Privacy policy

Privacy Policy

Last updated: 8th September 2025

This Privacy Policy explains how Letterfest Ltd (“Letterfest,” “we,” “us,” or “our”) collects, uses, stores, and protects your personal information when you use our website or purchase from us. It also explains your rights under UK data protection law.

By visiting our site or purchasing from us, you agree to the practices described in this policy.

1. Information We Collect

When you purchase something from our store, we collect the personal information you provide, such as your name, billing and delivery address, email address, and payment details.
When you browse our store, we also automatically receive your device’s internet protocol (IP) address and browser information.
With your permission, we may collect your contact details for marketing communications (email or SMS).

2. Legal Bases for Processing

We only process your personal information when we have a lawful basis to do so:

  • Contract: To fulfil your order, take payment, deliver products, and provide customer service

  • Consent: When you opt in to receive marketing emails, SMS, or non-essential cookies. You can withdraw consent at any time

  • Legal obligation: To keep financial records for tax and accounting purposes

  • Legitimate interests: To improve our services, prevent fraud, and run advertising and analytics

3. How We Use Your Information

We use your personal information to process orders and deliver products, communicate with you about your order, send marketing updates where you have consented, improve our website and services, and comply with legal obligations.

4. Consent and Withdrawal

When you provide us with personal information for a transaction, we rely on contract as the lawful basis.
For marketing, we rely on your consent. You can withdraw this at any time by contacting us at info@letterfest.com or by using the unsubscribe links in emails or SMS.

5. Disclosure of Information

We may disclose your personal information if required by law or if you violate our Terms of Service.

6. Shopify and Payment Processing

Our store is hosted by Shopify Inc. They provide us with the e-commerce platform and store your data on secure servers.
If you choose a direct payment gateway, Shopify stores your card data in encrypted form (PCI-DSS compliant). For more details, see Shopify’s Privacy Policy.

7. Third-Party Services and International Transfers

We share information with third-party providers (such as couriers, payment processors, and advertising platforms) only to the extent needed for them to perform their services.
Some providers may be based outside the UK, including in Canada or the United States. Where personal data is transferred internationally, this is done using appropriate safeguards, such as the UK government’s International Data Transfer Agreement or Standard Contractual Clauses approved under UK GDPR.

Advertising and analytics platforms we use include: TikTok, Pinterest, Facebook/Meta, Snapchat, Google Ads, and Awin (affiliate marketing).

8. Cookies and Tracking Technologies

We use cookies and similar technologies to operate our website, improve performance, and personalise ads.

  • Strictly necessary cookies: Required for the site to function (for example, shopping cart)

  • Analytics cookies: Help us understand visitor behaviour

  • Marketing cookies: Used to show you relevant ads on other platforms

Under UK law, we ask for your consent before placing non-essential cookies. You can manage your preferences through our cookie banner or your browser settings.

9. Security

We take reasonable precautions and follow industry best practices to protect your information from loss, misuse, unauthorised access, disclosure, alteration, or destruction.
If you provide credit card details, they are encrypted using SSL technology and stored with AES-256 encryption. While no method of transmission is 100% secure, we comply with PCI-DSS standards.

10. Data Retention

We keep personal data only as long as necessary:

  • Order and transaction data: 6 years (for HMRC record-keeping)

  • Marketing data: until you withdraw consent or unsubscribe

  • Website analytics and cookies: retention periods vary, see our cookie banner for details

11. Your Rights

Under UK GDPR, you have the right to access the personal data we hold about you, request correction of inaccurate data, request deletion (“right to be forgotten”), restrict or object to certain processing including direct marketing, request data portability, and withdraw consent where processing is based on consent.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe your data has been misused. For more information, visit www.ico.org.uk.

12. Age of Consent

By using this site, you confirm that you are at least the age of majority in your country of residence, or you have given consent for your minor dependents to use the site.

13. Changes to This Policy

We may update this policy from time to time. Changes take effect immediately when posted on our website. If we make significant changes, we will notify you.
If our store is acquired or merged, your information may be transferred to the new owners.

14. Contact Information

If you would like to exercise your rights, access or correct your information, or make a complaint, please contact our Privacy Compliance Officer at:

Email: info@letterfest.com
Address: Privacy Compliance Officer, Letterfest Ltd, Unit 1, Chivenor, EX31 4AY