or otherwise opt out, subject to applicable legal requirements.

When personal data is no longer required, we will securely delete it or anonymise it where appropriate.

10. Data security

We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

Security measures may include access controls, authentication, encryption where appropriate, secure hosting, monitoring and staff procedures.

However, no method of transmission or electronic storage can be guaranteed to be completely secure.

If we become aware of a personal-data breach, we will assess and respond to it in accordance with our legal obligations.

11. Your data-protection rights

Subject to applicable legal conditions and exemptions, you may have the right to:

• request access to the personal data we hold about you;
• request correction of inaccurate or incomplete personal data;
• request deletion of your personal data;
• request restriction of processing;
• object to certain processing, including processing based on legitimate interests;
• object to direct marketing;
• request portability of certain personal data;
• withdraw consent where processing is based on consent; and
• complain to the Information Commissioner’s Office.

You can exercise your rights by contacting us at info@sjsgiftshop.co.uk.

We may need to verify your identity before responding to a request.

We normally respond to valid requests within one month, subject to the circumstances and applicable legal extensions.

We will not normally charge a fee for exercising your rights. However, applicable law permits us to charge a reasonable fee or refuse a request where a request is manifestly unfounded or excessive.

12. Complaints

If you have concerns about how we use your personal data, please contact us first at:

info@sjsgiftshop.co.uk

You also have the right to complain to the UK’s data-protection regulator, the Information Commissioner’s Office (ICO).

Information Commissioner’s Office
Website: https://ico.org.uk/

You can find information about making a complaint on the ICO’s website.

13. Children’s privacy

Our website is not intended for children under 18, and we do not knowingly collect personal data from children where doing so would be unlawful.

If you believe that a child has provided us with personal data, please contact us so that we can investigate and take appropriate action.

14. Third-party websites and services

Our website may contain links to websites, applications or services operated by third parties.

We are not responsible for the privacy practices of those third parties. We recommend reviewing their privacy notices before providing them with personal data.

15. Automated decision-making and profiling

We do not currently use your personal data to make decisions based solely on automated processing that produce legal or similarly significant effects on you.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our business, services, technology or legal requirements.

When we make significant changes, we will take reasonable steps to bring them to your attention.

The date at the top of this Privacy Policy indicates when it was most recently updated.

17. Contact us

If you have questions about this Privacy Policy or how we process your personal data, please contact:

SJ’s Gift Shop

Email: info@sjsgiftshop.co.uk
Address: Chestnut Cottage, Birchfield Road, Nordelph, Norfolk, PE38 0BP

Website: www.sjsgiftshop.co.uk