Privacy Policy

HeartnThread ("we", "us", or "our") is committed to protecting your privacy. This policy explains how we collect, use, and safeguard your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

HeartnThread is a sole trader business based in the West Midlands, England, providing personalised hand-embroidered knitwear and accessories.

Data controller: HeartnThread
Email: heartnthread@gmail.com
Instagram: @heartnthread

2. What Data We Collect

We may collect the following personal data when you interact with us:

  • Contact information — name, email address, Instagram handle, and any other details you provide when placing an order or sending an enquiry
  • Order details — custom text, colour preferences, sizing information, and delivery address
  • Payment information — processed securely through our third-party payment provider (Stripe). We do not store your full card details
  • Communication records — messages, DMs, and email correspondence
  • Website usage data — pages visited, browser type, and general location (via cookies — see our Cookies Policy)

3. How We Use Your Data

We use your personal data to:

  • Process and fulfil your custom orders
  • Respond to enquiries and provide customer support
  • Send order updates and shipping notifications (via email or Instagram DM)
  • Comply with our legal obligations (e.g., financial record-keeping for HMRC)
  • Improve our website and services based on aggregated usage data

We do not use your data for automated decision-making or profiling.

4. Legal Basis for Processing

We process your data under the following legal bases:

  • Contract performance — processing is necessary to fulfil your order (art. 6(1)(b) UK GDPR)
  • Legitimate interests — maintaining business records, responding to enquiries, and improving our services (art. 6(1)(f) UK GDPR), where our interests are not overridden by your rights
  • Consent — marketing communications (e.g., newsletters), which you can withdraw at any time
  • Legal obligation — financial record-keeping required by law

5. Data Sharing

We do not sell, rent, or trade your personal data. We may share data with trusted third parties only where necessary:

  • Royal Mail / delivery couriers — for shipping your order
  • Stripe — for secure payment processing
  • Google Analytics — for website usage analytics (anonymised data only)
  • Instagram (Meta Platforms, Inc.) — if you contact us via Instagram DM

All third parties are required to process your data only as instructed and in accordance with UK GDPR.

6. Data Transfers Outside the UK

Some of our third-party service providers (e.g., Meta/Instagram) may transfer data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions, in accordance with UK GDPR Chapter V.

7. Data Retention

We retain personal data only for as long as necessary:

  • Order records — 7 years (required for HMRC financial record-keeping)
  • Enquiry and communication data — 2 years from last contact
  • Marketing consent — until you withdraw consent

After these periods, data is securely deleted or anonymised.

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

  • Right of access — request a copy of your data (Subject Access Request)
  • Right to rectification — request correction of inaccurate data
  • Right to erasure — request deletion of your data, subject to legal obligations
  • Right to restriction — request limited processing in certain circumstances
  • Right to data portability — receive your data in a structured, commonly used format
  • Right to object — object to processing based on legitimate interests
  • Right to withdraw consent — where processing is based on consent, at any time
  • Right to lodge a complaint— with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, please contact us at heartnthread@gmail.com. We will respond within one month.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encrypted communication (HTTPS), secure password practices, and limited access to personal data on a need-to-know basis.

10. Cookies

Our website uses cookies to enhance your browsing experience and analyse site traffic. For full details, please see our Cookies Policy.

11. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. Any updates will be posted on this page with a revised "Last updated" date.

Last updated: May 2026

12. Contact Us

If you have any questions about this privacy policy or how we handle your personal data, please contact us:

Email: heartnthread@gmail.com
Instagram: @heartnthread