# Privacy Policy URL: https://houseofattar.co.uk/privacy-policy/ *Last updated: 14 October 2026* This notice explains what personal information House of Attar collects when you visit houseofattar.co.uk, place an order or contact us, why we use it, who we share it with and what your rights are. We keep it to what we need to run the shop. ## Who we are House of Attar is the data controller for the personal information described here. That means we decide how it is used and we are responsible for it. - **Business:** House of Attar, 5 Brayford Square, London E1 0SG, United Kingdom - **Email:** [info@houseofattar.co.uk](mailto:info@houseofattar.co.uk) - **Phone or WhatsApp:** [07952 709944](https://wa.me/447952709944) ## What we collect - **When you order:** your name, delivery and billing address, email address, phone number, the items you buy, prices, any discount code and any note you add. WooCommerce also records the IP address and browser used to place the order, to help prevent fraud. If you have accepted marketing cookies, we also save with your order which website, ad or campaign brought you to us and the type of device you used. - **Payments:** card, Apple Pay, Google Pay and Link payments are handled by Stripe, and PayPal payments by PayPal. We never see or store your full card number. We receive confirmation that you have paid and, in some cases, limited details such as the card type. - **If you create an account:** your login email, a password (stored in encrypted form) and your saved addresses and order history. An account is optional. You can check out as a guest, and you can create an account at checkout or afterwards if you want one. - **If you sign up for emails:** your email address, what you signed up through (for example the spin-the-wheel pop-up or the tick box at checkout) and how you interact with our emails. - **If you contact us:** what you send us through the contact form, email or WhatsApp, including your name, email or phone number, any order number and your message. - **Back-in-stock requests:** your email address and the product and size you asked about. - **When you browse:** pages visited, the site that referred you, device and browser type, and approximate location (country) for visit statistics. If you accept the relevant cookies, we also collect the information described in our [Cookie Policy](https://houseofattar.co.uk/cookie-policy/). We do not ask for or knowingly collect information about children. Our shop is for adults. ## How we use it, and our lawful basis UK data protection law says we need a lawful basis for each use of your information. These are ours. | What we do | Lawful basis | | Take payment, process and deliver your order, send order and dispatch emails, handle returns, refunds and problems with an order | Contract: we need it to sell you the goods | | Run your customer account, if you open one | Contract | | Keep sales and accounting records | Legal obligation (tax law) | | Prevent fraud and keep the site secure (for example payment fraud checks and blocking malicious traffic) | Legitimate interests: protecting our customers and our business | | Reply to messages through the contact form, email or WhatsApp | Legitimate interests: answering your question. Contract, if it is about an order. | | Send marketing emails or texts, including offers, reorder reminders, review requests and reminders about a basket you left | Consent: only if you have opted in. You can unsubscribe at any time. | | Send one email when an item you asked about is back in stock | Consent: you tick a box when you ask | | Count visits and see which pages are used with Umami, which uses no cookies | Legitimate interests: understanding how the site is used so we can improve it | | Google Analytics, advertising measurement with Meta (Facebook and Instagram), and recording which link or ad brought you to us | Consent: through the cookie banner. You can change your choice at any time. | | Deal with complaints, disputes and legal claims | Legitimate interests: protecting our legal rights | Where we rely on legitimate interests, you can object (see “Your rights” below). Stripe and PayPal use automated checks to spot fraudulent payments, and these can sometimes block a payment. If that happens, contact us and we will look at it. We do not make any other decisions about you by purely automated means. ## Who we share it with We do not sell your personal information. We share it only with the services that help us run the shop, and only what each one needs: - **Stripe**: card, Apple Pay, Google Pay and Link payments, and fraud checks. If you choose to save your details with Link, Stripe holds them under its own privacy policy. - **PayPal**: PayPal payments, if you choose PayPal. - **Royal Mail**: your name, delivery address, email address and phone number (if you gave one), so it can deliver your parcel and send you delivery updates. - **Omnisend**: our email and text marketing service. It sends marketing emails to subscribers and stores the sign-up details listed above. - **Our hosting provider (OVHcloud, servers in the UK)**: stores the website and its database. - **Our email delivery provider (Amazon SES, London region)**: sends the shop’s own emails, such as order confirmations, contact form messages and back-in-stock emails. - **Cloudflare**: delivers the website quickly and protects it from attacks. It processes your IP address and technical details of each request. - **Umami**: cookieless visit statistics, run on a server at our own analytics server. It does not store your IP address or set cookies. - **Google**: Google Analytics, only if you accept statistics cookies. Google also provides the reviews we display from our Google Business Profile. - **Meta (Facebook and Instagram)**: the Meta pixel and Conversions API, only if you accept marketing cookies. This tells Meta when someone views a product, adds to basket or buys after seeing our ads. Meta may also receive contact details from your order, such as your email address, phone number, name and postcode, in scrambled (hashed) form so it can match a purchase to an ad. - **Meta (WhatsApp)**: if you message us on WhatsApp, your messages are handled by WhatsApp under its own terms. - **Jetpack (Automattic)**: visit statistics, only if you accept statistics cookies. - **Mailchimp**: we used Mailchimp for emails in the past. An older mailing list is still stored there. We no longer send from it or add new people to it. - **Trustindex**: copies our public Google reviews to our website so we can show them. It does not receive information about our customers. - **Complianz**: our cookie banner. It stores your cookie choice in your browser. - **HMRC, the police or other authorities**, where the law requires it. If the business is ever sold, customer information may pass to the new owner, who must use it in line with this notice. ## Transfers outside the UK Some of these providers, such as Stripe, PayPal, Omnisend, Google, Meta and Cloudflare, store or access data outside the UK, including in the European Economic Area and the United States. When that happens, we rely on one of the safeguards UK law allows: - the country or arrangement is approved by the UK government as giving adequate protection (this covers the European Economic Area, and US companies certified under the UK Extension to the EU-US Data Privacy Framework); or - the provider has signed the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses. Contact us if you would like more detail about the safeguard used for a particular provider. ## How long we keep it | Information | How long | | Orders and payment records | 6 years after the end of the tax year in which you ordered, because tax law requires us to keep them | | Customer account | Until you ask us to close it. Orders placed through it are kept as above. | | Marketing sign-up | Until you unsubscribe. After that we keep only your email address on a “do not contact” list, so we don’t email you again by mistake. | | Messages to us (contact form, email, WhatsApp) | Up to 2 years after the conversation ends, or longer if it relates to an order or a complaint | | Back-in-stock requests | Until we send the email, then deleted straight away. You can ask us to delete a request sooner. | | Google Analytics | 14 months | | Umami visit statistics | No personal details are stored. Totals are kept for as long as they are useful. | ## Your rights You have the right to: - **access** the personal information we hold about you and get a copy; - **correct** anything that is wrong or incomplete; - **delete** your information, where we no longer need it or have no other lawful reason to keep it (we must keep order records for tax); - **restrict** how we use it, for example while we check a correction; - **object** to uses based on legitimate interests, and to direct marketing at any time; - **move** information you gave us to another service (data portability); - **withdraw consent** at any time, where we rely on it. Use the unsubscribe link in any email, or change your cookie choice on our [Cookie Policy](https://houseofattar.co.uk/cookie-policy/) page. This does not affect what we did before you withdrew. To use any of these rights, email [info@houseofattar.co.uk](mailto:info@houseofattar.co.uk) or message us on WhatsApp. It is free. We may ask you to confirm your identity. We will reply within one month. If your request is complex we may need up to two more months, and we will tell you if so. ## Complaints If you are unhappy with how we have handled your personal information, please tell us first so we can put it right: - Email [info@houseofattar.co.uk](mailto:info@houseofattar.co.uk) with the subject “Data protection complaint”, or message us on WhatsApp on 07952 709944. Tell us what happened and what you would like us to do. - We will confirm we have received your complaint within 30 days, usually within 2 working days. - We will look into it, keep you updated and tell you the outcome without undue delay. If you are not happy with our response, or we have not replied, you can complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: [ico.org.uk/make-a-complaint](https://ico.org.uk/make-a-complaint/) or 0303 123 1113. ## Cookies We use cookies and similar technologies. Only those needed to run the shop are set without your agreement. Statistics and marketing cookies are used only if you accept them. Our [Cookie Policy](https://houseofattar.co.uk/cookie-policy/) lists them and lets you change your choice at any time. ## Keeping your information safe The site uses an encrypted connection (HTTPS). Payments are handled by Stripe and PayPal, never on our own servers. Access to order and customer information is limited to the people who run the shop. If we have a data breach that puts you at risk, we will tell you and, where required, the ICO. ## Changes to this notice We will update this notice when the way we use personal information changes. The date at the top shows when it last changed. If a change significantly affects you, we will tell you by email if we have your address. ## Contact For any question about this notice or your information: [info@houseofattar.co.uk](mailto:info@houseofattar.co.uk), WhatsApp 07952 709944, or by post to House of Attar, 5 Brayford Square, London E1 0SG.