Last updated 10 September 2026.

Coconits ("we", "us") is a small handmade-goods shop based in the UK. This page explains what personal data we collect when you shop or get in touch, why, and what your rights are over it. It's written in plain English rather than as a legal document, but it aims to meet our obligations under UK GDPR and the Data Protection Act 2018.

What we collect

When you place an order, we collect:

• Your name, email address, and delivery address
• What you ordered, and any note you add to the order
• Which payment method you used (Stripe or PayPal) — we never see or store your card details ourselves; those go directly to Stripe or PayPal

When you use the contact form, we collect your name, email, address (if given), and your message.

Your shopping cart lives only in your own browser's local storage until you check out — it isn't sent to us or stored on our servers while you're just browsing.

For security, we also keep a short-lived record of IP addresses against certain actions (like checkout attempts or failed admin logins) purely to detect and block abuse — for example, someone trying to guess discount codes. These records are automatically cleared after a day and are not used to identify or track individual shoppers.

Why we collect it

We use your data to:

• Take payment for and fulfil your order, including arranging delivery via Royal Mail
• Email you an order confirmation and, if applicable, a refund confirmation
• Respond to enquiries sent through the contact form
• Prevent fraud and abuse of discount codes or our checkout

We don't use your data for advertising, and we don't sell or rent it to anyone. We don't currently run any analytics or advertising cookies on this site — if that ever changes, this policy will be updated first.

Who we share it with

To run the shop, some data necessarily passes through:

• Stripe and PayPal — to process your payment
• Royal Mail (Click & Drop) — to print your delivery label and address your parcel
• Cloudflare — who host this website, our database, and send our order/confirmation emails on our behalf

Each of these providers has their own privacy policy governing how they handle your data, and some may process data outside the UK/EEA under their own applicable safeguards. We don't share your data with anyone else, and never for marketing purposes.

How long we keep it

We keep order records for as long as needed to meet our accounting and tax obligations, and to handle any return, dispute, or enquiry about that order. If you'd like an old order or enquiry deleted sooner than that and there's no legal reason for us to keep it, contact us and we'll action it.

Your rights

Under UK GDPR, you have the right to:

• Ask what personal data we hold about you, and get a copy of it
• Ask us to correct inaccurate data
• Ask us to delete your data, where we're not required to keep it
• Object to or restrict how we use your data
• Complain to the Information Commissioner's Office (ICO) if you think we've handled your data wrongly

To exercise any of these, email us at coconits@outlook.com and we'll get back to you as soon as we can.

Contact

Questions about this policy or your data? Email coconits@outlook.com.