Who is responsible
- support@littlechristmas.co.uk
This notice covers browsing Little Christmas, building a box, placing an order and contacting us. You can use the contact details above for a privacy request or complaint.
What we use and why
- Orders: name, email, delivery address, selected designs, box size, payment reference and order status let us take payment, fulfil the order and handle returns. We use these to perform our contract with the buyer.
- Gift recipients: the buyer may give us someone else’s name, address and a card message. We use them to deliver the gift, in our legitimate interests in fulfilling the buyer’s request. Please tell the recipient about this notice when appropriate.
- Gift clues: optional colours, motifs, a star sign, pet preferences, dislikes and notes help us choose the surprise gifts. Do not include medical information or other sensitive personal details.
- Support and records: we use correspondence and transaction records to answer questions, meet tax and accounting duties, and resolve disputes. The basis is our contract, legal obligations or legitimate interests, as applicable.
- Security: technical request information and hashed identifiers help prevent misuse, duplicate orders and fraud. Hosting and payment providers may also process connection and device information. Our basis is our legitimate interests in running a secure shop.
The information needed for payment and delivery is required to process an order. Gift clues and a card are optional. We do not require an account, your age or a demographic profile to browse. Suggested gift combinations do not make decisions about your legal rights.
When you type a delivery postcode, we request suggestions from Postcodes.io. Your partial postcode, full postcode for validation, and technical connection information are sent to that service; your name, email, card message and street address are not included in these lookup requests. You can enter your address manually if you prefer.
Payment and service providers
Stripe handles card details on its hosted checkout. We receive payment status and transaction references, not your full card number or security code. Stripe also processes information for its own payment and fraud-prevention purposes; see Stripe’s privacy notice.
We use Render for website hosting, Supabase for the order database and order-processing service, and IONOS for domain and email services. Delivery providers receive the details needed to deliver a parcel. Information may also be shared with professional advisers or authorities when needed for our legal obligations or a dispute. We do not sell personal information.
Our Supabase project is hosted in Ireland. Some service providers may process information elsewhere, including outside the UK. Where applicable, their data-processing arrangements use adequacy decisions or contractual safeguards, such as standard contractual clauses with the UK Addendum. You can read Supabase’s data-processing terms and Render’s data-processing terms, or contact us for the safeguards relevant to your data.
Cookies and browser storage
The box builder stores chosen product IDs and box size in this browser’s local storage so you can return to your selection. These remain until you clear this site’s browser data. Gift preferences, card text and delivery details are held in the current page until you submit them at checkout.
Session storage remembers your gift-guide selection and, when checkout starts, a checkout reference and access token so the same tab can resume payment. That token does not contain card details. Session storage normally ends when the tab or browser session closes; some browser restore settings preserve it. Clear this site’s browser data on a shared device when you finish.
Optional Meta advertising measurement is described below. It only operates when enabled on this website and you have accepted it in Marketing privacy settings. Stripe’s payment page and service providers may use their own essential security technologies.
Marketing measurement settings
We propose to use optional Meta PageView, InitiateCheckout and Purchase measurement to understand purchases associated with our advertising. The shop footer’s Marketing privacy settings shows whether this feature is available. While it says advertising measurement is disabled, this website does not load the Meta pixel or send Meta advertising events.
When enabled, measurement stays off unless you choose “Accept marketing measurement”. Your consent is optional, separate from any first-party analytics choice, and is not required to place an order. After you accept, we send a PageView event when the shop opens and an InitiateCheckout event with the box value in GBP when a checkout is successfully created. When our order service confirms payment, our event payload supplies Meta with a Purchase event, the order value in pounds sterling (GBP) and a deterministic event identifier (eventID) derived from the checkout attempt. We do not include your name, email, delivery address, gift notes or other customer contact fields in that payload, or supply advanced-matching fields. Meta also receives browser connection information through the pixel request, such as your IP address and browser information; this is not anonymous measurement.
We remember your accepted or rejected choice in session storage in this tab. If a purchase event is attempted, we also store its event identifier in session storage to reduce repeat attempts. Session storage normally ends when the tab or browser session closes, although browser restore settings may preserve it. Meta’s pixel may use cookies and other identifiers after consent. Read Meta’s privacy policy for how Meta uses and retains information it receives.
You can decline or withdraw consent in the shop footer’s Marketing privacy settings by choosing “Continue without marketing measurement”. This turns off future advertising measurement in this tab and, if the pixel has been loaded, sends Meta a consent-revocation instruction. It does not delete information already sent to Meta or automatically clear existing cookies. You can clear this site’s browser data using your browser settings. Withdrawal does not affect processing already carried out with your consent.
How long we keep information
We keep order and payment records for the applicable tax, accounting and legal-claim periods. Gift notes and correspondence are kept only while needed for fulfilment, support or an unresolved issue. Unpaid checkout records are kept while needed to reconcile payment attempts and prevent duplicates. The length depends on those purposes and any legal requirement; we review records and remove or minimise information when it is no longer needed. Backup copies remain until the relevant backup cycle expires.
Your choices and rights
You can ask for access to your information, correction, deletion, restriction or a portable copy, where the relevant right applies. You can object to processing based on legitimate interests. Contact us using the details above; we may need proportionate information to verify the request.
Ordering a box does not subscribe you to marketing. If we later ask for marketing consent, you may withdraw it at any time. Withdrawal does not affect earlier lawful use. You can complain to the Information Commissioner’s Office if you are unhappy with how your information is handled.