Last updated: 11/11/2027
Who we are Water Sign Crafts is operated by [LEGAL SELLER NAME], of [FULL BUSINESS ADDRESS]. We are the controller of personal information we collect to run this business. Contact us about privacy at [PRIVACY/CONTACT EMAIL]. This policy explains how we use information when you visit our Shopify store, place an order, ask a question or join our mailing list. Information we collect and where it comes from We collect information you provide, including your name, email, billing and delivery addresses, telephone number where supplied, order details, messages and marketing preferences. For gifts and personalised products, the purchaser may provide another person's name and delivery details, including a child's first name. Shopify and our payment providers process payment and transaction information. We receive the transaction details needed to manage orders and refunds. Please do not send full payment-card details by email. Our store and service providers also collect technical information, such as IP address, browser/device information, pages visited and cookie choices, as permitted by your settings and applicable law. Why we use information and our lawful bases We use purchaser and order information to take payment, fulfil purchases, send order updates and deal with cancellations or refunds. Our lawful basis is performing our contract with you or taking steps you request before entering it. We keep records needed for tax, accounting and other statutory duties on the basis of legal obligation. We use relevant information to answer enquiries, administer the business, prevent fraud, maintain security and handle disputes. Where we rely on legitimate interests, those interests are running a secure, effective business and resolving customer issues. We consider people's rights and use only what is reasonably necessary. We use consent for our newsletter and other marketing emails. You can withdraw consent at any time through the unsubscribe link or by emailing us. Necessary order and service messages are separate from marketing. Children's details and gift recipients Our store is intended for adults purchasing products, although some products are for children. We receive children's names and recipient addresses from the purchaser, not through a request that children register or submit information themselves. We use these details to personalise and deliver the requested order. For recipients who are not the purchaser, our lawful basis is our legitimate interest in fulfilling the purchaser's gift or personalisation request, balanced carefully against the recipient's rights, particularly where a child is involved. Please share this notice with the recipient or their parent/carer where appropriate. Please provide only the information requested, normally a first name and delivery details. Do not include a child's school, date of birth, health information or other unnecessary personal details. Children's details are not used to send marketing to children. If you believe a child has submitted information directly, please contact us. Who we share information with We share relevant information with Shopify to host and operate our store; payment providers to process transactions; our postal/carrier providers to deliver orders; and professional advisers or authorities where necessary or legally required. [ADD THE ACTUAL EMAIL-MARKETING PROVIDER AND ANY OTHER APPS/PROVIDERS RECEIVING PERSONAL DATA, THEIR PURPOSES, AND ANY ADDITIONAL SHARING THAT APPLIES. REMOVE THIS INSTRUCTION AFTER CHECKING.] We use information for the purposes described here and do not publish customers' or children's personalisation details as marketing material without appropriate permission. Shopify and international processing Shopify hosts our store and processes information about visits and purchases to provide its services. Information may be processed outside the UK, including by Shopify and its service providers. Where required, transfers are protected by an applicable adequacy decision or approved contractual safeguards, such as UK-approved transfer arrangements. Contact us for information about relevant safeguards and how to obtain a copy. Read Shopify's Consumer Privacy Policy: https://www.shopify.com/legal/privacy/consumers Shopify's privacy portal: https://privacy.shopify.com [IF SHOPIFY NETWORK INTELLIGENCE IS ENABLED, RETAIN AND CHECK THE NEXT PARAGRAPH AGAINST SHOPIFY'S CURRENT GENERATED POLICY. IF DISABLED, REMOVE IT. REMOVE THIS INSTRUCTION BEFORE PUBLICATION.] We use Shopify Network Intelligence to provide enhanced services. Shopify processes information about your interactions with our store together with information from your interactions with other merchants and Shopify to help provide personalised experiences, relevant advertising and insights about store use. Information is shared with Shopify and relevant third parties, which may be outside the UK. Where consent is required, these uses depend on your choices. Use our cookie controls to change consent, and Shopify's privacy portal above to learn about withdrawing consent or objecting to Shopify's processing. Cookies and similar technologies Essential cookies support functions such as the basket, checkout and security. Optional analytics or advertising technologies are used only with the consent required by law. You can accept, reject or change optional choices using [EXACT LOCATION/LINK FOR YOUR STORE'S COOKIE PREFERENCES]. Blocking essential cookies may prevent parts of the store working. [INSERT OR LINK THE CURRENT COOKIE DETAILS FOR YOUR ACTUAL SHOPIFY CONFIGURATION AND APPS, INCLUDING PROVIDERS, PURPOSES AND DURATIONS. REMOVE THIS INSTRUCTION AFTER COMPLETING.] How long we keep information We keep order and accounting records for the periods needed to meet applicable tax and legal requirements, resolve complaints and establish or defend claims. Those requirements, the type of record and whether an issue remains open determine retention. Separate working files used to personalise products are deleted after [PERSONALISATION WORKING-FILE RETENTION PERIOD], unless needed to resolve an outstanding issue. Some necessary order information may remain within order records for the reasons above. We retain enquiry messages while needed to respond and resolve related issues. Marketing information is retained while we have valid consent and a continuing purpose. After an unsubscribe request we may keep a minimal suppression record to ensure we do not send unwanted marketing. Your rights and choices Depending on the circumstances, you may ask to access or correct information, request deletion, restrict processing or receive a portable copy. You can withdraw consent at any time without affecting earlier lawful processing. These rights are subject to legal conditions; for example, some records must be kept to meet legal duties. You have the right to object to processing based on legitimate interests. You can always object to the use of your personal information for direct marketing. Contact [PRIVACY/CONTACT EMAIL] to exercise your rights. We may need proportionate information to confirm your identity and authority if acting for someone else. We normally respond within one month, subject to lawful extensions. Concerns and complaints Please contact us if you have a concern. You can also complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ without first complaining to us. Changes to this policy We update this policy when our practices change. The date above shows the latest version.