Privacy policy
Last updated: 28 September 2026
We collect as little as we can and we never sell your data. This page explains what we hold about you, why, who helps us handle it, how long we keep it, and what you can ask us to do with it. It is written to comply with the UK GDPR and the Data Protection Act 2018. If you have a question that this page does not answer, email winstonsemporium@outlook.com.
1. Who is responsible for your data
The data controller is Arthur Lawlor, trading as Winston's Emporium, of Hen Ysgubor, Coed Pryfydey, Llanbrynmair, Powys, Wales, SY19 7DN. Contact: winstonsemporium@outlook.com.
We do not have a data protection officer, as the law does not require one for a business of our size. Data questions go to the email above.
2. What we collect
When you browse the site. Basic technical data: IP address, browser and device type, pages visited, and cookie identifiers. Shopify, which hosts our shop, collects this to run the site securely. See section 8 for cookies.
When you create an account. Your name, email address (you sign in with a code sent by email, there is no password), saved delivery addresses and phone number if you add one, your order history and your wishlist.
When you place an order (with or without an account). Your name, email, delivery and billing addresses, phone number, what you ordered, and your payment details. Payments are handled by our payment providers; we see only the last four digits of a card, the payment method and the payment status, never the full card number.
When you submit a card request. The form asks for the card name, set, language, condition, quantity, your budget, your contact details, and your tick on the acknowledgement checkbox. We record the fact that you ticked it.
When you submit a wholesale request. Your shop name, your name and contact details, the products and case quantities you want, and your delivery postcode.
When you opt in to marketing. Your email address and your marketing preference, plus the date and how you opted in.
When you join VIP. Your subscription status and billing history, and your Discord username and Discord user ID. We store the Discord user ID so the VIP role can be granted to the right account when your membership is active, and removed when it ends.
When you join Wholesale. Your subscription status, and the business details you give us to confirm you are a business (business name, address, company number if you have one).
When you contact us. Your message and our replies, by email, Instagram, Discord or any other channel you use.
We do not ask for, and please do not send us, special category data (such as health, religion or political views).
3. Why we use it, and the legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Take and fulfil orders, deliver, take payment, send order emails, handle returns and refunds | To do what you have asked us to do | Performance of a contract |
| Run your account and wishlist | You asked for an account | Performance of a contract |
| Handle card requests and wholesale requests, send quotes and invoices | To provide the service you requested | Performance of a contract (steps taken at your request before a contract) |
| Grant and remove the Discord VIP role using your Discord user ID | To give you what your membership includes | Performance of a contract |
| Manage wholesale access with a customer tag | To give you what your subscription includes | Performance of a contract |
| Keep order, invoice and payment records | Tax and accounting law requires it | Legal obligation |
| Send marketing emails about drops, early access and new stock | To tell you about things you have said you want to hear about | Consent (you can withdraw it at any time) |
| Send service emails (order updates, subscription reminders, renewal notices, changes to terms) | Required to run the service and by consumer law | Performance of a contract and legal obligation |
| Fraud checks on orders | To protect you and us from fraud | Legitimate interests |
| Keep the site secure, fix bugs, understand which pages are used | To run a working, safe shop | Legitimate interests |
| Answer your messages and complaints | To help you | Legitimate interests, and legal obligation for complaints about your rights |
| Log quotes in a spreadsheet | To keep track of requests and quotes | Legitimate interests (running the quote service) |
Where we rely on legitimate interests, we have checked that our interest does not override your rights. You can object at any time (section 7).
We do not make decisions about you by purely automated means that have a legal or similarly significant effect. Fraud screening by our payment providers can flag an order for human review; it does not decline you on its own without a person looking.
4. Who we share it with
We use trusted services to run the shop. They process your data on our behalf and under our instructions, and are not allowed to use it for their own purposes.
| Service | What it does for us | Data it handles |
|---|---|---|
| Shopify (Shopify International Ltd and Shopify Inc.) | Hosts the shop, customer accounts, checkout, order emails, and Shopify Payments | Everything in section 2 that passes through the shop |
| Seal Subscriptions | Runs VIP and Wholesale memberships, billing and renewal reminders | Name, email, subscription and billing data |
| Locksmith (Lightward Inc.) | Locks the wholesale pages to tagged customers | Customer tags and account identifiers |
| eBay Integration by Digital Product Labs | Keeps our eBay listings, stock and orders in step with the shop | Order and customer details of eBay and shop orders, product and stock data |
| Shopify Forms | Collects card request and wholesale request forms | What you type into the forms |
| Discord Inc. | Runs the VIP community and the alert channels | Your Discord user ID and username, and anything you post on Discord |
| Google (Google Sheets) | Where we log requests and quotes | Name, contact details and quote details for card and wholesale requests |
| Payment providers (Shopify Payments) | Take your payment | Payment details, billing address |
| Delivery carriers (Royal Mail Tracked 48, Royal Mail Tracked 48) | Deliver your parcel | Name, address, phone number or email for delivery updates |
| Email delivery (Shopify Email) | Sends our marketing and service emails | Email address and name |
| Our accountant and, where required, HMRC | Bookkeeping and tax | Order and invoice records |
Telegram: if we add a Telegram mirror of the VIP alerts later, we will update this page before it goes live and explain what Telegram data we hold.
We also share data where the law requires it (for example a lawful request from the police or a regulator), to enforce our terms, or if we sell or restructure the business, in which case the buyer takes on the same obligations.
We do not sell your data and we do not share it with third parties for their own marketing.
5. Where your data goes
Shopify stores data in the EU and the United States, under Shopify's data transfer safeguards. Canada and the EU have UK adequacy decisions. Discord and Google are US companies. Where data goes to the United States we rely on the UK Extension to the EU-US Data Privacy Framework for providers certified under it, and otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. You can ask us for details of the safeguards in place.
6. How long we keep it
| Data | How long |
|---|---|
| Orders, invoices, payment records, refunds | 6 years from the end of the tax year of the order, as required by tax law |
| Account data | Until you delete your account, or after 3 years of inactivity, after which we delete it or anonymise it (order records are kept as above) |
| Card request and wholesale request forms, and the quote log | 12 months after the request is closed if no order followed; with the order records if it did |
| Marketing consent and preferences | Until you unsubscribe, then a record of the unsubscribe so we do not email you again |
| Discord user ID | While your VIP membership is active and for 30 days after it ends, then deleted |
| Wholesale business details | While your subscription is active and 6 years after the last order, with the order records |
| Emails and messages | 2 years after the last message, longer if needed for a dispute |
| Technical logs | As set by Shopify, typically the period set by Shopify |
7. Your rights
You have the right to:
- Access the personal data we hold about you and get a copy.
- Correct anything that is wrong or incomplete. You can edit most of it yourself in your account.
- Delete your data, where we no longer need it. We cannot delete order records we must keep for tax law, but we can remove everything else.
- Restrict how we use it in some circumstances.
- Port the data you gave us to another service, in a machine-readable format.
- Object to processing based on legitimate interests, and to marketing at any time.
- Withdraw consent where we rely on it, for example for marketing. Every marketing email has an unsubscribe link, and you can change your preference in your account.
- Not be subject to automated decisions with legal or similarly significant effects.
To use any of these rights, email winstonsemporium@outlook.com. We reply within one month. We may ask you to confirm your identity first so we do not give your data to someone else. There is no charge unless a request is clearly unfounded or excessive.
8. Cookies
Our site uses cookies and similar technologies. Some are essential to make the shop work (basket, checkout, login, security). Others, used for analytics and marketing, are set only if you accept them in the cookie banner. You can change your choice at any time through the banner or your browser settings. The cookie banner lists the cookies we use and lets you change your choice.
9. Marketing
We only send marketing emails if you have opted in, for example by ticking the box at checkout or in your account. You can opt out at any time by clicking unsubscribe in any email, by changing your account preferences, or by emailing us. Opting out of marketing does not stop service emails such as order confirmations, membership reminders and renewal notices, which we have to send.
10. Children
- You must be 18 or older to place an order. Under-18s need a parent or guardian to order for them.
- Discord requires its users to be 13 or older, so VIP members must be at least 13. A VIP membership paid for by someone under 18 needs a parent's or guardian's consent.
- We do not knowingly collect data from anyone under 13. If you think we have, tell us and we will delete it.
11. Security
Our shop runs on Shopify, which is certified to PCI DSS Level 1 for payment security. We use strong passwords and two-factor authentication on our admin and app accounts, limit staff access to what each person needs, and never store full card numbers. No system is perfectly secure, so if we ever suffer a breach that puts your rights at risk we will tell you and the ICO as the law requires.
12. Complaints
If you are unhappy about how we handle your data, please tell us first at winstonsemporium@outlook.com and give us the chance to put it right. You also have the right to complain to the UK regulator:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113. Website ico.org.uk.
13. Changes to this policy
We update this page when our data practices change. The date at the top tells you when it was last updated. For significant changes we tell account holders and members by email.