Your details, plainly

I am the data controller for everything described here, under the UK GDPR and the Data Protection Act 2018.

• To send you an order: your name, delivery and billing address, email, and phone number if you give one.
• Your order history — what you bought, when, and what you paid.
• If you make an account: your email and a password, which is stored scrambled and cannot be read back, by me or anyone else.
• If you write a review or save a wishlist: the name you choose to show and what you wrote.

Your card number is never collected. Payment happens inside Square’s own form; all this site ever receives is a one-time token and, afterwards, the last four digits so you can recognise the payment.

• To perform our contract — taking payment, making the piece, posting it, handling a return.
• Legal obligation — keeping sales records for HMRC.
• Legitimate interests — keeping the shop secure and preventing fraudulent orders.
• Consent — marketing email, and only if you ticked the box. Every one has an unsubscribe link, and unsubscribing does not affect your orders.

Only the services needed to actually get a parcel to you. Each sees the minimum required, and none of them is allowed to use your details for their own marketing.

• Square — payment processing. They receive your card details directly and the order total.
• Resend — sends order confirmations and dispatch notices. Receives your email address and order details.
• Royal Mail — receives your name and delivery address, printed on the label.
• Neon — hosts the database the shop runs on.

Your details are not sold, rented, or shared with anyone else. If I am ever legally required to disclose something, I will, and I will tell you unless the law forbids it.

Order and payment records are kept for six years after the end of the tax year they fall in, which is what HMRC requires. Account details are kept until you ask me to close the account. Marketing consent is kept until you withdraw it.

Only the ones the shop cannot work without: what is in your basket, whether you are signed in, and the security token that stops someone submitting a form on your behalf. There is no advertising tracking and no third-party analytics on this site, which is why there is no cookie banner to dismiss.

Your basket is also stored in your own browser so it survives a reload. Clearing your browser data clears it.

You have the right to see the data I hold about you, correct it, have it deleted, restrict or object to how it is used, and receive it in a portable form. Where I rely on consent, you can withdraw it at any time.

Email hello@tengology.com and I will deal with it within one month. There is no charge. The one thing I cannot delete on request is a completed order record, because HMRC requires me to keep it — everything around it can go.

Please tell me first and give me a chance to fix it. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113.