Checkout saves the name, email and delivery address entered, selected products, formats and quantities, prices, discounts, delivery choice, order reference, payment method, payment and approval status, and related confirmation times. Bank transfer is the available payment method; this storefront does not collect card numbers.

Bank transfer orders keep a snapshot of the receiving account details and payment reference. When you submit transfer details, the sending bank, account name, date sent, optional note and submission time are saved for manual payment verification. Submitting those details does not itself confirm payment.

Support enquiries require a signed-in account. Tickets store your account identifier, account email, optional name, topic, original message, replies, author roles, status and timestamps. Replies appear in your account. Internal staff notes are visible only to administrators. Keep health information, card details, passwords and receipt access tokens out of support messages.

Customer signup stores an account identifier, normalised email address, display name, salted scrypt password hash and creation and update times. Your name is optional; without one, the display name uses the part of your email before @. Signed-in orders can be linked to your account identifier. Passwords are not saved as plaintext or added to customer orders and contact messages. Email verification and password-reset email are not connected.

Administration uses a separate owner username and password, verified on the server. Customer and administrator session records contain a token digest, credential fingerprint, creation and expiry times, and any revocation time; customer sessions also contain the account identifier. Plaintext session tokens are not stored in these database records.

Private receipt links contain access tokens that allow the holder to view the corresponding order. Treat those links as private. Do not share them, paste them into public messages or leave them saved on a shared device.

Optional administrator two-factor authentication stores encrypted active and pending authenticator secrets, setup expiry and enabled times, the last used time step, hashed recovery codes and a revision. Pending setup expires after ten minutes. Recovery codes are shown once when enabled; each code can be used once.

Login protection stores attempt counters for global and account categories, keyed hashes of account and IP identifiers, and a 15-minute window expiry. These records do not store raw IP addresses or submitted unknown usernames. They support abuse protection rather than visitor analytics; the IP-hash rows are capped at 1,000.

The records support checkout, stock reservation, order history, receipt access, enquiry review and fulfilment updates. Authorised administrators can view these records and enter tracking details, public order notes and internal notes. Internal notes are kept out of customer receipt responses.

An audit history records administrative changes and the acting account. Historical audit entries can include notes. Tracking statuses are entered manually; there is no connected courier service or automatic dispatch email.

This site runs from the operator’s server and is made reachable through a Cloudflare Tunnel. Stored orders, messages, accounts and administrative records use the site’s configured database. Cloudflare processes network traffic needed to provide the tunnel and its security services.

Customer and administrator sign-in use this website’s separate session cookies. Cloudflare may add security checks or cookies depending on the tunnel and hostname configuration; complete provider-cookie behavior on this hostname has not yet been verified. See the cookies policy for the application cookies and the remaining verification.

No advertising pixels, page analytics, embedded videos, maps or external web fonts are configured in the storefront. Product artwork and fonts are served locally. External research and tracking links open a separate provider’s website when followed; that website has its own privacy practices.

The operator has not confirmed processing locations, applicable transfer safeguards or a complete provider agreement review. No claim is made that all processing takes place in the UK.

Bank transfers are made through your own bank using the receiving account details and reference shown on your receipt. This website does not connect to your bank account or request your banking password or security codes. Transfer details you submit are saved for manual verification by the store.

Basket selections, saved products and up to 100 private receipt records are kept in this browser’s local storage. Receipt records include the order reference, access token, total and creation date. Use the browser-data controls or browser settings to remove these local records.

Removing browser data does not erase server orders, messages, administrative notes or audit records, and signing out does not remove saved local receipt links. No automatic timed deletion of server records is configured. The operator needs to set and apply a justified retention schedule and review existing records; no deletion deadline is promised here.

Customer sessions expire after seven days and administrator sessions after eight hours. Signing out revokes the session and clears its browser cookie. Changing your customer password ends older sessions and replaces the current session. Login-attempt windows expire after 15 minutes, but expired session, attempt and pending-authenticator rows are not automatically deleted. These access limits do not establish a deletion schedule for accounts, orders, messages or administrative audit history.

Read the cookies and browser-data policy.

A valid lawful basis is needed for personal-data processing. The operator has not yet supplied the purpose-specific bases and retention criteria for this notice. Reading a privacy notice or submitting a form is not described here as consent to unrelated marketing.

Depending on the applicable basis and circumstances, UK data protection rights include access, correction, erasure, restriction, objection and portability. Consent can be withdrawn where processing relies on it. These rights have legal limits; clearing this browser’s data does not exercise a server-data erasure request.

The account contact form includes a Privacy request topic for review. Request handling is not automated, and a dedicated privacy contact is still pending. This does not remove the operator’s obligations under data protection law. You can also obtain information about your rights and make a complaint to the Information Commissioner’s Office.