Privacy Policy

This policy explains what personal data Tullara collects, why we hold it, how long we keep it, and the rights you have under the UK GDPR and the Data Protection Act 2018. Tullara is the data controller for the data described here. Contact us at orders@tullara.co.uk about anything in this policy.

What we collect and why

• Account data — your email address and password (stored only as a secure hash by our authentication provider). Lawful basis: performance of a contract, so you can sign in and see your own orders.
• Order data — name, email, delivery address, postcode, items ordered, totals, discount codes used, payment reference, invoice and fulfilment status. Lawful basis: performance of a contract, and legal obligation for tax and accounting records.
• Saved delivery addresses — only those you choose to save to your account, so repeat checkout is faster. Lawful basis: performance of a contract. You can delete them at any time from your account page.
• Reviews — the rating, review text and display name you submit, shown publicly against the product. Lawful basis: consent, given when you publish the review.
• Return requests — the reason you give and our decision. Lawful basis: performance of a contract and our legal obligations.
• Newsletter signups — your email address and where you signed up. Lawful basis: consent. Every future campaign will carry an unsubscribe link, and you can ask us to remove you at any time.
• Technical data — data needed to keep the site running securely, such as error reports. We do not run advertising trackers.

Payment data

Card payments are processed by Stripe. We never see or store your full card number. Where you choose Klarna or Clearpay, that provider handles your payment data under its own privacy policy. We store only the payment reference, the amount and the capture date.

Who we share data with

• Stripe — payment processing (and Klarna / Clearpay where selected).
• Resend — sending invoice and dispatch emails.
• Our hosting and database provider — storing the site and its data.
• Suppliers and couriers — the delivery name, address and postcode needed to fulfil your order, and nothing more.

We do not sell your personal data. Where a provider processes data outside the UK, it is covered by appropriate safeguards such as the UK International Data Transfer Addendum.

How long we keep it

• Order, payment and invoice records: six years, as required for UK tax purposes.
• Account and saved addresses: until you ask us to delete your account.
• Newsletter signups: until you unsubscribe.
• Reviews: until you or we remove them.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to our use of it, or port it to another service. Where we rely on consent you can withdraw it at any time. Email orders@tullara.co.uk and we will respond within one month. We may need to keep order records for tax reasons even after an account is closed.

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.

Cookies and local storage

We use strictly necessary storage only: your cart is kept in your browser's local storage so it survives a page refresh, and a session token keeps you signed in. No advertising or profiling cookies are set.