Privacy Policy

1. Who we are

De Spruce Ventures Ltd (company number 17334719), trading as Despruce Fashion (“we”, “us”, “our”), is the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our registered office is Unit A, De Spruce Ventures Ltd, 82 James Carter Road, Mildenhall, Suffolk, IP28 7DE, United Kingdom.

For any data protection question, request or complaint, contact us at [email protected] or by post at the address above. We take all data protection questions seriously and will respond personally — you will not be routed to a faceless helpdesk.

2. What personal data we collect

The categories of data we collect depend on how you use the store:

• Account data: name, email address and a password (stored only as a salted, hashed value — we never see your actual password).
• Order data: delivery name, address, phone number (shared with the carrier where needed), order contents, prices and order history.
• Payment data: handled entirely by Stripe. We see your name, email, order value and a partial card reference for reconciliation — never your full card number or security code.
• Communication data: the content of messages you send us via the contact form or email.
• Review data: your rating, review text, display name and any photo or video you choose to submit with a review. If we approve a review, these details are displayed publicly on the relevant product and reviews pages.
• Technical data: browser type, device type and basic usage data needed to run and secure the site.
• Marketing data: your email address and preferences, where you have opted in to marketing.

We do not deliberately collect special category data (such as health or biometric data), data from children under 13, or more data than is needed for the purposes in this policy. If you send us special category data unprompted, we will delete it where we become aware of it.

3. How and why we use your data (lawful bases)

• To process and deliver your orders — performance of our contract with you.
• To send transactional emails (order confirmation, dispatch, refund notices) — performance of contract.
• To handle returns, refunds and faulty-item claims — performance of contract and compliance with consumer law.
• To keep accounts and tax records — compliance with a legal obligation (UK tax law).
• To run, secure and improve the store (fraud prevention, debugging, service integrity) — our legitimate interests.
• To moderate and display product reviews — our legitimate interests in providing customers with useful, authentic product feedback. Approved reviews, including the display name and any media you submit, are public.
• To measure store use and advertising performance using optional analytics or advertising storage — your consent. You can refuse or withdraw this at any time through Cookie settings.
• To send marketing emails about new products and offers — consent, which you can withdraw at any time. Where you are an existing customer, we may also rely on the “soft opt-in” exception for marketing about similar products, always with a clear unsubscribe in every email.

You are never required to provide more data than is needed for the purpose you chose. Without order data we cannot fulfil an order; without marketing consent we simply will not market to you.

4. Who we share your data with

We share only what is needed with the service providers that help us run the store:

• Supabase — database and account hosting.
• Stripe — payment processing. Card details are collected and stored by Stripe under their own PCI DSS-compliant terms; they never touch our servers.
• Shippo and delivery carriers (Royal Mail, Evri, DPD) — generating shipping labels and delivering your parcels. Carriers receive your name, delivery address and phone number.
• Resend — sending transactional emails on our behalf.
• Google — Google Analytics 4 may receive browsing and shopping-event information if you opt in to analytics storage.
• Meta — Meta Pixel may receive browsing and shopping-event information if you opt in to advertising measurement.

We may also disclose data where required by law (for example, a court order or tax authority request), or as part of a business transfer in which case we will ensure your data remains protected under this policy.

We never sell your personal data. If you opt in to advertising measurement, we share relevant site and shopping events with Meta to measure advertising performance. We do not load that tool before you opt in.

5. International transfers

Some of the providers above may process personal data outside the United Kingdom (for example, in the United States). Where that happens, transfers are protected by one of the lawful mechanisms under the UK GDPR: the UK’s adequacy regulations, the International Data Transfer Agreement (IDTA), or the UK Addendum to the European Commission’s Standard Contractual Clauses, together with additional technical safeguards such as encryption in transit and at rest. Our providers are selected for their established, documented compliance with these frameworks.

6. How we protect your data

• All traffic to and from the store is encrypted (HTTPS/TLS).
• Passwords are stored only as salted hashes, never in plain text.
• Access to customer data is limited to what is needed to run the business, and administrative access is protected with authentication.
• We review access and security practices regularly, and retain no payment card data on our own systems.

No system is perfectly secure, but if a personal data breach is ever likely to affect you, we will notify you and the Information Commissioner’s Office (ICO) as UK law requires.

7. How long we keep your data

• Order and invoice records: 6 years after the last order, for UK tax and accounting law, and to handle any later claims under consumer law.
• Account data: while your account is active, and for 12 months after deletion to satisfy financial record-keeping tied to past orders.
• Marketing preferences: until you withdraw consent (withdrawal is always one click), plus a suppression record so we do not contact you again.
• Contact messages: 2 years, so we can refer back if an issue resurfaces.
• Technical/security logs: typically 12 months, for fraud prevention and site integrity.
• Reviews: while under moderation and, if approved, while published on the store. Contact us if you want us to review or remove a review or its media; we may retain limited records where needed to handle a complaint or meet a legal obligation.

After these periods, data is deleted or anonymised.

8. Cookies and similar storage

We use cookies and browser storage to run the store and remember your choices. The basket is saved in browser storage, not in a cookie. Strictly necessary storage is used to provide services you request; optional analytics and advertising tools are off unless you choose them.

• Sign-in: Supabase authentication cookies keep your session active. Their names and expiry follow the authentication session.
• Return to your page after sign-up: the despruce_last_page cookie lasts up to 3 days. The despruce_auth_redirect cookie lasts up to 15 minutes.
• Basket: the despruce-cart entry is kept in browser local storage until you clear it.
• Remembering your choice: your optional-storage preferences are kept in this browser. We ask you again after 6 months or if the tools in use change.
• Analytics — Google Analytics 4: only loaded if configured and you opt in. It may set _ga and _ga_<container-id> cookies, with a default lifetime of up to 2 years, subject to browser limits and Google settings. Google receives site-usage and shopping-event data.
• Advertising measurement — Meta Pixel: only loaded if configured and you opt in. It may set the _fbp cookie, typically for 3 months, and other Meta identifiers when relevant. Meta receives site-usage and shopping-event data.

You can change or withdraw your optional choices at any time using Cookie settings in the footer. Turning a category off blocks future tracking from this site and removes matching cookies we can access; information already received by Google or Meta is handled under their privacy policies.

9. Automated decision-making

We do not make decisions about you based solely on automated processing that has legal or similarly significant effects. Basic automated fraud screening at checkout may flag an order for human review — a person always makes the final decision.

10. Your rights

Under the UK GDPR you have the right to:

• Access your personal data (a copy of what we hold about you)
• Rectification of inaccurate data
• Erasure of your data where there is no overriding legal reason to keep it
• Restriction of processing while a dispute or correction is resolved
• Portability — a machine-readable copy of data you gave us, to move elsewhere
• Object to processing based on legitimate interests, including profiling related to direct marketing (you can opt out of marketing at any time, with one click in any marketing email, or by emailing us)
• Withdraw consent at any time, for anything that relies on consent

To exercise any right, email [email protected]. We may ask you to verify your identity before releasing data, to make sure we do not hand your information to someone else. We respond within one month, and tell you straight away if we need more time or intend to refuse (and why, and your route to complain).

You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or by phone on 0303 123 1113. We would rather fix the problem first — please talk to us, but the ICO is always there for you.

11. Changes to this policy

We update this policy when our practices or providers change. The version that applies to you is the one displayed on this page at the time. If a change is significant, we will highlight it (and, where appropriate, ask for fresh consent, for example for any new marketing purpose).