Privacy notice
1. Who we are
Birkeby is a trading name of BIRKEBY LTD (company number 17520256, registered in England and Wales), which is the controller of your personal data. Registered office: 128 City Road, London, United Kingdom, EC1V 2NX. Email: tomas@birkeby.co.uk. We have not appointed a data protection officer.
2. What we collect
- When you pre-order or buy: your name, email address, delivery address and what you ordered. Card details are collected by Stripe; we never see your full card number.
- When you email us or use our complaint form: your name, email address and what you tell us.
- When you browse: a random visitor number stored in a cookie, the price shown to you, the pages you view, the website that sent you (its name only) and any campaign tags in the link you followed. This does not include your name, email or IP address. Our hosting provider processes your IP address to deliver the site and keeps it in short-lived server logs.
3. Why we use it, and our legal basis
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Taking, delivering and supporting your order, including refunds and cancellations | Contract (Art. 6(1)(b)) |
| Keeping sales and tax records | Legal obligation (Art. 6(1)(c)) |
| Visit statistics: counting visitors, pre-orders and the price shown, so we can tell which price and which pages work | Legitimate interests (Art. 6(1)(f)): understanding how the shop is used so we can improve it. You can turn this off on our cookies page, and you can object at any time. |
| Answering your questions and handling complaints | Legitimate interests (Art. 6(1)(f)), and legal obligation where the law sets how we must respond |
We do not send marketing emails, and we do not use advertising or social media tracking on this site.
4. Who we share it with
- Stripe, which processes payments and screens them for fraud. Stripe also uses some data as a separate controller, for fraud prevention and its own legal duties (see stripe.com/privacy).
- Vercel, which hosts this website.
- Upstash, which stores our visit statistics and complaint records.
- Google, which provides our email (Google Workspace).
- Our delivery company and, if we use one, our fulfilment warehouse, which receive your name and delivery address to send your order.
- Our professional advisers and HM Revenue & Customs, where needed.
If we set up a limited company to run Birkeby, we will transfer your details to it and tell you by email.
5. International transfers
Stripe, Vercel, Upstash and Google may process data in the United States. Where a provider is certified under the UK Extension to the EU-US Data Privacy Framework, we rely on the UK-US data bridge (the Data Protection (Adequacy) (United States of America) Regulations 2023). Otherwise we rely on the provider's International Data Transfer Agreement or Addendum.
6. How long we keep it
- Order and payment records: six years, to meet UK tax record-keeping rules.
- Emails about an order or question: up to two years after our last contact, unless part of an order record.
- Complaints made through our complaint form: three years from the date we receive them.
- Visit statistics: twelve months, then deleted.
7. Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to how we use it, and to receive a copy in a portable format. Where we rely on consent, you can withdraw it at any time without affecting what we did before. To use any of these rights, email tomas@birkeby.co.uk.
8. Complaints
If you are unhappy with how we handle your data, tell us first at tomas@birkeby.co.uk or using our complaint form. We will acknowledge your complaint within 30 days and respond without undue delay. You can also complain to the Information Commissioner: ico.org.uk/make-a-complaint, 0303 123 1113.
9. Do you have to give us your data?
No. You can browse without giving us anything. To pre-order, we need your name, email and delivery address, or we cannot deliver your order.
10. Automated decisions
We do not make decisions about you by automated means. Stripe screens payments for fraud automatically and may decline a payment it considers high risk.
11. Cookies
We use two small first-party cookies and no advertising cookies. See our cookies page.