Legal
Privacy Policy
Last updated 17 September 2026
This policy explains what personal information Bespoke Fragrances collects when you visit bespokefragrances.uk, place an order or join our mailing list, why we collect it, who we share it with, and the rights you have over it. We keep it short because we collect very little.
Who we are
Bespoke Fragrances is run by [your full legal name, or company name and number], of [business address, Manchester, postcode], United Kingdom. We are the "controller" of your personal information under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Questions about your data: email [your business email] or message us on WhatsApp at +44 7463 340184.
What we collect
| When | What | Why |
|---|---|---|
| You place an order | Name, email address, phone number (optional), delivery address, town and postcode, order notes, the products you choose, your sample picks and any promo code | To process, deliver and support your order, and to keep the business records the law requires |
| You pay by card | Your card details are entered on Stripe's secure payment page — we never see or store your card number. Stripe tells us whether the payment succeeded. | To take payment |
| You order by WhatsApp or email | Whatever you include in your message, plus your phone number or email address | To reply to you and fulfil your order |
| You join our mailing list | Your email address and the date you joined | To tell you about new compositions — one email per release |
| You browse the site | Standard technical information your browser sends (such as IP address, browser type and the pages requested), kept briefly in our hosting providers' security logs | To run the site securely and stop abuse, such as automated order spam |
We don't use advertising trackers, analytics cookies or social media pixels, and we don't buy or sell personal information.
Our legal reasons for using it
- Contract — using your order details to sell and deliver your fragrance.
- Legal obligation — keeping order and payment records for tax and accounting.
- Consent — sending release emails. You can withdraw consent at any time.
- Legitimate interests — keeping the website secure, preventing fraud and answering your questions.
Mailing list
We only email you if you've joined the list, and only about new releases. Every email lets you unsubscribe, or you can message us and we'll remove you straight away. We will never share your email address with other businesses for their marketing.
Who we share it with
Only with the services that help us run the shop, and only what they need:
- Netlify — hosts our website and receives mailing-list signups made on it.
- [backend host, e.g. PythonAnywhere or Render] — runs our order system and stores order details and mailing-list emails.
- Stripe — processes card payments (once card checkout is live).
- Google Fonts — supplies the typefaces on our pages, so your browser connects to Google, which receives your IP address.
- WhatsApp (Meta) — if you choose to order or contact us through WhatsApp.
- Royal Mail or our courier — your name and delivery address, to deliver your parcel.
- Our accountant and HMRC — order records where required by law.
We may also disclose information if the law requires it, or to protect our customers or business from fraud.
International transfers
Some of these providers (such as Netlify, Stripe, Google and Meta) are based in, or use servers in, the United States or elsewhere outside the UK. Where that happens, they protect your information with safeguards recognised under UK law, such as the UK–US data bridge or the UK's International Data Transfer Agreement.
How long we keep it
- Orders — 6 years from the end of the financial year of the order, as UK tax law requires, then deleted.
- Mailing list — until you unsubscribe.
- Messages — as long as needed to deal with your enquiry or order.
- Security logs and backups — rotated automatically; database backups are kept for 14 days.
Cookies and storage on your device
We don't use tracking or advertising cookies. The site stores a few small items in your own browser so it works as you expect:
- your bag, sample choices and any promo code, so they're still there when you return;
- whether you prefer the light or dark design;
- that you've already seen the opening animation during this visit.
These stay on your device, aren't sent to us until you place an order, and can be cleared at any time in your browser settings.
Keeping it safe
Our site uses HTTPS encryption. Order information is kept on access-controlled systems, our admin area is password protected, and card payments are handled entirely by Stripe, which is certified to the highest payment security standard (PCI DSS Level 1).
Your rights
You have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct anything that's wrong or incomplete;
- ask us to delete your information (we may need to keep order records for tax purposes);
- object to or ask us to limit how we use your information;
- ask for your information in a portable format;
- withdraw consent to marketing emails at any time.
To use any of these rights, contact us using the details above. We'll respond within one month, and there's no charge.
Complaints
If you're unhappy with how we've handled your information, please tell us first and we'll try to put it right. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this policy
If we change how we use your information, we'll update this page and the date at the top. For significant changes, we'll let mailing-list members know by email.