Privacy Notice

1. Who is responsible for your data

Holly & Thistle is the data controller for the personal information we use to handle enquiries and provide our workshops and gift vouchers. For privacy questions or rights requests, email hello@hollyandthistle.uk.

2. Information we use and why

• Enquiries and bookings: your name, email address, workshop choice, London or Cheshire location, town or area, number of guests and any notes you add. We use these to reply, arrange workshops and provide the service. Our legal basis is taking steps at your request before a contract and performing that contract.
• Voucher purchases: buyer email address, selected workshop, voucher code and payment transaction references received from Paddle. We use these to issue and email vouchers, arrange redemption, assist with refunds and maintain order records. Our bases are contract performance and applicable legal record-keeping obligations.
• Correspondence: support messages and any information you choose to send. We use them to answer questions and resolve issues, based on contract performance or our legitimate interest in providing customer support.
• Technical information: our hosting and payment providers may process IP addresses, device and browser information, request logs and error or security diagnostics to operate and protect the site. The basis is our legitimate interest in maintaining a safe and reliable service.

Please avoid putting sensitive personal information in the enquiry form. If you need to discuss an allergy or accessibility requirement, contact us so we can agree how to handle that information appropriately, including obtaining explicit consent where required.

We do not use enquiry details to enrol you automatically in marketing. If we introduce optional email marketing, we will request any required consent and provide an unsubscribe option.

3. Who receives information

Our founders and authorised service providers use information only as needed for their roles. Providers include Lovable Cloud for website hosting and private data storage, managed email delivery services for enquiry notifications and voucher emails, and Google Fonts, which receives your IP address when loading the website’s fonts.

We share necessary order information with Paddle, our Merchant of Record, for product sales, payments, tax compliance, invoicing and any applicable subscription management. Our current gift vouchers are one-off purchases. Paddle collects and handles payment information under its own Privacy Policy; we do not store full payment card details.

We may also share necessary information with professional advisers, such as legal or accounting advisers, and with authorities when required by law. We do not sell personal information.

4. International transfers

Our hosting, email and payment providers may process information outside the UK or EEA. Where a transfer requires safeguards, we rely on applicable adequacy decisions or approved contractual safeguards, such as the UK International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses, as appropriate. Contact us for information about the safeguards relevant to your data.

5. How long we keep information

We keep enquiry and booking information only for as long as needed to respond, arrange and deliver the workshop, and deal with follow-up questions or disputes. Voucher and transaction records are retained as necessary to manage redemption and refunds and meet applicable accounting or legal obligations.

Retention depends on the purpose, whether an enquiry becomes a booking and any legal requirements. We review information and delete or anonymise it when it is no longer needed. Contact us if you would like information about retention for your particular record.

6. Your rights

Under UK GDPR and, where applicable, EU GDPR, you may request access, correction, erasure, restriction of processing or data portability, and object to processing based on legitimate interests. Where we rely on consent, you may withdraw it at any time without affecting earlier lawful processing. Some rights have legal exceptions.

Email us to exercise your rights. We may need to verify your identity and will normally respond within one month. If a lawful extension is necessary, we will explain it within that month. We do not make solely automated decisions with legal or similarly significant effects about you.

You may complain to the UK Information Commissioner’s Office or your local supervisory authority. We would welcome the opportunity to address your concerns first.

7. Security

We use appropriate technical and organisational measures, including encrypted connections, access controls and private storage for enquiry and voucher records. No internet service can guarantee absolute security. Please do not send payment card details by email or through the enquiry form.

8. Cookies and browser storage

The website and its checkout may use essential cookies or similar browser storage for technical operation, security and payment processing. Paddle may use storage within its checkout as described in its own privacy information. We have not added optional advertising or marketing cookies to this website.

You can manage cookies and site storage in your browser settings; blocking essential storage may prevent checkout or other parts of the site from working. If we introduce non-essential analytics or marketing cookies, we will provide information and obtain consent before using them where required.

9. Changes to this notice

We may update this notice as our service changes. The date above identifies the latest version. We will provide additional notice of material changes where required.