Privacy Policy

1. Who is responsible

The data controller is [LEGAL NAME / TRADING NAME], trading as Auntie Wainwright's Antiques, [REGISTERED ADDRESS], Cork, Ireland. For anything related to your personal data, contact [CONTACT EMAIL].

2. What we collect and why

• Orders — name, email, delivery address, phone (optional), order notes and purchase history. Needed to perform the sales contract (GDPR art. 6(1)(b)) and kept afterwards for tax and accounting law (art. 6(1)(c)).
• Account (optional) — name, email, password (stored as a cryptographic hash), phone, avatar and saved addresses. Processed to provide the account you asked for (art. 6(1)(b)).
• Enquiries — name, email and your message about a specific item, used to answer you (art. 6(1)(b) / legitimate interest, art. 6(1)(f)).
• Payments — handled entirely by Stripe; your card number never reaches our servers. We store only the payment reference and order amount.
• Technical data — server logs (IP address, requested pages) kept briefly for security and troubleshooting (legitimate interest, art. 6(1)(f)).

3. Cookies and local storage

We use no advertising or analytics trackers. What the site stores in your browser:

• Session cookie — keeps you signed in to your account. Strictly necessary; deleted on sign-out or expiry.
• Cart & wishlist (localStorage) — remembers your basket and saved items when you browse without an account. Stays on your device; sent to us only when you check out or sign in.
• Captcha — our forms use a self-hosted proof-of-work captcha (Cap). It does not profile or track you across sites.

Because none of this is used for tracking, no cookie consent banner is required.

4. Who we share data with

We share personal data only with processors needed to run the shop: Stripe Payments Europe Ltd (payment processing), our hosting provider [HOSTING PROVIDER, LOCATION], our email delivery provider [EMAIL PROVIDER], and couriers (name, address and phone, to deliver your order). We never sell personal data. Where a processor is outside the EEA, transfers rely on an adequacy decision or Standard Contractual Clauses.

5. How long we keep data

• Orders and invoices — 6 years after the tax year, as required by Irish Revenue.
• Accounts — until you delete the account or ask us to.
• Enquiries — up to [12 MONTHS] after the conversation ends.
• Server logs — up to [30 DAYS].

6. Your rights

Under the GDPR you can ask us for access to your data, correction, deletion, restriction of processing, portability, and you can object to processing based on legitimate interest. Email [CONTACT EMAIL] and we will respond within one month. You also have the right to lodge a complaint with the Data Protection Commission (dataprotection.ie), or with your local supervisory authority.

7. Changes

We may update this policy as the shop evolves; the current version is always available on this page with its date above. See also our Terms of Service.