1. Who This Policy Applies To

This Policy applies to personal data belonging to:

• Visitors — individuals who browse our website;
• Customers — individuals who purchase, request or receive our products;
• Contacts — individuals who contact us via our website, email or other means.

2. What We Collect

We may collect, store, process and use the following categories of personal data:

• From visitors: IP address and other device identifiers;
• From customers: name, email address, billing address, delivery address, payment information, and telephone number (where provided);
• From contacts: name, email address, and any other information you choose to share with us.

Where mandatory information is not provided, we may be unable to fulfil your order, respond to your enquiry, or provide access to parts of our website.

3. Our Legal Basis and Purpose for Processing

Under UK GDPR, we rely on the following legal bases to process your personal data:

• Performance of a contract — to process and fulfil your orders, manage your account, and handle payments;
• Legitimate interests — to monitor and improve our website, prevent fraud, and maintain security, provided this does not override your rights;
• Consent — for direct marketing communications, which you may withdraw at any time;
• Legal obligation — where we are required to retain or disclose data to comply with the law.

4. Who We Share Your Data With

We may disclose your personal data to:

• Our staff, where relevant to their role;
• Shopify Inc., our e-commerce platform provider;
• Payment processors, to facilitate and secure your payment;
• Delivery and fulfilment partners, to deliver your order;
• IT, hosting, and data analytics providers who support our website;
• Professional advisors, insurers, or authorities, where necessary for legal, security, or regulatory purposes;
• A buyer or successor, in the event of a merger, acquisition, or sale of the business.

Where a service provider is located outside the UK, we take reasonable steps to ensure your data continues to receive an appropriate level of protection, in line with UK GDPR requirements on international transfers.

We do not sell your personal data to third parties.

5. Cookies

Our website uses cookies to operate correctly, remember your preferences, and understand how our site is used. Full details of the cookies we use and how to manage them are set out in our Cookie Policy, which forms part of this Privacy Policy.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. Once no longer required, your data will be securely deleted or anonymised.

7. Your Rights

Under UK GDPR, you have the right to:

• Request access to the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request erasure of your data, in certain circumstances;
• Request restriction of, or object to, our processing of your data;
• Request a portable copy of your data;
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at support@maisielondon.com. We may need to verify your identity before responding.

If you are unhappy with how we have handled your personal data, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Direct Marketing

With your consent, we may use your name and email address to send you marketing communications, including promotions, offers, and product updates. You may opt out at any time by contacting us or using the unsubscribe link in any marketing email.

9. Children's Privacy

Our website and products are intended for adults. We do not knowingly collect personal data from children.

10. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or unlawful processing.