Privacy notice

Mindful Walls Ltd (company number 00000000), trading as Mindful Walls, of 1 Example Street, London, SW1A 1AA, United Kingdom, is the data controller for the information described here. That means we decide what is collected and why, and we are accountable for it.

For anything about your personal information — a question, a correction, or a request to delete it — email hello@mindfulwalls.example. We aim to reply within two working days and are required to deal with a formal request within one month.

Information you give us:

• Your name, email address, delivery and billing address, and phone number if you give one.
• Your order history, and the contents of your basket while you are shopping.
• Your password, stored as a one-way hash we cannot reverse, if you create an account.
• Anything you write to us in an email, and our replies.

Information we are given about you:

• From our payment provider: confirmation that a payment succeeded or failed, the card type and last four digits, and the result of their fraud checks. We never receive your full card number, expiry date or security code.
• From the delivery carrier: tracking and delivery status.

Information collected automatically when you use the site: your IP address, browser and device type, the pages you looked at, and the small set of cookies described below. We do not build a profile of you from this, and we do not attempt to identify you by it.

We do not ask for and do not want special category data — health, beliefs, ethnicity, politics. Some prints are drawn from religious and philosophical traditions; what you buy is not treated as evidence of what you believe, and it is not used to target you.

UK data protection law requires a lawful basis for each use. Ours are:

Fulfilling your order

Taking payment, printing, packing, arranging delivery, and emailing you confirmations and tracking. Basis: performance of our contract with you. Without this information we cannot send you anything.

Running your account

Signing you in, showing your order history, and keeping your saved addresses. Basis: performance of our contract with you.

Dealing with returns, refunds and complaints

Basis: performance of our contract, and compliance with our legal obligations under consumer law.

Keeping records of sales

Order and tax records are kept for six years. Basis: legal obligation.

Preventing fraud and keeping the site secure

Checking payments, rate-limiting, and investigating misuse. Basis: our legitimate interests in not being defrauded and in protecting other customers, balanced against the limited intrusion involved.

Understanding how the site is used

Aggregate, non-identifying measurement of which pages are visited. Basis: our legitimate interests in a site that works. If we ever introduce analytics that can single you out, we will ask for your consent first.

Sending marketing emails

Only if you have asked for them. Basis: your consent, which you can withdraw at any time using the unsubscribe link in any email or by replying to it. We do not add customers to a mailing list because they bought something.

Where we rely on legitimate interests you have the right to object, and we will stop unless we have a compelling reason not to that we can explain to you.

The site uses a small number of cookies that are strictly necessary for it to function, which is why you are not asked to consent to them:

• One that remembers your basket, so it survives a page reload.
• One that remembers which country and currency you are shopping in.
• One that keeps you signed in to your account, if you have one.
• Cookies set by our payment provider during checkout, to protect against fraud and to keep the payment session together.

There are no advertising cookies, no third-party trackers and no cross-site profiling. If that changes we will ask for your consent before setting anything, rather than after.

You can block or delete cookies in your browser, but blocking the ones above will stop the basket and sign-in from working.

We do not sell your personal information, and we do not share it for anyone else's marketing. We do use a small number of suppliers who process it on our instructions, under contracts that require them to keep it secure and to use it for nothing else:

• Our payment provider, to take payment and check for fraud.
• Our print and fulfilment partner, to produce and pack your order.
• Our delivery carrier, who needs your name, address and phone number to deliver.
• Our email provider, to send order confirmations, delivery updates and — if you asked for them — marketing emails.
• Our hosting and infrastructure providers, who host the site and the database it runs on.

We may also disclose information where the law requires it, to our professional advisers where they need it, and to a buyer if the business is ever sold — in which case this notice would continue to apply to information collected before the sale.

Some of our suppliers process information outside the United Kingdom. Where they do, we only use them if the transfer is protected — either the country has been formally recognised as providing adequate protection, or the contract includes the UK's International Data Transfer Agreement or the addendum to the EU standard contractual clauses.

You can ask us which suppliers are involved and where, and we will tell you. Email hello@mindfulwalls.example.

Order and payment records

Six years after the end of the tax year they fall in, because HMRC requires it.

Your account

For as long as you have one. Ask us to close it and we will delete it, keeping only the order records above.

Emails between us

Two years after the conversation ends, or six years where it concerns a complaint or a claim.

Marketing consent

Until you withdraw it, plus a note that you unsubscribed so we do not email you again by mistake.

Site and server logs

Up to 90 days.

You have the following rights over your personal information, free of charge:

To see it

Ask for a copy of what we hold about you and why.

To correct it

Have anything inaccurate or incomplete put right.

To have it deleted

Where we no longer need it. We cannot delete order records we are legally required to keep, and we will say so rather than quietly ignoring the request.

To restrict what we do with it

Ask us to pause using it while a dispute about its accuracy or our basis for holding it is resolved.

To object

To any use we base on legitimate interests, and to marketing at any time, with no reason needed.

To take it with you

Receive the information you gave us in a portable, machine-readable format.

To withdraw consent

Where consent is what we relied on. Withdrawing it does not undo what was lawful beforehand.

To use any of them, email hello@mindfulwalls.example. We may ask you to confirm who you are before we release information — that protection is for you. We will respond within one month, and tell you if we need longer because a request is complex.

The site is served over HTTPS. Passwords are stored as one-way hashes rather than as passwords. Access to customer data is limited to the people who need it to do their job, and card details never reach our systems at all.

No system is perfectly secure. If a breach happens that is likely to put your rights at risk, we will tell you and the Information Commissioner's Office without undue delay.

This shop is not directed at children, and we do not knowingly collect information about anyone under 16. If you believe a child has given us their details, tell us and we will delete them.

We will update this page when what we do changes, and the date at the top always reflects the current version. If a change materially affects how we use information we already hold about you, we will email you rather than rely on you rereading this page.

Please tell us first, at hello@mindfulwalls.example, and give us a chance to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK's independent regulator for data protection, at any time — you do not have to come to us first. ICO: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113, or ico.org.uk.