Legal · GDPR Compliant
Privacy Policy.
Last updated: June 2026
Your privacy is important to us. This policy explains how we collect, use, and protect your data in compliance with GDPR.
01
Data We Collect
We collect information necessary to process your orders and improve your shopping experience.
Order Information: Name, email address, shipping address, and payment details
Account Data: Email and password (encrypted) if you create an account
Usage Data: How you interact with our website to improve our services
Newsletter: Email address if you subscribe to our newsletter (explicit consent required)
02
How We Use Your Data
We use your personal data for the following purposes:
Processing and fulfilling your orders
Sending order confirmations and shipping updates
Providing customer support
Sending marketing emails (only with your explicit consent)
Improving our website and services
03
Cookies
We use cookies to enhance your browsing experience. Non-essential cookies are only loaded after you give consent:
Essential Cookies: Required for the website to function (cart, checkout, authentication). Always active.
Analytics Cookies: Help us understand how visitors use our site (Google Analytics, Microsoft Clarity, Cloudflare Analytics) — loaded only with your consent.
Marketing Cookies: Used to deliver relevant advertisements (Meta Pixel, Klaviyo) — loaded only with your consent.
You can change your cookie preferences at any time using the cookie banner at the bottom of the page. Withdrawing analytics or marketing consent does not affect your ability to shop with us.
04
Your Rights (UK GDPR)
Under the UK GDPR and the Data Protection Act 2018, you have the following rights:
Right to Access (SAR): Request a copy of your personal data — we will respond within one calendar month
Right to Rectification: Request correction of inaccurate or incomplete data
Right to Erasure: Request deletion of your personal data ("right to be forgotten")
Right to Restrict Processing: Ask us to limit how we use your data in certain circumstances
Right to Data Portability: Receive your data in a structured, machine-readable format
Right to Object: Object to processing based on legitimate interests, including direct marketing
Right to Withdraw Consent: Withdraw marketing consent at any time — click "Unsubscribe" in any email, or email us directly
To exercise any right, email info@vinylvault.shop. We will acknowledge within 5 working days and respond fully within one calendar month.
05
Data Retention
We keep your data only for as long as is necessary for the purpose it was collected, and no longer:
Order & Transaction Data: Retained for 7 years to comply with HMRC accounting obligations
Account Profile Data: Retained while your account is active; deleted within 30 days of an account deletion request
Marketing Preferences: Retained until you withdraw consent or unsubscribe
Abandoned Cart Data: Deleted after 30 days if the cart is not recovered
Analytics Data: Google Analytics retains aggregated data for up to 26 months; no individually identifiable data is retained
06
Third-Party Data Processors
We share data only with the processors listed below, who handle it strictly on our behalf under data processing agreements. We do not sell your data.
Stripe: Payment processing (UK/EU). We never store card numbers — all payment data is handled by Stripe, which is PCI DSS Level 1 certified.
Klaviyo: Email marketing (US). Data transfer covered by UK IDTA / Standard Contractual Clauses. Email address and purchase events are shared only with your marketing consent.
Resend: Transactional email (order confirmations, shipping updates). EU-hosted infrastructure.
Supabase: Database and authentication (EU-West-1, Ireland). All customer data at rest is encrypted.
Cloudflare: CDN, DDoS protection, and analytics beacon (US, covered by EU Standard Contractual Clauses). Analytics data is aggregated and privacy-preserving; loaded only with analytics consent.
Royal Mail / EasyPost: Shipping fulfilment. Name and delivery address are shared for order despatch only.
Microsoft Clarity: Session analytics (US, covered by EU Standard Contractual Clauses). No personal identifiers are recorded. Loaded only with analytics consent.
07
Data Security
We implement appropriate technical and organisational measures to protect your personal data:
TLS encryption for all data in transit between your browser and our servers
At-rest encryption for all customer data stored in our database
Payment processing via Stripe — we never see or store card details (PCI DSS SAQ A scope)
Role-based access controls — staff access personal data only on a strict need-to-know basis
Regular security reviews, penetration testing, and dependency audits
08
Supervisory Authority
VinylVault is a UK-based business. Our supervisory authority under the UK GDPR is the Information Commissioner's Office (ICO). You have the right to lodge a complaint with the ICO at any time.
ICO Website: ico.org.uk
ICO Helpline: 0303 123 1113
Lodge a Complaint: ico.org.uk/make-a-complaint
We would always prefer to resolve concerns directly — please contact us at info@vinylvault.shop before raising a complaint with the ICO.
09
Contact Us
If you have any questions about this Privacy Policy, wish to make a Subject Access Request, or want to exercise any of your rights, please contact us. We will acknowledge within 5 working days and respond fully within one calendar month.
Email: info@vinylvault.shop