Privacy Policy

Contact details

Email: hello@needleandfern.co.uk

Needle & Fern Ltd is the controller of your personal data.

What information we collect, use, and why

To provide goods or services

• Purchase and transaction records, collected via our till system, Square, when you buy something from us in store, or online if we introduce online sales.

To prevent, detect, investigate or prosecute crime

• Video and CCTV recordings of public areas, including indoor and outdoor spaces.

For service updates or marketing purposes

• When you subscribe to our newsletter via our website, we collect your first name and email address.
• We use a double opt-in process. After signing up, we’ll send you a confirmation email. You’ll only be added to our mailing list once you’ve confirmed your subscription.
• We collect and record your marketing preferences.
• Our newsletter form may use Google reCAPTCHA to help protect the website from spam and abuse. Your use of reCAPTCHA is subject to Google’s Privacy Policy and Terms of Service.

To understand and improve our website

• With your consent, we use Google Analytics to understand how visitors use our website.
• Google Analytics may collect information including the pages you visit, the approximate area from which you access the website, your browser and device type, and how you arrived at the website.
• We use this information to measure website usage and improve the content and experience we provide.
• We do not use Google Analytics to identify you personally.
• Analytics will only be activated after you have accepted analytics cookies.

Cookies and similar technologies

• Our website may use essential cookies and similar technologies that are necessary for security and for features you request.
• With your consent, we also use non-essential analytics cookies provided by Google Analytics. These help us understand how the website is used.
• You can accept or reject analytics cookies through the cookie controls displayed on the website. Rejecting analytics cookies will not prevent you from using the website.

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. Which lawful basis we rely on may affect your data protection rights, set out briefly below:

• Right of access — ask us for copies of your personal information.
• Right to rectification — ask us to correct inaccurate or incomplete personal information.
• Right to erasure — ask us to delete your personal information.
• Right to restriction of processing — ask us to limit how we use your information.
• Right to object to processing — object to certain uses of your data.
• Right to data portability — ask us to transfer your data to another organisation, or to you.
• Right to withdraw consent — where we rely on consent, you can withdraw it at any time.

If you make a request, we must respond without undue delay and within one month. To make a data protection rights request, contact us at the email address above.

Our lawful bases

Purchase and transaction records — Contract: we need this information to complete a purchase you’ve asked us to fulfil, and to meet our legal obligations to HMRC and under the Companies Act.

CCTV, for crime prevention — Legitimate interests: it’s in our legitimate interest, and that of our staff and customers, to protect the shop, staff, and stock from crime. Because this relies on legitimate interests rather than consent, the right to object applies but the right to erasure and portability may be limited where footage is needed for a genuine security purpose.

Marketing and newsletter sign-ups — Consent: we only send marketing emails to people who’ve actively signed up, and you can withdraw that consent at any time by unsubscribing.

Website analytics — Consent: we use Google Analytics only where you have consented to analytics cookies. You may withdraw that consent at any time through our cookie settings.

Where we get personal information from

• Directly from you, in store or via our website.
• CCTV footage or other recordings.

How long we keep information

We keep personal information only for as long as necessary for the purpose it was collected.

• Newsletter sign-ups: we keep your information for as long as you remain subscribed. If you unsubscribe, we stop sending marketing emails and retain only the information necessary to record and respect your unsubscribe request. If you do not open or engage with our emails for 24 months, we may remove you from the active mailing list.
• Purchase and transaction records: held via our till system, Square, and kept for 6 years after the end of the relevant tax year, in line with HMRC and Companies Act record-keeping requirements.
• CCTV footage: retained for 30 days, then automatically overwritten, unless needed for an ongoing investigation.
• Website analytics: analytics information is retained in accordance with the data-retention settings applied to our Google Analytics account. We periodically review these settings and retain the information only for as long as necessary to understand and improve the website.

For more information on how long we store your personal information, or the criteria we use to determine this, please contact us using the details above.

Who we share information with

We share personal information with the following organisations, who process it on our behalf or as required by law:

• Google — provides Google Analytics, which we use with your consent to measure and understand use of our website, and Google reCAPTCHA, which may be used to protect forms from spam and abuse.
• Square — our payment processing and till (EPOS) system.
• MailerLite — our email marketing platform, used to manage newsletter subscriptions and send marketing emails.
• Hostinger — our website hosting provider.
• Insurance companies — where needed to support a claim.
• Emergency services — where needed for safety or crime prevention.

How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us directly:

Email: hello@needleandfern.co.uk

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

Helpline: 0303 123 1113

Website: ico.org.uk/make-a-complaint