Who is responsible
- support@littlechristmas.co.uk
This notice covers browsing Little Christmas, building a box, placing an order and contacting us. You can use the contact details above for a privacy request or complaint.
What we use and why
- Orders: name, email, delivery address, selected designs, box size, payment reference and order status let us take payment, fulfil the order and handle returns. We use these to perform our contract with the buyer.
- Gift recipients: the buyer may give us someone else’s name, address and a card message. We use them to deliver the gift, in our legitimate interests in fulfilling the buyer’s request. Please tell the recipient about this notice when appropriate.
- Gift clues: optional colours, motifs, a star sign, pet preferences, dislikes and notes help us choose the surprise gifts. Do not include medical information or other sensitive personal details.
- Support and records: we use correspondence and transaction records to answer questions, meet tax and accounting duties, and resolve disputes. The basis is our contract, legal obligations or legitimate interests, as applicable.
- Security: technical request information and hashed identifiers help prevent misuse, duplicate orders and fraud. Hosting and payment providers may also process connection and device information. Our basis is our legitimate interests in running a secure shop.
The information needed for payment and delivery is required to process an order. Gift clues and a card are optional. We do not require an account, your age or a demographic profile to browse. Suggested gift combinations do not make decisions about your legal rights.
When you type a delivery postcode, we request suggestions from Postcodes.io. Your partial postcode, full postcode for validation, and technical connection information are sent to that service; your name, email, card message and street address are not included in these lookup requests. You can enter your address manually if you prefer.
Payment and service providers
Stripe handles card details on its hosted checkout. We receive payment status and transaction references, not your full card number or security code. Stripe also processes information for its own payment and fraud-prevention purposes; see Stripe’s privacy notice.
We use Render for website hosting, Supabase for the order database and order-processing service, and IONOS for domain and email services. Delivery providers receive the details needed to deliver a parcel. Information may also be shared with professional advisers or authorities when needed for our legal obligations or a dispute. We do not sell personal information.
Our Supabase project is hosted in Ireland. Some service providers may process information elsewhere, including outside the UK. Where applicable, their data-processing arrangements use adequacy decisions or contractual safeguards, such as standard contractual clauses with the UK Addendum. You can read Supabase’s data-processing terms and Render’s data-processing terms, or contact us for the safeguards relevant to your data.
Cookies and browser storage
The box builder stores chosen product IDs and box size in this browser’s local storage so you can return to your selection. These remain until you clear this site’s browser data. Gift preferences, card text and delivery details are held in the current page until you submit them at checkout.
Session storage remembers your gift-guide selection and, when checkout starts, a checkout reference and access token so the same tab can resume payment. That token does not contain card details. Session storage normally ends when the tab or browser session closes; some browser restore settings preserve it. Clear this site’s browser data on a shared device when you finish.
The shop does not currently use advertising pixels or optional analytics trackers. Stripe’s payment page and service providers may use their own essential security technologies. We will update this notice and obtain consent where required before adding optional tracking.
How long we keep information
We keep order and payment records for the applicable tax, accounting and legal-claim periods. Gift notes and correspondence are kept only while needed for fulfilment, support or an unresolved issue. Unpaid checkout records are kept while needed to reconcile payment attempts and prevent duplicates. The length depends on those purposes and any legal requirement; we review records and remove or minimise information when it is no longer needed. Backup copies remain until the relevant backup cycle expires.
Your choices and rights
You can ask for access to your information, correction, deletion, restriction or a portable copy, where the relevant right applies. You can object to processing based on legitimate interests. Contact us using the details above; we may need proportionate information to verify the request.
Ordering a box does not subscribe you to marketing. If we later ask for marketing consent, you may withdraw it at any time. Withdrawal does not affect earlier lawful use. You can complain to the Information Commissioner’s Office if you are unhappy with how your information is handled.