Privacy policy
PRIVACY POLICY
Last updated: 5 October 2026
This Privacy Policy explains how personal information is handled when using this website, placing an order or getting in contact.
It also explains the general purposes for which information may be used and the rights that may be available under applicable data protection law.
General privacy principles
Personal information is handled in accordance with applicable data protection requirements and is only used for appropriate business purposes.
Information collected is limited to what is reasonably relevant to operating the website, processing and managing orders, communicating with customers and carrying out related business activities.
Personal information will not be used in a way that is incompatible with the purposes for which it was collected unless otherwise permitted by applicable law.
Orders and customer service
Personal information may be used to process and fulfil orders, provide customer support, communicate about purchases, maintain necessary records and operate and protect the website.
Information provided in connection with an order may also be used where reasonably necessary to answer questions, resolve issues, confirm information, provide updates or otherwise manage that order.
Information is retained only for as long as reasonably necessary for these purposes and applicable legal requirements.
Payments
Payments are processed securely through Shopify and applicable payment providers.
Complete payment card details are not directly received or stored.
Payment-related information may be processed where necessary to complete transactions, confirm payments, address payment issues, help prevent fraudulent activity and maintain appropriate transaction records.
Cookies
Cookies and similar technologies may be used for essential website functions, preferences and analytics.
Where required, non essential cookies are used only after consent has been provided. Cookie preferences can be managed through the cookie banner or Your Privacy Choices link.
Some cookies may be necessary for functions such as navigation, security, shopping baskets and checkout.
Browser settings may also provide additional controls relating to cookies and similar technologies.
Information collected
Information may include contact and billing details, order information, information voluntarily provided for personalised services, photographs, messages, marketing preferences and technical information such as IP address, device information and website usage.
Information may be provided when placing an order, completing website forms, contacting customer support, communicating about a purchase or otherwise interacting with the website.
Certain technical information may also be generated automatically when the website is accessed or used.
Personal information is processed where necessary for a contract, legal obligation, legitimate interests such as operating and protecting the store, or with consent, as applicable.
Where sensitive personal information is voluntarily provided, it will only be processed where permitted by applicable law.
How information may be used
Personal information may be used where reasonably necessary to operate the website and provide the services requested by customers.
This may include processing and managing orders, responding to enquiries, maintaining business and transaction records, administering customer communications, protecting the website, preventing misuse and complying with applicable legal requirements.
Information will not be used or retained unnecessarily.
Accuracy of information
Customers are encouraged to provide accurate information when placing an order or getting in contact.
Where important information relating to an order is incorrect or changes, customers can get in contact to request that it is corrected where appropriate.
Reasonable steps may be taken to correct inaccurate information when necessary.
Data security
Reasonable measures are used to help protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
The website and payment process also rely on security measures provided by the platforms and services used to operate the store.
While reasonable precautions are taken, no internet-based system or method of electronic storage can be guaranteed to be completely secure.
Data retention
Personal information is kept only for as long as reasonably necessary for the purposes for which it was collected and to meet applicable legal, accounting or record-keeping requirements.
How long information is kept may vary depending on the type of information, the reason it is held and whether it may reasonably be required in connection with an order, enquiry, transaction or dispute.
Information may also need to be retained for longer where required by law.
Third party services
The store is hosted by Shopify. Information may also be processed by third party providers supporting payments, communications, customer support, administration, analytics, fraud prevention and other store functions, and certain AI-assisted or other digital tools may also be used from time to time as part of the general administration and day-to-day operation of the store.
Some providers may process information outside the United Kingdom. Where required, appropriate safeguards are used in accordance with applicable data protection law.
Information may also be disclosed where required by law.
Legal and regulatory requirements
Personal information may be used or retained where reasonably necessary to comply with applicable legal, regulatory, accounting or reporting requirements.
Information may also be used where necessary to establish, exercise or defend legal rights, respond to lawful requests or protect the rights, property or security of the business, customers or website.
Certain information may therefore need to be retained even after it is no longer required for the original purpose for which it was collected.
Consent and customer choices
Where processing is based on consent, that consent may be withdrawn where applicable.
Withdrawing consent does not affect processing that took place lawfully before consent was withdrawn.
Where certain information is necessary to process or provide an order, it may not always be possible to provide the relevant service without that information.
Marketing preferences can be changed at any time.
Your rights
Depending on applicable law, you may have rights to access, correct or delete personal information, restrict or object to processing, request portability and withdraw consent.
Certain rights may be subject to legal limitations or exceptions depending on the circumstances.
Where a privacy request is made, reasonable information may be requested where necessary to confirm identity or understand the request.
Requests will be considered and responded to in accordance with applicable data protection requirements.
You may object to direct marketing at any time or unsubscribe using the link provided in marketing emails.
Legal information
Registered in England and Wales.
Company registration number: 17260683
Registered office: Hazel Tree Court, Ebenezer Terrace, CF35 6EA, UK
Privacy enquiries
Questions or requests relating to personal information can be sent to:
mara@spellboundwhisper.com
Complaints
You also have the right to raise a complaint with the UK Information Commissioner's Office.
Privacy concerns may also be raised directly using the contact details above.
Data controller
The data controller responsible for personal information processed through this store is SPWH LTD.
Changes
This policy may be updated where business practices or legal requirements change. The latest version will be published on this page.
Changes may also be made from time to time to improve clarity or reflect changes to how the website operates.
The date shown at the top of this Privacy Policy indicates when it was most recently updated.