Privacy notice

Who is responsible

The data controller is Jack Jones, trading as Amber & Still, a sole trader, at 46 Park Avenue, Barking, IG11 8QU, United Kingdom. Email hello@amberandstill.co.uk or write to this address about your information. This draft is not a complete launch-ready privacy notice.

Information used by the shop

Lovable hosts this storefront. Your browser makes technical requests for pages, photographs and fonts. Technical information can include IP address, browser/device information, request logs and security or error information.

An essential cookie remembers your bag on this storefront. Shopify provides its contents, quantities and totals. The cookie duration is listed on our Cookies page.

Shopify handles checkout, payment processing and orders. When you proceed there, it collects the contact, delivery, billing and payment information needed for checkout. Our storefront does not collect full card details in its own forms.

If you contact us, we will use your correspondence and relevant order details. This storefront does not currently offer customer accounts, newsletter signup or review submission.

Why information is used and lawful bases

Contract: processing your bag, purchase, delivery, cancellations and relevant customer-care requests to take steps at your request or perform the purchase contract.

Legal obligations: keeping required accounting records, handling statutory consumer rights and responding to lawful regulatory requests.

Legitimate interests: proportionate site security, fraud prevention, technical troubleshooting and resolving disputes, subject to balancing those interests against your rights.

Consent: optional marketing or consent-requiring tracking, if introduced later, would require a separate appropriate choice. No marketing consent is required to shop, and no optional marketing service is being added in this draft.

Providers, fulfilment and international processing

Provider categories include Lovable for hosting and technical operation, Shopify and payment service providers for checkout/orders/payments, and, when confirmed, email and delivery/fulfilment providers. Relevant information may also be shared with professional advisers or authorities where necessary and lawful.

Draft: details of our email and delivery providers are being finalised, including whether a supplier delivering directly to you would receive your name, address or order information.

Providers may process information outside the UK. Draft: the countries involved and the safeguards applicable to those transfers are being confirmed before launch. Where required by law, transfers need appropriate safeguards, such as approved contractual arrangements. Details of the safeguards and how to obtain a copy will be included in the final notice.

How long information is kept

Draft: the actual retention schedule is awaiting confirmation. Retention must reflect order fulfilment, customer care, statutory accounting duties, limitation periods, security needs and any active dispute, rather than keeping all records indefinitely.

The essential cart cookie lasts up to 10 days from creation. This cookie duration is not the retention period for Shopify order records or hosting logs. Provider-specific retention and deletion arrangements must be confirmed separately.

Your rights and complaints

Depending on the circumstances, you can request access, correction or erasure, restriction, portability, and object to processing based on legitimate interests. These rights have legal conditions and exceptions. If processing relies on consent, you can withdraw it without affecting earlier lawful processing.

You can email hello@amberandstill.co.uk or write to the controller at the address above. We may need to verify identity appropriately, but you should not send passwords or full card details.

You can complain to the UK Information Commissioner’s Office (ICO). Providing details for a purchase may be necessary to fulfil it; without the required checkout information, an order cannot be completed. No profiling or automated decision-making by our storefront is configured; payment-provider fraud processes are governed by their own information.