Privacy policy
In short: we only collect what we need to take your payment and get your order to you. We share your name and address with the supplier who ships your order, and with PayPal to take payment. We never sell your data.
1. Who we are
This website, www.crafo.co.uk, is run by Crafo Supplies (“CRAFO”, “we”, “us”), Glasgow, United Kingdom. We are the controller of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Contact us about privacy at hello@crafo.co.uk.
2. What we collect
| Data | When |
|---|---|
| Name, email, delivery address, phone number (if given) | When you place an order through PayPal |
| Order details: items, prices, order number | When you place an order |
| Payment confirmation | From PayPal after you pay. We never see your full card or bank details. |
| Email address | If you join our email list |
| Messages and photos you send us | If you contact us, for example about a faulty item |
3. How we use it, and why we’re allowed to
- To process and deliver your order, and handle returns and refunds. Lawful basis: performing our contract with you.
- To answer your questions and resolve problems. Lawful basis: contract, or our legitimate interest in helping customers.
- To keep business and tax records. Lawful basis: legal obligation.
- To send marketing emails, only if you sign up. Lawful basis: your consent. Every email has a link to unsubscribe.
- To prevent fraud and keep the site secure. Lawful basis: legitimate interests.
4. Who we share it with
- PayPal, which processes your payment under its own privacy statement.
- Our partner suppliers, who pack and ship your order. They receive your name, delivery address, phone number if given, and the items ordered. Our main supplier is AliExpress.
- Delivery companies used by those suppliers, to deliver your parcel.
- Cloudflare, which hosts this website and securely stores order records.
- Authorities, only where the law requires it.
We don’t sell your personal data and don’t share it for targeted advertising. See Your Privacy Choices.
5. Transfers outside the UK
Some of our suppliers are based outside the UK, for example in China, so your order details may be sent there to fulfil your order. Where this happens, we rely on the transfer being necessary to perform our contract with you, or on safeguards such as the UK International Data Transfer Agreement. Contact us for more details.
6. How long we keep it
- Order and payment records: 6 years, for tax and accounting.
- Customer messages: up to 2 years after your query is resolved.
- Email list: until you unsubscribe.
7. Cookies and browser storage
This site doesn’t use advertising or analytics cookies. It saves your cart in your browser’s local storage so it’s still there when you come back. It stays on your device and isn’t sent to us until you pay. You can clear it any time in your browser settings.
When you pay, PayPal may set its own cookies to process the payment and prevent fraud.
8. Your rights
You have the right to:
- ask for a copy of the personal data we hold about you
- ask us to correct anything that’s wrong
- ask us to delete your data, unless we must keep it by law
- object to, or ask us to limit, how we use your data
- ask us to send your data to another organisation
- withdraw consent at any time, for example by unsubscribing from emails
To use any of these rights, email hello@crafo.co.uk. We’ll reply within one month. There’s no charge.
9. Keeping your data safe
Payments are handled entirely by PayPal over a secure connection. We limit access to your details to what’s needed to run your order.
10. Children
This site isn’t aimed at children under 13, and we don’t knowingly collect their data.
11. Complaints
If you’re unhappy with how we’ve handled your data, please contact us first. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
12. Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed.