Privacy Notice

Contact details

Email: hello@needleandfern.co.uk

We are the controller of your personal data.

What information we collect, use, and why

To provide goods or services

• Purchase and transaction records, collected via our till system, Square, when you buy something from us in store, or online if we introduce online sales.

To prevent, detect, investigate or prosecute crime

• Video and CCTV recordings of public areas, including indoor and outdoor spaces.

For service updates or marketing purposes

• When you subscribe to our newsletter via our website, we collect your first name and email address.
• We use a double opt-in process. After signing up, we’ll send you a confirmation email. You’ll only be added to our mailing list once you’ve confirmed your subscription.
• Our website uses Google reCAPTCHA to help prevent spam and abuse. Your use of reCAPTCHA is subject to Google’s Privacy Policy and Terms of Service.
• Our website uses essential cookies required for the website to function correctly. We may also use cookies provided by trusted third-party services such as Google reCAPTCHA.
• Marketing preferences.

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. Which lawful basis we rely on may affect your data protection rights, set out briefly below:

• Right of access — ask us for copies of your personal information.
• Right to rectification — ask us to correct or delete inaccurate or incomplete information.
• Right to erasure — ask us to delete your personal information.
• Right to restriction of processing — ask us to limit how we use your information.
• Right to object to processing — object to certain uses of your data.
• Right to data portability — ask us to transfer your data to another organisation, or to you.
• Right to withdraw consent — where we rely on consent, you can withdraw it at any time.

If you make a request, we must respond without undue delay and within one month. To make a data protection rights request, contact us at the email address above.

Our lawful bases

Purchase and transaction records — Contract: we need this information to complete a purchase you’ve asked us to fulfil, and to meet our legal obligations to HMRC and under the Companies Act.

CCTV, for crime prevention — Legitimate interests: it’s in our legitimate interest, and that of our staff and customers, to protect the shop, staff, and stock from crime. Because this relies on legitimate interests rather than consent, the right to object applies but the right to erasure and portability may be limited where footage is needed for a genuine security purpose.

Marketing and newsletter sign-ups — Consent: we only send marketing emails to people who’ve actively signed up, and you can withdraw that consent at any time by unsubscribing.

Where we get personal information from

• Directly from you, in store or via our website.
• CCTV footage or other recordings.

How long we keep information

We keep personal information only for as long as necessary for the purpose it was collected.

• Newsletter sign-ups: we keep your email address for as long as you remain subscribed. If you unsubscribe, we delete it within 30 days. If you never open or engage with our emails for 24 months, we’ll remove you from the list.
• Purchase and transaction records: held via our till system, Square, and kept for 6 years after the end of the relevant tax year, in line with HMRC and Companies Act record-keeping requirements.
• CCTV footage: retained for 30 days, then automatically overwritten, unless needed for an ongoing investigation.

For more information on how long we store your personal information, or the criteria we use to determine this, please contact us using the details above.

Who we share information with

We share personal information with the following organisations, who process it on our behalf or as required by law:

• Square — our payment processing and till (EPOS) system.
• MailerLite — our email marketing platform, used to manage newsletter subscriptions and send marketing emails.
• Hostinger — our website hosting provider.
• Insurance companies — where needed to support a claim.
• Emergency services — where needed for safety or crime prevention.

How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us directly:

Email: hello@needleandfern.co.uk

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

Helpline: 0303 123 1113

Website: ico.org.uk/make-a-complaint