GDPR Privacy Policy

Privacy Policy

Last updated: May 2026

KOOLTHINGS ("we", "us", or "our") operates the website www.koolthings.co.uk. This policy explains how we collect, use, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

KOOLTHINGS is the data controller for personal data collected through this website. If you have any questions about this policy or your data, please contact us at: [your contact email]

2. What Data We Collect

We may collect and process the following personal data:

• Identity data: name, username
• Contact data: email address, postal address, phone number
• Transaction data: details of purchases and payments
• Technical data: IP address, browser type, device information, cookies
• Usage data: information about how you use our website
• Marketing data: your preferences for receiving marketing from us

3. Legal Basis for Processing

We process your personal data on the following legal bases:

• Contract: to fulfil orders and provide our services
• Legal obligation: to comply with applicable laws (e.g. tax, fraud prevention)
• Legitimate interests: to improve our website and services, and for fraud prevention
• Consent: for marketing communications (you may withdraw consent at any time)

4. How We Use Your Data

• To process and fulfil your orders
• To manage your account and customer relationship
• To send transactional emails (order confirmations, shipping updates)
• To send marketing communications (where you have consented)
• To improve our website and services
• To comply with legal and regulatory obligations

5. Cookies

We use cookies and similar tracking technologies to enhance your experience on our website. These may include essential cookies, analytics cookies, and marketing cookies. You can manage your cookie preferences via our cookie banner or your browser settings.

6. Third-Party Sharing

We may share your data with trusted third parties, including:

• Payment processors (e.g. Shopify Payments, Stripe)
• Shipping and logistics providers
• Email marketing platforms (e.g. Klaviyo)
• Analytics providers (e.g. Google Analytics)
• Legal and regulatory authorities where required by law

We do not sell your personal data to third parties.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements. Order data is typically retained for 7 years in line with UK tax law.

8. International Transfers

Some of our third-party service providers may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place in accordance with UK GDPR.

9. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: request a copy of the data we hold about you
• Right to rectification: request correction of inaccurate data
• Right to erasure: request deletion of your data ("right to be forgotten")
• Right to restriction: request that we limit how we use your data
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interests or for direct marketing
• Rights related to automated decision-making: not to be subject to solely automated decisions that significantly affect you

To exercise any of these rights, please contact us at: [your contact email]

10. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): ico.org.uk

11. Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with an updated date. We encourage you to review this policy periodically.