Privacy policy

This policy explains what personal data we collect when you visit or buy from sculpette.com, why we collect it, how long we keep it and what rights you have over it. It is written to meet the UK General Data Protection Regulation and the Data Protection Act 2018.

Contents

Who controls your data
What we collect
Why we use it, and our lawful basis
Cookies and similar technologies
Who we share it with
International transfers
How long we keep it
Your rights
Marketing
Security
Children
Complaints
Changes

1. Who controls your data

The data controller is Primevia Ltd, registered in England and Wales under company number 16784568. For anything to do with your data, write to support@sculpette.uk and put "Data protection" in the subject line.

2. What we collect

Identity and contact data: name, email address, delivery address, billing address, telephone number where you give it.
Order data: what you bought, when, order value, delivery method, tracking number, returns and refunds.
Payment data: we never see or store your full card number. Our payment providers process the payment and return to us only a transaction reference, the outcome and the last four digits of the card.
Account data: where you create an account, your login details and saved addresses.
Technical data: IP address, device and browser type, operating system, time zone, and the pages you viewed on our site.
Marketing data: your preferences for receiving marketing from us, and how you interact with the emails we send.
Communications: the content of emails and messages you send us, including reviews and photographs you choose to submit.

We do not seek or knowingly collect special category data. Please do not send us health information; it is not needed to buy from us or to return anything.

3. Why we use it, and our lawful basis

Purpose	Lawful basis
Taking payment, dispatching your order, handling returns and refunds	Performance of a contract with you
Answering your questions and providing customer service	Performance of a contract, and our legitimate interest in running the business well
Keeping accounting and tax records	Legal obligation
Preventing and investigating fraud and chargebacks	Legitimate interest in protecting the business, and legal obligation
Sending marketing emails	Your consent, or our legitimate interest where you are an existing customer and we are offering similar products
Analytics and advertising measurement	Your consent, given through the cookie banner
Improving products, copy and the website	Legitimate interest in improving what we sell

4. Cookies and similar technologies

Strictly necessary cookies make the basket, checkout and login work. They cannot be switched off and do not require consent.

Analytics and advertising cookies and pixels — including those operated by Meta Platforms and Google — are set only where you accept them in the cookie banner. They let us measure which advertisements led to a sale and how the site is used. You can change your choice at any time through the cookie settings link in the footer, and you can block or delete cookies in your browser.

5. Who we share it with

Shopify Inc. — our e-commerce platform, which hosts the store and processes orders.
Payment providers — to take payment, run fraud checks and process refunds.
Carriers, including Royal Mail, and our fulfilment partner — name, address and contact details, so your parcel can be delivered.
Email and marketing platforms — to send the emails you have asked for.
Analytics and advertising platforms — where you have consented, to measure campaigns.
Professional advisers, and authorities where the law requires it.

We never sell your personal data.

6. International transfers

Some of our suppliers are based outside the United Kingdom, principally in the European Economic Area, the United States and Canada. Where personal data leaves the UK we rely on an adequacy decision covering the destination, or on the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, together with additional safeguards where they are needed. You can ask us for details of the safeguard used for any particular supplier.

7. How long we keep it

Order and transaction records: six years from the end of the tax year in which the order was placed, to meet HMRC requirements.
Customer accounts: for as long as the account is open, and two years after your last order if it is dormant.
Marketing data: until you unsubscribe, and for a short period afterwards so that we can honour your objection.
Customer service correspondence: two years from the last message.
Analytics data: in line with the retention period of the platform concerned, typically no more than 14 months.

8. Your rights

Under UK data protection law you have the right to:

be told what we hold about you and receive a copy of it;
have inaccurate data corrected;
have data erased where we no longer have a reason to keep it;
restrict how we use it while a concern is investigated;
object to processing based on legitimate interests, and to direct marketing at any time;
receive data you gave us in a portable format;
withdraw consent at any time, without affecting anything done before you withdrew it.

To exercise any of these, email support@sculpette.uk. We respond within one month. There is no charge, and we may ask you to confirm your identity before we release information.

9. Marketing

Every marketing email has an unsubscribe link, and it works immediately. Unsubscribing stops the marketing but not the operational messages about an order you have placed — order confirmations, dispatch notices and delivery updates are part of the contract and continue.

10. Security

The site runs over an encrypted connection. Access to customer data is limited to the people who need it to do their job, and to our platform and service providers under contract. No system is perfect; if a breach ever put your rights at risk, we would tell you and the Information Commissioner's Office as the law requires.

11. Children

Our products and this website are intended for adults. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, write to us and we will delete it.

12. Complaints

If you are unhappy with how we have handled your data, please tell us first so that we can put it right. You also have the right to complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk.

13. Changes

We update this policy when our practices change. The date below shows when it was last revised, and material changes will be signposted on the website.

Primevia Ltd, registered in England and Wales, Company No. 16784568. Last updated: 15 September 2026.