The Gingerbread House Gallery Ltd is committed to protecting your privacy and handling your personal data with transparency, integrity, and care. This policy outlines how we collect, use, store, and protect your information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

​

1. What Information We Collect

We may collect and process the following personal data:

•     Full name, email address, phone number

•     Billing and shipping address

•     Payment details (processed securely via third-party gateways)

•     Account login credentials

•     IP address, browser type, and device information

•     Purchase history and preferences

•     Communications with our support team

​

2. How We Use Your Data

We use your personal data to:

•     Process orders and deliver products

•     Provide customer support and respond to inquiries

•     Send transactional and promotional emails (with your consent)

•     Improve website functionality and user experience

•     Comply with legal obligations and prevent fraud

​

3. Legal Basis for Processing

We process your data under the following lawful bases:

•     Contractual necessity: To fulfill your orders and provide services

•     Consent: For marketing communications and optional features

•     Legal obligation: For tax, accounting, and regulatory compliance

•     Legitimate interest: To improve our services and prevent misuse

​

4. Data Sharing & Third Parties

We do not sell your personal data. We may share it with:

•     Payment processors (e.g., Stripe, PayPal)

•     Shipping providers

•     Email marketing platforms (with consent)

•     Legal or regulatory authorities when required

All third parties are contractually obligated to protect your data and comply with UK GDPR.

​

5. Data Retention

We retain your data only as long as necessary:

•     Account and order data: up to 6 years for legal compliance

•     Marketing data: until you withdraw consent

•     Support communications: up to 2 years

​

6. Your Rights

You have the right to:

•     Access your personal data

•     Correct inaccurate or incomplete data

•     Request deletion (“right to be forgotten”)

•     Restrict or object to processing

•     Withdraw consent at any time

•     Lodge a complaint with the Information Commissioner’s Office (ICO)

To exercise your rights, contact: Ginger@ladygingerlust.co.uk

​

7. Data Security

We implement robust security measures:

•     SSL encryption for all transactions

•     Secure servers and firewalls

•     Limited access to personal data by authorized staff only

​

8. International Transfers

If your data is transferred outside the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

​

9. Updates to This Policy

We may update this policy from time to time. Changes will be posted on this page with a revised “Last Updated” date.