Privacy Policy

01

Who we are

HandFab makes handmade kitchen knives in Scotland. For the purposes of UK data protection law, we are the data controller for the personal information described in this policy, which means we decide how and why it is used.

[HARRY TO CONFIRM] Insert HandFab's correct legal name and trading status, the business or correspondence address, and confirm the data controller wording. UK GDPR requires the controller to be clearly identifiable.

02

Information we collect

When you visit the site, we automatically collect certain information about your device, including:

Your web browser, IP address, time zone, and cookies
Pages or products you view, and how you interact with the site

When you make, or attempt to make, a purchase, we collect personal information including:

Name
Billing and shipping address
Email address
Phone number
Payment information, processed securely by our payment provider. We do not store card details.

03

How we use your information

We use your information to:

Process and fulfil your orders
Communicate with you about your purchase
Arrange shipping and provide tracking information
Screen orders for potential risk or fraud
Improve and optimise our website and services

Where you have opted in, we may also use your email address to send occasional updates about new products or releases. You can unsubscribe at any time.

[HARRY TO CONFIRM] UK GDPR requires a stated lawful basis for each use (for example: contract for order fulfilment, legitimate interests for fraud screening, consent for marketing). Confirm and insert the lawful bases, and confirm the marketing opt-in mechanism matches what the store actually does.

04

Sharing your information

We share your personal information only with trusted third parties where necessary to run our business, such as:

Payment processors
Shipping and courier services
Website and e-commerce platform providers

We do not sell, rent, or trade your personal data.

[HARRY TO CONFIRM] Consider naming the key processors (for example Shopify as the platform, and the payment and courier providers actually used), as UK GDPR favours transparency about who data is shared with.

05

International customers

If you are located outside the UK, your information may be transferred to and processed in the UK, or in other countries where our service providers operate.

[HARRY TO CONFIRM] The original policy relied on "consent" for international transfers. Under UK GDPR, transfers usually rely on adequacy decisions or appropriate safeguards rather than consent. Confirm the correct basis and wording before publishing.

06

Data retention

We keep your personal information only for as long as necessary to fulfil orders, comply with our legal obligations, resolve disputes, and enforce our agreements.

[HARRY TO CONFIRM] UK GDPR expects a defined retention period or clear criteria (for example, order records kept for the period required by HMRC / tax law). Confirm the actual retention periods to insert here.

07

Your rights

If you are a UK or EU resident, you have the right to:

Access the personal data we hold about you
Request correction, updating, or deletion of your data
Withdraw consent for marketing communications at any time

To exercise any of these rights, please contact us at handfab.enquiries@gmail.com.

[HARRY TO CONFIRM] UK GDPR also gives rights to restrict processing, to data portability, and to object. Consider listing these for completeness, and add the right to complain to the Information Commissioner's Office (ICO), which a compliant UK policy should include.

08

Cookies

This website uses cookies to improve functionality and your experience. You can control or disable cookies through your browser settings, though some features of the site may not work correctly as a result.

[HARRY TO CONFIRM] If the site uses analytics or marketing cookies (for example Shopify analytics, Meta or Google pixels), PECR requires prior consent via a cookie banner, not just browser settings. Confirm which cookies are in use and whether a consent banner is needed, then expand this section accordingly.

09

Data security

We take reasonable steps to protect your personal information. However, no method of transmission over the internet or electronic storage is fully secure, and we cannot guarantee absolute security.

10

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or regulatory reasons. Any updates will be posted on this page.

Country/region