Privacy & Cookie Policy
Hobby Heaven (hobbyheaven.co.uk) Last updated: 29/08/2026
This Privacy & Cookie Policy explains how Hobby Heaven (“we”, “us”, “our”) collects, uses, and protects personal data when you visit hobbyheaven.co.uk (the “Site”) or place an order with us. It is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).
1. Who we are
Hobby Heaven is the data controller for the personal data described in this policy.
- Trading name: Hobby Heaven
- Contact email: [email protected]
If you have any questions about this policy or how we handle your data, contact us at the email address above.
2. What personal data we collect
We collect the following categories of personal data:
- Account and order data: name, billing and delivery address, email address, telephone number, order history, and correspondence with us.
- Payment data: we do not store full card details. Payments are processed by our third-party payment processor (WooPayments), who acts as an independent data controller for that data. We retain only transaction references and the last four digits of the card where provided to us by the processor.
- Usage data: pages visited, referring pages, device/browser type, approximate location (derived from IP address), and time spent on pages, collected via our self-hosted analytics (see Section 5).
- Marketing preferences: whether you have opted in to marketing communications.
We do not knowingly collect special category data (e.g. health data, religious beliefs) and ask that you do not submit such data to us via contact forms or order notes.
3. How we use your data and our legal basis
| Purpose | Legal basis |
|---|---|
| Processing and fulfilling your order, including delivery and returns | Performance of a contract |
| Customer service and handling queries or complaints | Performance of a contract / legitimate interests |
| Fraud prevention and payment verification | Legal obligation / legitimate interests |
| Site analytics to understand usage and improve the Site | Legitimate interests |
| Sending order-related communications (confirmations, dispatch notices, returns updates) | Performance of a contract |
| Sending marketing emails | Consent (only where you have opted in) |
| Complying with tax, accounting, and consumer protection law | Legal obligation |
You may withdraw consent to marketing at any time by using the unsubscribe link in any marketing email or by contacting us.
4. Who we share your data with
We share personal data only where necessary, with:
- Delivery couriers, to fulfil your order.
- Payment processors, to process payments and refunds.
- IT hosting and email service providers who process data on our behalf under a data processing agreement.
- HMRC and other authorities, where required by law.
- Professional advisers (e.g. accountants, solicitors) where necessary.
We do not sell personal data to third parties, and we do not share data with advertising networks or ad-tech platforms.
5. Analytics and cookies
We do not use a cookie consent banner on this Site, for the following reasons:
- The Site uses strictly necessary cookies only — for example, cookies required to operate your shopping basket, remember items in your cart, maintain your logged-in session, and protect against fraud (e.g. CSRF tokens). Under PECR (Regulation 6), cookies that are strictly necessary to provide a service you have requested do not require consent.
- Our website analytics are provided by Umami, which we host ourselves on our own infrastructure. Umami is configured to operate without cookies and without any persistent identifier or local storage, and it does not track visitors across sessions or across other websites. Because it does not store or access information on your device, this analytics activity falls outside the scope of PECR’s consent requirement, which applies specifically to storage of, or access to, information on a user’s terminal equipment.
- Umami data is aggregated and does not identify you personally. IP addresses are not stored in identifiable form.
If this changes in future (for example, if we introduce cookie-based or third-party analytics, advertising cookies, or session tracking beyond what’s strictly necessary), we will update this policy and implement a consent mechanism as required by law at that time.
A full list of the strictly necessary cookies currently in use is available on request.
6. International transfers
Where any of our service providers store data outside the UK, we ensure appropriate safeguards are in place, such as the UK’s International Data Transfer Agreement or adequacy regulations.
7. Data retention
We retain personal data only for as long as necessary:
- Order and transaction data: 6 years, to meet tax and accounting obligations.
- Account data: for as long as your account is active, plus a reasonable period afterwards.
- Marketing consent records: until you withdraw consent, plus a record of that withdrawal.
- Analytics data: aggregated and anonymised; not linked to individuals.
8. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request erasure of your data, subject to our legal obligations (e.g. we must retain order records for tax purposes).
- Restrict or object to certain processing.
- Request data portability.
- Withdraw consent at any time where processing is based on consent.
- Lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.
To exercise any of these rights, contact us using the details in Section 1. We may need to verify your identity before actioning a request.
9. Security
We use appropriate technical and organisational measures to protect personal data, including encrypted transmission (HTTPS), access controls, and secure hosting. No system is completely secure, and we cannot guarantee absolute security of data transmitted to the Site.
10. Children
The Site is not directed at children under 16, and we do not knowingly collect personal data from children.
11. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top will reflect the most recent changes. Continued use of the Site after changes constitutes acceptance of the updated policy.
12. Contact us
For any questions about this policy or your personal data, contact: [email protected]
You can also contact the ICO if you believe your data protection rights have been infringed: ico.org.uk / 0303 123 1113.