Privacy Policy

Last updated: 28th September 2026

At Holy Poly, we respect your privacy and are committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and protect your personal information when you visit our website, purchase our polymer clay handmade jewellery and other products, contact us, or otherwise interact with our business.

We are a small independent business based in the United Kingdom and this Privacy Policy is intended to explain our practices in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Holy Poly is the data controller responsible for your personal information.

Business name: Holy Poly UK
Business owner: Mrs Luisa Bonello
Business address: Swindon, Wiltshire, SN5 5DY
Email: TBC
Website: TBC

If you have any questions about how we use your personal information, please contact us using the details above.

2. What personal information we collect

Depending on how you interact with us, we may collect some or all of the following information:

Information you provide when placing an order

  • Your name

  • Billing address

  • Delivery address

  • Email address

  • Telephone number, if provided

  • Details of the products you purchase

  • Order number and transaction details

  • Any information you provide in an order note or customer message

Information you provide when contacting us

If you contact us by email, contact form, social media or another method, we may collect:

  • Your name or username

  • Your contact details

  • The contents of your message

  • Any photographs or other information you choose to send us

Website information

When you visit our website, certain technical information may be collected automatically, such as:

  • IP address

  • Browser and device type

  • Operating system

  • Pages visited

  • Approximate location derived from your IP address

  • Date and time of visits

  • Website activity and referring websites

The information collected depends on the technology and services used by our website.

Cookies

Our website may use cookies and similar technologies to make the website function, remember your preferences, understand how visitors use our website and, where applicable, provide relevant marketing.

Some cookies are necessary for the website to operate. Other, non-essential cookies will only be used where we have the appropriate legal basis or consent required by law.

Please see our Cookie Policy for more information about the cookies we use and how you can manage them.

3. How we use your personal information:

We may use your information to:

  • Process and fulfil your orders

  • Take payment for your purchases

  • Arrange delivery of your purchases

  • Communicate with you about your order

  • Respond to enquiries and customer-service requests

  • Handle returns, refunds and complaints

  • Provide and maintain our website

  • Improve our products, website and customer experience

  • Keep appropriate business and financial records

  • Prevent and detect fraud or misuse of our website

  • Comply with legal and regulatory obligations

  • Send marketing communications where you have given permission or where another lawful basis permits us to do so

We will only use your personal information for purposes that are compatible with the reasons for which it was collected.

4. Our lawful bases for using your information

Under UK data protection law, we need a lawful basis for processing personal information.

Depending on the circumstances, we may rely on the following lawful bases:

Contract

We use information that is necessary to enter into or fulfil a contract with you.

For example, when you purchase a piece of polymer clay jewellery from us, we need your name, delivery address and contact details to process and deliver your order.

Legal obligation

We may process information where necessary to comply with a legal obligation.

For example, we may need to retain certain transaction and financial records for tax and accounting purposes.

Legitimate interests

We may use your information where it is necessary for our legitimate business interests, provided that those interests are not overridden by your rights and interests.

This may include administering and improving our website, responding to enquiries, protecting our business from fraud and maintaining appropriate business records.

Consent

Where required, we will ask for your consent before processing your information.

For example, we may ask for your consent before sending certain marketing communications or using certain non-essential cookies.

Where we rely on consent, you can withdraw it at any time.

5. Payment information

Payments made through our website may be processed by third-party payment providers such as [STRIPE / PAYPAL / SHOPIFY PAYMENTS / OTHER PROVIDER].

Depending on the payment method you use, your payment information may be provided directly to the relevant payment provider.

We do not normally have access to or store your full debit or credit card number.

Payment providers may process your information in accordance with their own privacy policies and terms.

6. Delivery information

To fulfil your order, we may share relevant information such as your name and delivery address with postal or courier services, including [ROYAL MAIL / EVRI / DPD / OTHER PROVIDER].

We only provide the information reasonably necessary to deliver your order.

7. Other third parties we may use

We may use trusted third-party providers to help us operate our business and website.

These may include:

  • Website hosting providers

  • E-commerce platforms

  • Payment providers

  • Delivery and postal services

  • Email service providers

  • Accounting and bookkeeping services

  • Website analytics providers

  • Customer-service tools

  • Marketing and newsletter platforms

  • Website security and fraud-prevention providers

Where a third party processes personal information on our behalf, we take reasonable steps to ensure that appropriate data-protection arrangements are in place.

Important: You should replace this section with the actual services your business uses. Do not list providers that you do not use.

8. Social media

We may operate social media accounts or provide links to social media platforms from our website.

If you interact with us through social media, the relevant social-media platform may collect and process your personal information according to its own privacy policy.

We may receive information such as your username, profile name, comments or messages when you interact with our social-media accounts.

We are not responsible for the privacy practices of third-party social-media platforms.

9. Marketing

If you choose to subscribe to our marketing communications, we may use your name and email address to send you information about:

  • New jewellery collections

  • New products

  • Special offers

  • Discounts

  • Business news

  • Other information about [BUSINESS NAME]

You can unsubscribe from marketing emails at any time by clicking the unsubscribe link included in our emails or by contacting us at [EMAIL ADDRESS].

We will not sell your personal information to third parties for their own marketing purposes.

10. How long we keep your information

We only keep personal information for as long as reasonably necessary for the purposes for which it was collected.

Different types of information may be retained for different periods.

For example:

  • Order and transaction information: We may retain this for the period required for accounting, tax and legal purposes.

  • Customer-service correspondence: We may retain this for as long as reasonably necessary to deal with your enquiry and maintain appropriate business records.

  • Marketing information: We will generally retain this until you unsubscribe or we determine that the information is no longer required.

  • Website and analytics information: Retention periods may depend on the relevant technology or service provider.

When personal information is no longer required, we will securely delete it or anonymise it where appropriate.

11. How we protect your information

We take reasonable technical and organisational measures to protect personal information against accidental loss, unauthorised access, alteration, disclosure or destruction.

These measures may include:

  • Using secure website connections where appropriate

  • Restricting access to personal information

  • Using passwords and account security measures

  • Keeping relevant software and systems updated

  • Using reputable payment and service providers

  • Taking reasonable precautions when handling customer information

However, no method of transmitting or storing information online can be guaranteed to be completely secure.

12. International transfers

Some of the third-party services we use may process personal information outside the United Kingdom.

Where this happens, we will take appropriate steps to ensure that your personal information receives an appropriate level of protection in accordance with applicable data protection law.

The safeguards used may include an adequacy decision, appropriate contractual safeguards or another lawful transfer mechanism.

13. Your data protection rights

Depending on the circumstances, you have rights under UK data protection law, including the right to:

  • Ask for a copy of the personal information we hold about you

  • Ask us to correct inaccurate or incomplete information

  • Ask us to delete your personal information in certain circumstances

  • Ask us to restrict how we use your information in certain circumstances

  • Object to certain types of processing

  • Ask for your information to be provided to you or another organisation in a portable format, where applicable

  • Withdraw consent where we rely on consent to process your information

These rights are not absolute and certain legal exceptions may apply.

To exercise your rights, please contact us at:

[EMAIL ADDRESS]

We may need to verify your identity before completing certain requests.

14. Complaints

If you have concerns about how we have handled your personal information, please contact us first using the details in this Privacy Policy so that we have an opportunity to resolve your concern.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).

You can find information about making a complaint on the ICO's website.

15. Children's privacy

Our website and products are intended for a general audience and are not specifically directed at children.

We do not knowingly collect personal information from children where we are not legally permitted to do so.

If you believe that a child has provided us with personal information inappropriately, please contact us at [EMAIL ADDRESS].

16. Third-party websites

Our website may contain links to websites operated by third parties.

This Privacy Policy does not apply to those websites. We recommend checking the privacy policy of any third-party website you visit.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our business, website, services or applicable data protection requirements.

When we make significant changes, we will update the "Last updated" date at the top of this policy and, where appropriate, provide additional notice.

We recommend checking this page occasionally to make sure you are aware of any changes.

18. Contact us

If you have any questions about this Privacy Policy or how we handle your personal information, please contact:

Holy Poly UK
Email: [EMAIL ADDRESS]
Address: Swindon, Wiltshire SN5 5DY

Last updated: 28th September 2026