Privacy policy

Last updated: 1 October 2026

This policy explains how Mercian Minis collects and uses your personal data, and your rights under UK data protection law. Mercian Minis is the data controller for the information you give us.

What we collect

Depending on how you use the shop, we collect:

when you order: your name, email address, and delivery address, and your order details (items, prices, and order history);
if you create an account:your email address and a securely hashed version of your password (we never store the password itself), whether you’ve verified your email, and what you save to it — your wishlist and saved basket;
if you collect blessings(our loyalty points): what you’ve earned, spent, and had expire, and when;
if you sign up for our emails: your email address and when you confirmed your subscription;
to protect our first-order offer from misuse: a card identifier provided by Stripe (not your card number) and a scrambled, one-way code made from your delivery address, so we can spot the same card or address being used to claim the offer more than once;
when you use the site: your IP address, briefly, to limit repeated sign-in and sign-up attempts;
any messages you send us.

We do not see or store your full card or PayPal account details — payments are handled directly by Stripe and PayPal (see below).

Why we use it, and our lawful basis

to take payment, fulfil, and deliver your order, and to provide customer support — this is necessary to perform our contract with you;
to keep records of sales — to comply with our legal and tax obligations;
to run your account, wishlist, saved basket, and blessings balance (including emailing you before blessings expire) — to perform our contract with you;
to stop our offers being claimed more than once, and to keep sign-in secure — in our legitimate interest in preventing fraud and misuse;
to respond to enquiries — in our legitimate interest in helping customers;
to send our newsletter — only with your consent, which you give by confirming your subscription from the email we send you.

We don’t send you marketing without your consent. Every newsletter has an unsubscribe link, and unsubscribing takes effect straight away.

Who we share it with

We share only what’s needed with the service providers that help us run the shop, each acting on our instructions:

Stripe — card and other payment processing;
PayPal — if you choose to pay with PayPal (PayPal also handles your data under its own privacy policy);
Resend — sending our emails (orders, shipping, your account, blessings reminders, and the newsletter);
Royal Mail — delivery of your order, including emailing you tracking updates as your parcel moves;
Cloudflare and Railway — hosting, running, and securing the website and the data behind it.

We don’t sell your personal data to anyone.

International transfers

Some of these providers (including Stripe, PayPal, Resend, Cloudflare, and Railway) process data outside the UK, mainly in the United States. Where your data is transferred outside the UK, we rely on safeguards recognised under UK data protection law — such as the UK International Data Transfer Agreement, or the UK addendum to the EU Standard Contractual Clauses — so that it stays protected to the same standard.

How long we keep it

We keep order and transaction records for as long as needed to provide the service and to meet our legal and accounting obligations (generally six years for tax records), then delete them. Your account stays until you ask us to close it. Blessings expire 12 months after the order that earned them. We keep your newsletter subscription until you unsubscribe. IP addresses used for rate limiting are held in memory only and cleared within an hour.

Your rights

You have the right to access, correct, or erase your personal data, to restrict or object to its processing, and to data portability. To exercise any of these, email hello@mercianminis.co.uk. If you’re unhappy with how we handle your data you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Cookies

We only use essential storage: your basket (and the reference of the order you just placed) is kept in your own browser’s storage, and a sign-in cookie keeps you logged in to your account. We don’t use analytics or advertising cookies, so there’s no cookie banner to click through.

Contact

Mercian Minis, 2 Sycamore Drive, Truro, United Kingdom, TR4 9FU — hello@mercianminis.co.uk. See also our contact page.