Privacy Policy
Privacy Policy
How The Beadster looks after your information — written to be read, not to be survived.
The short version
- We take your name, address and email so we can send you beads. That is nearly all of it.
- We never see your card number. PayPal handles that.
- We do not sell your details to anybody, and we never will.
- Analytics and advertising cookies only run if you agree to them. If you decline, the shop still works normally.
- You can ask us what we hold about you, or ask us to delete it, and we will.
1. Who we are
The Beadster is a small family business in Dorset selling beads and jewellery-making supplies. It is run as a partnership by Dennis and Ruth Hughes, who together are the data controller for the information described here — the people responsible for it and answerable for what happens to it.
There is no data protection officer, because a business our size is not required to appoint one. If you have a question about your information, it comes to us directly — there is no department in between.
2. When you buy something
To take an order and get it to you, we need:
- Your name and delivery address — so the parcel arrives.
- Your email address — for the order confirmation and any message about that order.
- Your phone number, if you give us one — used only if there is a problem with your delivery.
- What you ordered and what you paid.
We do not see or store your card details. When you pay, the card fields on our checkout are provided and handled by PayPal. Your card number goes to them, not to us. We are told whether the payment succeeded and nothing more.
We keep a record of your order because we have to. HMRC requires businesses to keep records of sales for six years, so we cannot delete an order on request even if you ask — though we can remove everything that is not part of that legal record.
3. If you create an account
You do not have to. You can buy from us as a guest and many people do.
If you do create one, we store your email address, your name, the addresses you have saved, and your order history — so you do not have to type it all in again. Your password is stored scrambled, in a form that cannot be read back, including by us.
You can close your account at any time by emailing us. We will delete it, keeping only what the tax records above require.
4. If you sign up for emails
Our newsletter is run through Mailchimp. If you subscribe, your email address is stored there so we can send it.
We only send it if you have asked for it. Every email has an unsubscribe link at the bottom, and it works immediately — you do not need to ask us, and we are not told why you left.
Mailchimp records whether an email was opened and whether a link was clicked. We use that only to see whether the newsletter is worth sending. We do not act on it individually.
5. If you contact us
When you email us or use the contact form, we keep the message and your reply address so we can answer, and for a reasonable time afterwards in case you write again about the same thing.
We do not add you to any mailing list because you asked a question. Getting in touch is not consent to be marketed at.
6. Reviews
Some time after your order has arrived, we may send you one email asking whether you would like to review what you bought. It is sent by a service called CusRev, which is given your name, your email address and what you ordered, so that it knows what to ask you about.
You do not have to reply, and you can opt out of review requests using the link in that email.
If you do leave a review, it is public — your review and the name you give will be visible to anyone. Please use only a name you are happy to have shown. If you change your mind later, email us and we will remove it.
7. Cookies and tracking
Our shop uses cookies. The ones that make the site work — remembering your basket, keeping you logged in — are always on, because without them there is no shop.
Everything else asks first. When you arrive you will see a banner offering statistics and marketing cookies, and nothing in those categories runs unless you accept. Google Analytics and Google Ads are the two services that fall into them.
You can change your mind whenever you like using the Manage consent option, and refusing is exactly as easy as accepting. If you decline, the shop works normally — we simply cannot see how you used it.
The full list of cookies, what each one does and how long it lasts, is in our Cookie Policy.
8. Why we are allowed to
The law says we need a reason for holding your information. Ours are:
| What | Why we are allowed |
|---|---|
| Taking and delivering your order | Contract — we cannot send you beads without knowing where you live |
| Keeping sales records | Legal obligation — HMRC requires six years |
| Answering your enquiry | Legitimate interest — you wrote to us and expect a reply |
| Preventing fraud and keeping the site secure | Legitimate interest — protecting you and us |
| Newsletter | Consent — you asked for it and can stop it |
| Analytics and advertising cookies | Consent — refused by default until you accept |
| Asking you to review a purchase | Legitimate interest — feedback on an order you placed, and you can opt out |
| Publishing your review | Consent — you chose to write it |
9. Who else sees it
We do not sell your information, and we do not share it for anyone else’s marketing. It goes only to the companies that make the shop work:
| Who | What they get, and why |
|---|---|
| PayPal | Your payment details, to take the payment. They receive your card number; we do not |
| Krystal | Our web host, in the UK. The website and its database sit on their servers |
| Royal Mail and couriers | Your name and address, so the parcel can be delivered |
| Mailchimp | Your email address, but only if you subscribed |
| Analytics and advertising data, and only if you accepted those cookies | |
| CusRev | Your name, email address and order details, so it can ask you for a review — and any review you choose to leave |
We would also disclose information if the law required it — a court order, or a legitimate request from HMRC or the police. That has never happened, and we would not do it quietly if it did, unless we were forbidden from saying so.
10. Data outside the UK
Our website and its database are hosted in the United Kingdom.
Some of the services above are American companies — Google, Mailchimp, and PayPal in part — so some information reaches the United States. That is permitted where the transfer is covered by the safeguards UK law recognises, and each of those companies operates under them. We have not chosen any supplier that sits outside those arrangements.
11. How long we keep it
| What | How long |
|---|---|
| Orders and payment records | Six years after the end of the tax year, because HMRC requires it |
| Your account | Until you close it |
| Newsletter subscription | Until you unsubscribe |
| Emails and enquiries | Around two years, then deleted |
| Analytics data | 14 months, then deleted automatically by Google |
| Reviews | Until you ask us to remove yours |
| Review-request emails | Sent once per order; opt out at any time via the link |
12. Your rights
Your information belongs to you. You can:
- Ask what we hold. We will send you a copy, free, within one month.
- Correct it if it is wrong.
- Ask us to delete it. We will, apart from the order records HMRC requires us to keep.
- Ask us to stop using it for a particular purpose, or to pause while a dispute is sorted out.
- Take it elsewhere — we will provide it in a readable file.
- Withdraw consent for anything you agreed to, at any time. Stopping the newsletter or refusing cookies does not affect anything you agreed to beforehand.
- Object to anything we do on the basis of legitimate interest.
Email info@thebeadster.co.uk and say what you would like. We do not charge, and we will not ask why. We may ask you to confirm who you are, so that we are not handing your details to somebody else.
13. Complaints
If we have got something wrong, please tell us first — it is usually quicker to sort out directly.
If you are not satisfied with our answer, you can complain to the Information Commissioner’s Office, the UK’s data protection regulator. Complaining to them is free, and you can do it whether or not you have spoken to us.
Information Commissioner’s Office
ico.org.uk/make-a-complaint · 0303 123 1113
14. Children
Our shop is meant for adults, and we do not knowingly collect information about children. Beading is a hobby many children enjoy, so if a child has given us their details, tell us and we will delete them.
15. Changes to this policy
If we change how we handle your information, we will update this page and change the date at the bottom. If a change is significant, we will say so clearly rather than hoping you re-read it.
16. How to reach us
About anything on this page, or about your information generally:
The Beadster, 9 Hawkesdene, Shaftesbury, Dorset SP7 8NT
A real person reads that address, and we would rather hear from you than have you wonder.
Prepared 31 August 2026.