Privacy policy
This privacy policy explains how Waldenhaus Limited collects, uses, shares and protects your personal data when you visit waldenhaus.uk or buy from us. We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Waldenhaus Limited ("Waldenhaus", "we", "us", "our") is the data controller for personal information collected through this website.
- Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
- Company number: 16877766
- Contact: support@waldenhaus.uk
2. What data we collect
| Category | Examples | When collected |
|---|---|---|
| Identity & contact | Name, billing address, delivery address, email, phone | Order placement, account creation |
| Order & payment | Order history, payment method, transaction ID (no card numbers — handled by Shopify/Klarna/PayPal) | Checkout |
| Account | Login credentials, saved addresses, preferences | Account creation |
| Communications | Email or phone exchanges, support tickets, warranty claim photos | When you contact us |
| Marketing consent | Email subscription, marketing preferences | Sign-up form, checkout opt-in |
| Technical & cookies | IP address, browser/device, referring URL, session activity | Every visit (see cookie policy below) |
We do not collect special-category data (race, religion, political opinions, health). We do not knowingly collect data from children under 16.
3. Why we use your data and our lawful basis
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Processing your order, taking payment, arranging delivery | Contract (Art. 6(1)(b)) |
| Managing your account and order history | Contract (Art. 6(1)(b)) |
| Customer support, warranty claims, complaints | Contract / Legitimate interests (Art. 6(1)(b)/(f)) |
| Accounting, tax records, audit (HMRC retention) | Legal obligation (Art. 6(1)(c)) |
| Email marketing (newsletter, offers) | Consent (Art. 6(1)(a)) — withdrawable any time |
| Site analytics, fraud prevention, security | Legitimate interests (Art. 6(1)(f)) |
| Responding to legal requests, regulatory enquiries | Legal obligation (Art. 6(1)(c)) |
4. Who we share data with
We never sell your personal data. We share with named processors only as needed to deliver your order or run the business:
- Shopify Inc. — e-commerce platform (hosting, order management)
- Klarna, PayPal, Stripe — payment processing (their privacy policies apply to the payment step)
- Pallet couriers (Palletways, Pallet-Track, or equivalent UK pallet network) — name, delivery address, phone for delivery booking
- Email service providers (Klaviyo / Mailchimp / equivalent) — for transactional and consented marketing emails
- Analytics — Google Analytics 4 (aggregated/anonymised), Microsoft Clarity (session replays without IP, no cross-site tracking)
- Judge.me — verified review collection (post-purchase email; you may opt out at the email)
- HMRC, banks, accountants — for tax and accounting obligations
- Legal authorities — only where required by law (court order, police investigation, regulatory request)
All processors are bound by data-processing agreements that meet UK GDPR requirements.
5. International transfers
Some processors (e.g. Shopify, Google) host data outside the UK. Where data leaves the UK, transfers are protected by either:
- UK adequacy regulations (e.g. EEA destinations recognised by the UK government), or
- Standard Contractual Clauses + UK International Data Transfer Addendum, or
- The UK–US Data Bridge for transfers to US providers certified under the UK Extension to the Data Privacy Framework.
6. How long we keep your data
| Data | Retention |
|---|---|
| Order & payment records (financial/tax) | 7 years from end of accounting year (HMRC requirement) |
| Customer account (if created) | While active; deleted on request or after 3 years of inactivity |
| Warranty claim records | Duration of the relevant warranty + 1 year |
| Support emails / claim photos | 3 years from the closure of the matter |
| Marketing consent + email subscriptions | Until you unsubscribe; cleansed after 2 years of no engagement |
| Website analytics (Google Analytics 4) | 14 months (rolling) |
| Server logs & cookies | See cookie table — typically session to 12 months |
7. Your rights under UK GDPR
You have the right to:
- Access the personal data we hold about you (subject access request)
- Rectify any inaccurate or incomplete data
- Erasure ("right to be forgotten") where there is no overriding legal obligation to retain
- Restrict processing in certain circumstances
- Data portability — receive your data in a machine-readable format
- Object to processing based on legitimate interests, including direct marketing
- Withdraw consent at any time for marketing or any consent-based processing
- Lodge a complaint with the UK Information Commissioner's Office: ico.org.uk/make-a-complaint · 0303 123 1113
To exercise any right, email support@waldenhaus.uk. We respond within one month (the UK GDPR statutory timescale). No fee unless requests are manifestly unfounded or excessive.
8. Cookies and tracking
We use cookies and similar technologies to make the site work, remember your basket, measure performance and (with your consent) personalise marketing. On first visit you will see a cookie banner offering Accept / Reject / Customise.
| Type | Examples | Lawful basis | Duration |
|---|---|---|---|
| Strictly necessary | Cart, checkout session, fraud prevention, CSRF | Legitimate interests (no consent required) | Session — 30 days |
| Performance / analytics | Google Analytics 4, Microsoft Clarity | Consent | Up to 14 months |
| Marketing | Meta Pixel, Google Ads remarketing | Consent | Up to 13 months |
| Preferences | Currency, language, recently viewed | Legitimate interests / consent | 30 days — 1 year |
You can change cookie preferences any time via the "Cookie settings" link in the footer or your browser settings.
9. How we protect your data
- HTTPS / TLS encryption across the site and checkout
- Payment data tokenised by PCI-compliant processors — we never store card numbers
- Access controls and two-factor authentication on internal admin systems
- Annual review of processor agreements and security posture
- Breach-notification process: in line with UK GDPR (ICO notified within 72 hours of any qualifying breach)
10. Children's privacy
Our services are intended for adults aged 18+. We do not knowingly collect personal data from children under 16. If you believe a child has provided data, contact support@waldenhaus.uk and we will delete it.
11. Changes to this policy
We may update this policy from time to time. The "last updated" date below changes whenever we do. For material changes affecting how we use your data, we will notify subscribed customers by email at least 14 days before the change takes effect.
12. Complaints
If you are not satisfied with how we have handled your data:
- Email us first at support@waldenhaus.uk — we acknowledge within 2 working days and respond within one month.
- If unresolved, contact the UK Information Commissioner's Office (ICO): ico.org.uk · 0303 123 1113 · Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.