1. Who we are
Time & Tide Skincare makes natural skincare by hand in Cornwall and sells it through this website. We are the controller of the personal data described in this policy, which means we decide how and why it is used.
Controller
Time & Tide Skincare, Cornwall, United Kingdom
Email: hello@timeandtideskincare.co.uk
We are a small business and have not appointed a Data Protection Officer. Please send any privacy question or request to the email address above.
2. What we collect and why
When you place an order
Your name, email address, phone number, billing and delivery address, whether the order is a gift and any gift message, the products you buy, prices, any promotion code and the payment status. We use this to take payment, pack and deliver your order, send your order confirmation, deal with questions, cancellations and returns, and keep the accounting records the law requires.
Card details are entered straight into the secure payment form of our payment provider, Stripe. We never see or store your full card number.
How you found us (order source)
When you arrive, we note the website that referred you, any campaign tags in the link (such as utm_source) and the first page you visited. This is kept in your browser for the current visit only and is attached to your order so we know which channels bring us customers. Advertising click identifiers (fbclid, gclid, ttclid) are only kept if you accept marketing cookies.
When you contact us
If you use our contact form we collect your first name, last name, email address, subject and message, and send them to our mailbox using the EmailJS service. If you email us directly, we receive your email address and whatever you include. We use this only to reply and help you.
Security and fraud prevention
Stripe uses information about your device and connection (such as your IP address) to detect and prevent fraudulent payments. Our order system also uses your IP address for a short time to limit repeated requests and protect the service from abuse.
Website hosting
Like every website, our hosting provider receives technical information when your browser requests a page, such as your IP address, browser type and the pages requested. Fonts and code libraries are delivered to your browser by Google Fonts, Cloudflare (cdnjs) and jsDelivr, which also receive your IP address.
Order confirmation map
After you pay, the order confirmation page shows your delivery address on a map. To do this, the address is sent to the mapping service Mapbox.
Marketing and analytics — only if you agree
If you choose “Accept all” (or switch on “Marketing & analytics”) in our cookie banner, we load the Meta Pixel. It tells Meta (Facebook and Instagram) which pages you view, products you look at or add to your basket, the checkout steps you complete and your purchase (products and value), together with information about your browser. When you check out, it also sends scrambled (SHA-256 hashed) versions of your email address, phone number, name, town, county, postcode and country, and a random identifier, so Meta can match the visit to an account. We use this to measure our advertising and show relevant ads. If you don't agree, the Meta Pixel is never loaded.
We don't send marketing emails, and we don't sell your personal data.
3. Our lawful bases
UK data protection law (the UK GDPR and the Data Protection Act 2018) requires a lawful basis for each use of your data:
| Purpose | Lawful basis |
|---|---|
| Taking payment, delivering your order, order emails, returns and customer service | Contract — we need it to fulfil your order |
| Keeping order, invoice and payment records | Legal obligation — UK tax and accounting rules |
| Staff order notifications so we can pack and dispatch quickly | Contract, and our legitimate interest in running the business efficiently |
| Replying to messages and enquiries | Legitimate interests (or steps before a contract, if you ask about buying) |
| Fraud prevention, security and protecting our systems from abuse | Legitimate interests |
| Recording the referring website and campaign tags with your order | Legitimate interests in understanding which channels bring orders |
| Showing your delivery address on a map after you order | Legitimate interests |
| Meta Pixel, advertising click identifiers and the related cookies and storage | Consent — you can withdraw it at any time |
Where we rely on legitimate interests, we have balanced them against your rights and you can object (see section 9).
4. Who we share it with
We use a small number of trusted providers. They may only use your data to provide their service to us, except Stripe and Meta, which also act as independent controllers for some purposes (for example Stripe's fraud prevention and Meta's own advertising) under their own privacy policies.
| Provider | What for | Data involved |
|---|---|---|
| Stripe | Card and other payments, fraud prevention | Order and contact details, payment details, device and IP information |
| Amazon Web Services (AWS) | Hosting the website and our order system, including short-lived payment session records (London region) | Technical data, order and session data |
| EmailJS | Sending contact-form messages and order confirmation emails | Name, email address, message, order details |
| Microsoft 365 | Our business email | Emails you send us and our replies |
| Slack | Private notifications to our team about new and failed orders, including a dispatch invoice | Name, email, phone, delivery address, items, order source |
| Royal Mail | Delivering your parcel | Name and delivery address |
| Mapbox | Map on the order confirmation page | Delivery address, IP address |
| Meta Platforms (only with consent) | Advertising measurement and relevant ads | Browsing and purchase events, hashed contact details, identifiers |
| Google Fonts, Cloudflare (cdnjs), jsDelivr | Delivering fonts and code libraries to your browser | IP address, browser information |
We may also share information if the law requires it, to protect our rights or prevent fraud, or with professional advisers such as our accountant.
5. International transfers
Several of our providers are based in, or process data in, the United States or other countries outside the UK — for example Stripe, Meta, Slack, Mapbox, EmailJS and Microsoft. When your data leaves the UK we make sure it is protected by one of the safeguards UK law allows: UK “adequacy” regulations (including the UK Extension to the EU–US Data Privacy Framework for certified US companies), or the ICO's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. You can ask us for more details.
6. How long we keep it
- Orders, invoices and payment records (including order emails and staff notifications): six years from the end of the financial year in which you ordered, to meet UK tax and accounting rules.
- Messages and enquiries: up to two years after our last contact with you, unless they relate to an order (then as above).
- Payment session records on our order system: they expire after 10 minutes and are then deleted automatically.
- Abuse-prevention data (IP address request counts): held in memory for about a minute.
- Meta Pixel data: held by Meta under its own retention policy. The cookies and storage on your device are deleted when you withdraw consent.
- Storage in your browser: see the tables in section 8.
7. Keeping it safe
The website is served over encrypted HTTPS connections, and payments are handled by Stripe, a PCI DSS Level 1 certified payment provider, so card details never pass through our systems. Contact details sent to Meta (only with your consent) are hashed in your browser before they leave it.
We don't knowingly collect personal data from children.
8. Cookies and similar storage
Cookies are small files stored by your browser. Our site also uses “local storage” and “session storage” in your browser, which work in a similar way and are covered by the same rules (the Privacy and Electronic Communications Regulations, PECR).
Essential cookies and storage are needed for the shop to work, so they are always on. Everything else is off until you agree. You can accept, reject or change your choice at any time:
Rejecting or withdrawing consent stops the Meta Pixel and deletes the tt_meta_ storage and the _fbp and _fbc cookies from your browser. You can also delete cookies and site data in your browser settings at any time.
| Name | Type & set by | Purpose | How long |
|---|---|---|---|
timetide_cookie_consent | Cookie, Time & Tide | Remembers your cookie choices | 12 months |
stripe_cart_… | Local storage, Time & Tide | Your basket | Until you empty your basket or complete your order |
tts_customer_form_data | Local storage, Time & Tide | Keeps the checkout details you've typed if the page reloads | Used for up to 1 hour; removed when you order |
tts_last_order, tts_order_timestamp, ttsc_order_data | Local storage, Time & Tide | Shows your order confirmation after payment | Used for up to 24 hours; removed by the confirmation page |
tts_email_sent | Local storage, Time & Tide | Stops your order confirmation email being sent twice | Until your next order |
stripe_products_cache, stripe_products_cache_products, stripe_product_… | Local storage, Time & Tide | Product catalogue cache so pages load faster (no personal data) | Refreshed automatically |
tt_attribution | Session storage, Time & Tide | The referring site and campaign tags recorded with your order. Ad click identifiers are only added with marketing consent | Deleted when you close the tab |
wholesale_order, wholesale_total | Session storage, Time & Tide | Carries a trade (wholesale) order into checkout | Deleted when you close the tab |
__stripe_mid, __stripe_sid | Cookies, Stripe | Fraud prevention for payments. Set by Stripe's payment script on the pages that load it (basket, checkout and some other shop pages). Stripe may also set cookies on its own domains for the same purpose | 1 year / 30 minutes |
| Name | Type & set by | Purpose | How long |
|---|---|---|---|
_fbp | Cookie, Meta Pixel | Identifies your browser to Meta to measure ads | 90 days |
_fbc | Cookie, Meta Pixel | Stores the ad click identifier when you arrive from a Facebook or Instagram ad | 90 days |
tt_meta_external_id | Local storage, Time & Tide | A random identifier that helps Meta recognise events from the same browser | Until you withdraw consent or clear site data |
tt_meta_data_layer | Local storage, Time & Tide | Basket contents and hashed contact details used to report events to Meta | Until you withdraw consent or clear site data |
tt_pixel_fired_… | Local storage, Time & Tide | Makes sure a purchase is only ever reported to Meta once (contains the order reference only) | Until you clear site data |
When the Meta Pixel is loaded, Meta may also read cookies on its own websites (for example if you are logged in to Facebook or Instagram). See Meta's cookie policy.
| Name | Type & set by | Purpose | How long |
|---|---|---|---|
mapbox.eventData… | Local storage, Mapbox | Set by the Mapbox map that shows your delivery address; Mapbox uses it to count map loads | Until you clear site data |
9. Your rights
Under UK data protection law you have the right to:
- be informed about how we use your data (this policy);
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data erased, where we no longer need it or have no legal reason to keep it;
- restrict how we use your data in some circumstances;
- object to uses based on our legitimate interests;
- data portability — receive the data you gave us in a commonly used format;
- withdraw consent at any time, for example with “Cookie settings” at the bottom of every page. This doesn't affect anything done before you withdrew.
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
To use any of these rights, email hello@timeandtideskincare.co.uk. We will reply within one month. There is normally no charge.
Complaints
If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or call 0303 123 1113.
10. Changes and contact
We will update this policy when the way we use personal data changes, and change the “last updated” date at the top. If a change affects the cookies you agreed to, we will ask for your consent again.
Questions about this policy or your data: hello@timeandtideskincare.co.uk.