Privacy policy

 

This Privacy Policy explains how the operator of brownskitchen.shop collects, uses, shares, retains and protects personal information when you visit the website, create an account, place an order, contact us, receive marketing or otherwise interact with the store. For applicable UK data protection law, we act as the controller of personal information described in this policy unless another organisation is identified as independently responsible.

Privacy contact: info@brownskitchen.shop.

Personal information we collect

Depending on how you use the store, we may collect:

identity and contact information, such as name, billing and delivery address, email address and telephone number;
order and transaction information, such as products purchased, order value, discounts, returns, refund history and payment status;
payment-related information. Full card details are generally processed by payment providers rather than stored by us, although we receive transaction references and limited payment details;
account information, preferences, saved addresses and customer-service communications;
device and usage information, such as IP address, browser, device type, pages viewed, referral information, timestamps, cookie identifiers and interaction data;
marketing preferences and records of consent, unsubscribe requests or objections; and
information supplied for fraud prevention, dispute handling, legal claims or verification.

We collect information directly from you, automatically from your device, and from service providers such as our ecommerce platform, payment processors, delivery carriers, fraud-prevention providers and analytics or advertising partners where permitted.

Why we use personal information and our lawful bases
Contract: to process payment, accept and fulfil orders, deliver goods, provide order updates, manage accounts, handle returns and provide customer support requested before or after purchase.
Legal obligation: to keep tax and accounting records, respond to valid legal requests, meet consumer protection and product-safety duties, and comply with data protection obligations.
Legitimate interests: to secure the store, prevent fraud and misuse, troubleshoot services, improve store performance and customer experience, understand aggregated business performance, manage legal claims and communicate with existing customers about closely related products where the law permits. We assess whether these interests are necessary and balanced against individual rights.
Consent: for non-essential cookies and similar technologies, and for electronic marketing where consent is required. Consent can be withdrawn at any time without affecting earlier lawful processing.

We will not use personal information for a materially incompatible new purpose unless permitted by law and, where required, we provide further information or obtain consent.

Cookies and similar technologies

We use strictly necessary technologies to provide functions requested by users, such as keeping a shopping basket, securing checkout, balancing traffic and remembering essential session information. Where permitted by current law, limited-intrusion technologies may be used without consent for purposes falling within a statutory exception, while required information and objection controls are provided.

We seek valid consent before using non-essential analytics, advertising or personalisation technologies where consent is required. Non-essential technologies should not be activated merely because a visitor continues browsing. Available cookie controls can be used to accept, reject or change optional categories. Withdrawing consent does not affect the lawfulness of earlier use. Blocking some technologies may affect optional features but should not prevent use of essential shopping functions.

Marketing

We may send marketing where you have consented or where a limited existing-customer exception applies and the law permits it. Every electronic marketing message will provide a clear way to opt out. You have an absolute right to object to direct marketing. Send an objection to info@brownskitchen.shop or use the unsubscribe control in the message. We may retain a minimal suppression record to ensure the request continues to be honoured.

How we share personal information

We may disclose personal information only as reasonably necessary to:

our ecommerce hosting and store platform providers;
payment processors, banks and fraud-prevention services;
warehouses, suppliers, fulfilment partners, postal operators and couriers;
IT, security, customer-support, analytics, communications and professional advisers;
regulators, courts, law-enforcement bodies or other parties where disclosure is required or permitted by law; and
a buyer, seller or adviser involved in a genuine business reorganisation, subject to appropriate confidentiality and data protection measures.

Service providers acting for us are authorised to process information only for agreed services and must protect it appropriately. Some providers may act as independent controllers for their own regulated or operational purposes; their privacy information applies to that processing. We do not sell personal information in the ordinary meaning of selling it for money.

International transfers

Some providers may process personal information outside the United Kingdom. Where a transfer is restricted, we use a lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another mechanism permitted by law. Where required, we assess the destination and safeguards and apply supplementary measures. Contact us for information about the relevant safeguard, subject to protection of confidential and security-sensitive information.

Retention

We keep personal information only for as long as reasonably necessary for the relevant purpose, including fulfilment, customer service, legal compliance, fraud prevention and disputes. Order, invoice and accounting records are generally retained for up to six years after the end of the relevant financial or contractual relationship where needed for UK tax, accounting or legal-claims purposes. Customer-service records are ordinarily kept for up to three years after resolution, unless linked to a longer-lived order record or claim. Marketing records are kept until consent is withdrawn or an objection is made, with a limited suppression record retained as necessary. Security logs and cookie data are kept for shorter periods determined by security need and the stated lifetime of the relevant technology. We may retain information longer where law, litigation, fraud prevention or a regulatory hold requires it, and may delete or anonymise it earlier when no longer needed.

Security

We use administrative, technical and organisational measures designed to protect personal information against accidental or unlawful loss, misuse, alteration, disclosure or access. No internet transmission or storage system can be guaranteed completely secure. Customers should use unique passwords, keep account credentials confidential and contact us if they suspect unauthorised account activity.

Your rights

Subject to legal conditions and exemptions, you may have rights to be informed, request access, request correction, request erasure, restrict processing, receive portable information, object to processing and withdraw consent. You may also have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects. We do not intend to make such decisions about customers without safeguards required by law.

To exercise a right, email info@brownskitchen.shop. We may request proportionate information to confirm identity. We generally respond within one month, subject to lawful extensions or exceptions, and do not ordinarily charge a fee.

Data protection complaints

You may complain about our use of personal information by emailing info@brownskitchen.shop with the subject “Data Protection Complaint”. We will provide an accessible electronic route for complaints, acknowledge a data protection complaint within 30 days, investigate it appropriately and communicate the outcome without undue delay, in line with applicable law.

You also have the right to complain to the UK Information Commissioner’s Office. Its website is ico.org.uk. We would appreciate the opportunity to address the concern first, but this does not restrict your right to contact the ICO.

Children

The store is intended for adults able to enter a binding purchase contract. We do not knowingly collect personal information from children for the purpose of selling directly to them. If you believe a child has provided personal information improperly, contact us so we can investigate and take appropriate action.

Changes to this policy

We may update this policy to reflect operational, legal or regulatory changes. The revised version will be posted on this page with a new “Last updated” date. Where a change materially affects how existing personal information is used, we will provide additional notice where required.