Privacy notice

Last updated: 1 October 2026

This notice explains what personal data we collect when you shop with us, why, and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Who we are

The data controller is NAFF, a sole trader trading as NaffStore, of Saffron Walden, Essex, CB10. Contact us about your data at [email protected] or on 03333 44 2297.

What we collect

When you place an order, checkout is handled by Stripe and we receive:

• your name and delivery address
• your email address and phone number
• what you ordered and what you paid

We never see or store your card details. Stripe handles them directly.

If you email us, we keep the email and our reply so we can help you.

How we use it

• to take payment, make your order and deliver it
• to send you order and delivery updates and answer your questions
• to handle returns, refunds and problems
• to keep the business and tax records the law requires

We do not send marketing emails unless you have opted in, and you can opt out at any time. We never sell your data.

Our lawful basis

We use your data because we need it to perform our contract with you (taking, making and delivering your order). We keep sales records because we have a legal obligation to (tax law).

Who we share it with

We only share what each company needs to do its job for us:

• Stripe takes your payment. See Stripe's privacy policy.
• Our printing and fulfilment partner prints, packs and posts your order and gets your name, delivery address, email address and phone number, which it shares with the courier. Email us if you would like to know who they are.
• Cloudflare hosts this website and keeps standard server logs (such as IP address, browser type and pages requested) for security and to keep the site running. See Cloudflare's privacy policy.

We may also share data where the law requires it, for example with HMRC.

International transfers

Stripe, our printing partner and Cloudflare may process your data outside the UK, including in the EU and the USA. Where they do, they use appropriate safeguards recognised under UK law, such as UK adequacy regulations, the UK International Data Transfer Addendum or standard contractual clauses.

How long we keep it

We keep order and sales records for 6 years from the end of the tax year they relate to, because HMRC requires it. Emails not tied to an order are deleted when no longer needed, usually within 2 years.

Cookies and your cart

We do not use advertising cookies. Your cart is kept in your browser's local storage, on your device only, and is never sent to us until you check out. Your cookie choice is kept the same way. These are needed for the shop to work, so they do not need your consent. You can clear them at any time by clearing your browser data.

If you say yes when we ask, we also count visits with Cloudflare Web Analytics, which does not use cookies or track you across other sites. It tells us things like which pages are popular. If you say no, it does not load. You can change your mind with the "Cookies" link at the bottom of every page.

Stripe's checkout page sets its own cookies needed for payment and fraud prevention.

Your rights

You have the right to:

• access the personal data we hold about you
• have it corrected if it is wrong
• have it deleted, where we do not need to keep it by law
• object to or ask us to restrict how we use it
• get a copy in a portable format (data portability)

To use any of these rights, email [email protected]. We will reply within one month and it is free.

Complaints

If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

Changes

If we change this notice we will update the date at the top.