Privacy Policy
1. Who we are
fab4kids (“we”, “us”, “our”) is the data controller for personal data collected through this website. Contact us at privacy@fab-4-kids.co.uk.
2. Data we collect and why
| Category | Data | Legal basis |
|---|---|---|
| Purchase | Email address, order reference, items purchased | Contractual necessity (to fulfil your order) |
| Transactional email | Email address | Legitimate interest (to deliver what you paid for) |
| Newsletter | Email address, opt-in timestamp | Consent (you opted in explicitly) |
| Server logs | IP address, browser, pages visited | Legitimate interest (security and fraud prevention) |
| Cookies | Theme preference, cart contents, consent decision | Functional necessity / consent (see Cookie Policy) |
3. Third-party processors
We share data with the following processors, each bound by a Data Processing Agreement:
- Stripe — payment processing. Card data never touches our servers.
- Resend — transactional and marketing email delivery.
- Sanity — content management (product and category data; no personal data).
- Microsoft Azure — hosting (Azure App Service) and file storage (Azure Blob Storage).
4. Retention periods
- Purchase records: 7 years (HMRC statutory requirement).
- Newsletter subscriptions: until you unsubscribe.
- Server logs: 90 days.
5. Your rights under UK GDPR
You have the right to:
- Access — request a copy of the data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your data (subject to legal retention obligations).
- Restriction — ask us to pause processing while a dispute is resolved.
- Portability — receive your data in a machine-readable format.
- Object — object to processing based on legitimate interest.
- Withdraw consent — unsubscribe from marketing at any time.
To exercise any right, email privacy@fab-4-kids.co.uk. We will respond within 30 days.
You may also lodge a complaint with the ICO.
6. Children’s data
This website is directed at adults (parents and guardians). We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.
7. International transfers
Data processed by Stripe and Resend may be transferred outside the UK/EEA under appropriate safeguards (Standard Contractual Clauses or UK Adequacy decisions).
8. Changes to this policy
We will notify you of material changes by updating the date above. Continued use of the site after a change constitutes acceptance.