Privacy Policy
Last updated: 7 May 2026
Hello, and welcome to the small-print bit. We’ve tried to keep this short and human. If anything’s unclear, drop us a line.
This Privacy Policy explains how Sweetorium (“we”, “us”, “our”) collects, uses and looks after your personal information when you visit **sweetorium.co.uk** or place an order with us. We’re the data controller, and we comply with the UK GDPR and the Data Protection Act 2018.
Who we are
Sweetorium is a UK-based online pick n mix sweet shop.
Website: sweetorium.co.uk
Contact: hello@sweetorium.co.uk
What we collect and why
We only collect what we genuinely need to send you sweets and run the shop. Specifically:
When you place an order, we collect your name, delivery address, billing address, email address and phone number. We need this to process your order, take payment, pack your sweet bag and get it to your door. The lawful basis for this is contractual necessity — we can’t fulfil your order without it.
When you contact us, we keep the messages you send and our replies, so we can actually help you. Lawful basis: **legitimate interest** in providing customer support.
When you browse the site, our hosting and ordering systems log basic technical information (like the fact a page was loaded). This is standard for any website and is used only to keep things running and secure.
We do not collect or store your full payment card details. Card payments are handled directly by our payment providers on their secure systems.
Analytics
We use Leaflytics, a privacy-friendly, GDPR-compliant analytics tool that does not use cookies and does not collect personally identifiable information. It tells us things like which pages are popular and roughly where in the world our visitors come from — nothing that identifies you personally.
We do not use Google Analytics or any other tracking that profiles you across the web.
Cookies
We keep cookies to a minimum. The cookies we do use are essential for the shop to actually work:
– Shopping basket cookies — so the sweets you’ve added stay in your basket as you browse.
– Session and security cookies — set by WordPress and WooCommerce to keep your session secure (for example, when you log in or check out).
– Order processing cookies — to remember your order details through the checkout flow.
These are strictly necessary cookies under UK GDPR / PECR, which means we don’t need your consent to set them — but you can block or delete cookies in your browser settings if you’d prefer (the site may not work properly if you do).
We do not set advertising cookies, third-party tracking cookies or social media pixels.
Who we share your information with
We share your data only with the small number of services we need to run the shop:
– Our payment providers — to process your payment securely. They receive only what’s needed for the transaction.
– ShipStation and our chosen carrier — to generate shipping labels and deliver your order. They receive your name, delivery address, contact details and order reference.
– **Our website hosting provider** — which stores the website and order database on secure servers.
– HMRC and other authorities — only where we’re legally required to (for example, accounting and tax records).
We do not sell, rent or trade your personal information to anyone. Ever.
How long we keep your data
– Order records: kept for 7 years to meet UK accounting and tax obligations.
– Customer account details: kept for as long as your account is active. You can ask us to delete your account at any time.
– Customer support messages: kept for up to 2 years, then deleted.
– Marketing emails (if you’ve opted in): kept until you unsubscribe.
Marketing
If you opt in (for example, by ticking a box at checkout or signing up to our newsletter), we’ll send you the occasional email about new sweets, offers and seasonal goings-on. You can unsubscribe at any time using the link in any email, or by emailing us. We won’t email you marketing without your consent.
Your rights
Under UK GDPR, you have the right to:
– Access the personal data we hold about you.
– Correct anything that’s wrong or out of date.
– Delete your data (the “right to be forgotten”), where we’re not legally required to keep it.
– Restrict or object to how we use it.
– Data portability — get a copy of your data in a portable format.
– Withdraw consent at any time, where we rely on consent.
– Complain to the Information Commissioner’s Office (ico.org.uk) if you think we’ve mishandled your data.
To exercise any of these rights, email us at [your contact email]. We’ll respond within one month.
Security
We take reasonable steps to keep your data safe, including using HTTPS encryption across the site, secure hosting, and limiting who has access to customer data. No system is ever 100% secure, but we treat your information with the care we’d want for our own.
International transfers
Some of our service providers (for example, payment processors) may process data outside the UK. Where this happens, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or equivalent standard contractual clauses.
Changes to this policy
If we update this policy, we’ll change the “Last updated” date at the top. For significant changes, we’ll let you know more visibly — for example, with a notice on the site.
Contact
Questions, requests, or just want to say hello? Email us at hello@sweetorium.co.uk.