Legal

privacy notice

Template · check before launchThis page is a plain-English template. It has not been reviewed by a lawyer. The owner must check it, fill in the business details and remove this note before the site goes live.

Last updated: 27 October 2026

Who we are

Pawlm, Business address added before launch, shoppawlm@gmail.com is the controller of your personal data. If you have any questions about this notice, email us.

What we collect and why

When you order

Checkout runs on Stripe. Stripe collects your name, email, UK delivery address, optional phone number and payment details. We receive your name, email, address, phone number and what you ordered. We never see or store your full card number.

We use this to deliver your order, send updates and tracking, handle returns and keep the accounting records the law requires. The lawful basis is performing our contract with you, and legal obligation for tax records.

When you email us

We keep your email and our reply so we can help you. The lawful basis is our legitimate interest in answering your questions.

Newsletter (only if you sign up)

If we offer a newsletter and you sign up, we keep your email address to send it. The lawful basis is your consent, which you can withdraw at any time using the unsubscribe link.

Visiting the site

The site is hosted on Cloudflare Pages. Cloudflare processes technical data such as your IP address to deliver the site and protect it from attacks. We use Cloudflare Web Analytics, which counts visits without cookies and without identifying you.

Who we share it with

  • Stripe (payments). Stripe is also a controller for some data; see Stripe’s privacy policy.
  • Cloudflare (hosting and analytics).
  • Our fulfilment partner and couriers, who receive your name, delivery address and phone number to pick, pack and deliver your order.
  • Our email provider, if you sign up to the newsletter.

We don’t sell your data.

International transfers

Some of these providers process data outside the UK. Our fulfilment partner is based in China, and Stripe and Cloudflare may process data in the US and elsewhere. Where data leaves the UK, we rely on safeguards approved under UK law, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

How long we keep it

  • Order records: 6 years from the end of the financial year, as required for tax.
  • Emails with us: up to 2 years after our last contact.
  • Newsletter: until you unsubscribe.

Cookies and storage

This site sets no cookies. Your bag is saved in your browser’s local storage on your own device so it’s still there if you reload the page; it isn’t sent to us. Stripe sets its own cookies on its checkout pages to process payment and prevent fraud.

Your rights

You can ask to see, correct or delete your data, object to or restrict how we use it, or ask for a copy to take elsewhere. Email us and we’ll respond within one month.

If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113). We’d appreciate the chance to sort it out first.