Privacy policy

Information used to run the store

We use information you provide, such as your name, email address, delivery and billing details, account information, order references and messages to customer care. Order records include purchased items, totals, payment references and order status.

Website and service-provider systems may also process technical information needed to deliver and protect the service. Our own page-view counter records public page paths and referring website domains, rather than customer identifiers. It omits account, authentication and checkout pages and honours Do Not Track and Global Privacy Control signals.

Why your information is used

The following are the intended purposes and lawful bases for this store, subject to confirmation in the final notice:

• Contract: taking steps you request before a purchase, processing orders, arranging delivery and dealing with order-related support.
• Legal obligation: keeping required transaction records and dealing with applicable legal duties.
• Legitimate interests: proportionate fraud prevention, service security, troubleshooting and customer-care administration, where these interests do not override your rights.
• Consent: marketing messages where you have chosen to receive them. You can withdraw marketing consent without affecting an order or the lawfulness of earlier consent-based processing.

Payments and service providers

Supabase supports account authentication and store data, and Vercel hosts the website. Airwallex processes payments; its own privacy information also applies to its payment services. Delivery partners and customer-care providers receive the information necessary for the services they perform.

Our store database does not collect or store full payment-card numbers or card security codes. These are entered through the payment provider. Information may also be disclosed where required by law or necessary to address a legal claim.

Cookies, basket storage and analytics

Account authentication and checkout use necessary cookies to maintain sessions. The checkout-session cookie is set for up to seven days. Your basket is saved in your browser’s local storage so it can remain available between visits; you can remove it by clearing your basket or browser storage.

The store’s own page-view counter does not set analytics cookies or customer identifiers. Where Google Analytics is enabled, it loads only if you accept analytics through Privacy preferences. Google processes website usage information and uses analytics cookies, including _ga, to distinguish browsers. Analytics cookies and your saved consent choice have a six-month duration. You can decline or withdraw analytics consent through Privacy preferences at any time.

Our Google Analytics integration measures public page views, excludes account, admin, checkout and order pages, and omits URL query strings and fragments. We do not enable advertising personalisation or Google Signals in this integration. Google Analytics processes information on Google’s infrastructure; information about Google’s processing is available at policies.google.com/privacy. Withdrawal stops further collection by this integration; it does not erase information already collected.

How long information is kept

Retention is assessed by reference to why a record is needed: fulfilling an order, maintaining an account, responding to support, meeting record-keeping obligations or resolving a dispute. Records should not be kept longer than necessary for those purposes.

Deleting an account does not necessarily remove order or other records that must be retained for a legal obligation or legal claim.

Processing outside the UK

Service-provider arrangements may involve processing personal information outside the UK.

Your privacy rights

Depending on the circumstances and lawful basis, you may request access, correction, deletion, restriction or portability of your personal information. You may also object to certain processing and withdraw consent where consent is relied upon. Some rights are subject to legal exceptions.

You have the right to object to processing based on legitimate interests, including related profiling, on grounds relating to your particular situation. You can object to direct marketing at any time.

Email info@roselume.co.uk to make a request or raise a privacy concern. We may need information to verify your identity before responding. You may also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint.