PRIVACY POLICY

Pop! Shop ("we", "us", "our") is a vintage and retro shop based at 1 Stanhope Road, Deal, Kent, CT14 6AB. We are the data controller for any personal data you share with us through this website.

If you have any questions about this policy or how we use your data, you can reach us using the contact details at the bottom of this page.

We only collect the data we need to process your orders, respond to enquiries, and keep you informed about new stock:

• When you place an order: your name, email address, phone number, shipping address, and payment details. Payment is processed securely by Stripe — we never see or store your full card number.
• When you sign up to our newsletter: your email address (and name, if you provide it).
• When you submit a sell request: your name, email, phone number, description of your items, and any photos you upload.
• When you contact us: any information you include in your message.
• Automatically: basic browsing data (such as pages visited) via standard analytics cookies. This is anonymised and used only to improve the site.

We use your personal data for the following purposes:

• To process and fulfil your orders, including shipping and tracking.
• To communicate with you about your order or enquiry.
• To send you our newsletter if you have opted in (you can unsubscribe at any time).
• To assess and respond to sell requests you submit to us.
• To prevent fraud and comply with our legal obligations.

We rely on the following legal bases under the UK GDPR: contract (to fulfil your order), consent (for newsletter sign-ups), legitimate interests (to respond to enquiries and run our business), and legal obligation (for record-keeping and tax compliance).

We do not sell or rent your personal data. We share it only with the following trusted third parties when necessary:

• Stripe — processes your payments securely.
• Evri — delivers your orders (we share your name and shipping address only).
• Resend — sends our newsletter and order confirmation emails on our behalf.
• Google — analytics to help us understand how the site is used (anonymised data only).

We may also share data if required by law, for example with HMRC or law enforcement agencies.

We keep order and customer data for as long as legally required for tax and accounting purposes (typically 6 years). Newsletter subscriber data is kept until you unsubscribe. Sell request data is kept for 12 months unless you ask us to delete it sooner.

This website uses a minimal set of cookies to function properly. These include essential cookies (such as your shopping cart contents) and analytics cookies (to understand how visitors use the site). You can control cookies through your browser settings. Disabling cookies may affect some site functionality such as the shopping cart.

Under the UK GDPR and Data Protection Act 2018, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data (subject to legal retention requirements).
• Restriction — ask us to limit how we use your data.
• Portability — receive your data in a machine-readable format.
• Objection — object to how we process your data.
• Withdraw consent — at any time, for data processed on the basis of consent (such as the newsletter).

To exercise any of these rights, email us at hello@pop-shop.uk. We will respond within one month.

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Our website is not directed at children under 16, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

We take appropriate technical and organisational measures to protect your personal data, including encrypted payment processing via Stripe, secure data storage, and access limited to authorised personnel only. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated date. We recommend checking back periodically.