This Privacy Policy describes how Scott and Carolines Store (“we,” “us,” “our”) collects, uses, stores and protects your personal information when you visit, browse or make a purchase from our website https://byadt.com/ (the “Site”). By using the Site, you consent to the collection and use of your information in accordance with this policy, which complies with UK GDPR (Data Protection Act 2018) and all applicable UK data protection laws.
1. Information We Collect
We collect only the minimum personal information necessary to process your orders and provide a seamless shopping experience, with no unnecessary data collection:
- Voluntarily Provided Information: Full name, shipping/billing address, email address, phone number, and payment method details (processed exclusively by secure UK-based third-party payment processors).
- Automatically Collected Information: Non-identifiable technical data including browser type, IP address, pages viewed, time spent on the Site and referral source—used solely to optimize Site functionality and user experience.
- UK GDPR Note: We collect no sensitive personal data (e.g., biometric, health, political) under any circumstances.
2. How We Use Your Information
Your personal information is used exclusively for the following legitimate business purposes (as defined by UK GDPR):
- Process, fulfill and ship your orders; send order confirmations, shipping updates and tracking information (in English, our official brand language).
- Verify payment details and prevent fraudulent transactions, protecting both our brand and our UK and international customers.
- Respond to your customer service inquiries, product questions and support requests within our stated response time.
- Improve our Site, product curation and overall customer experience—using aggregated, non-identifiable data only.
- Comply with applicable UK legal obligations (e.g., HMRC tax reporting, consumer law record-keeping).
We will never use your personal information for unstated purposes without your explicit written consent.
3. Sharing Your Information
We do not sell, rent, lease or trade your personal information to third parties for marketing or advertising purposes—this is a fundamental commitment under UK GDPR.
We may share your information only with trusted third-party service providers who assist us in operating our business, and only to the extent necessary for such purposes (all bound by UK GDPR-compliant data processing agreements):
- Payment processors (e.g., PayPal, Stripe) – to process secure payments; we do not store full credit/debit card details on our servers.
- Shipping/courier carriers (e.g., Royal Mail, Evri, DPD) – to deliver your orders; we share only your name, shipping address and phone number.
- Email service providers – to send order updates; we share only your email address, with clear opt-out options for all non-transactional emails.
We may also disclose your information if required by UK law, court order or government regulation (e.g., HMRC, police), or to protect our legal rights, property or the safety of our customers.
4. Data Security & UK GDPR Rights
We implement industry-standard UK GDPR-compliant security measures to protect your personal information from unauthorized access, use or disclosure:
- SSL (Secure Sockets Layer) encryption for all data transmitted between your browser and the Site.
- Encrypted storage of personal information on secure, firewalled servers located in the UK/EU.
- Compliance with PCI DSS (Payment Card Industry Data Security Standard) for all payment-related processing.
Your UK GDPR Data Rights (exercisable free of charge, in accordance with the Data Protection Act 2018):
- Right to access the personal information we hold about you.
- Right to correction of inaccurate, incomplete or outdated personal information.
- Right to erasure (“right to be forgotten”) of your personal information (where not required to be retained by UK law).
- Right to restrict or object to data processing.
- Right to data portability (receive your data in a machine-readable format).
To exercise these rights, send a written request with proof of identity to service@byadt.com (subject line: UK GDPR Data Request – [Your Full Name]). We will respond to your request within one calendar month (UK GDPR compliance timeline).
5. Cookies & Tracking
We use only necessary, non-tracking cookies to enhance your Site experience (e.g., shopping cart storage, order processing). These cookies are non-identifiable, do not track your activity outside the Site and are not used for marketing purposes.
You may disable non-necessary cookies through your browser settings; however, some core Site features (e.g., checkout, shopping cart) may not function properly as a result. We do not use third-party marketing cookies, ad trackers or pixel tags on the Site.
6. Data Retention
We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, or to comply with UK legal obligations:
- Order information: 6 years (per HMRC tax and record-keeping laws for UK businesses).
- Customer service inquiries: 2 years from the date of the last interaction.
- Non-identifiable/aggregated data: Indefinitely (for Site improvement, no personal identification associated).
Once your personal information is no longer needed, we will securely delete or anonymize it in full compliance with UK GDPR.
7. Changes to This Policy
We may update this Privacy Policy to comply with changes to UK GDPR or other UK data protection laws. All updates will be posted on this page with a revised “Last Updated” date. Your continued use of the Site after the effective date of changes constitutes your acceptance of the modified policy. We will notify registered customers of material changes via email.
8. Contact Us
For questions, concerns or requests regarding this Privacy Policy, your personal information or UK GDPR rights, contact us at:
- Email: service@byadt.com
- Mailing Address: Scott and Carolines Store, Bungalow, Pyrford Primary School, Coldharbour Road, Pyrford, GU22 8SP, United Kingdom