This policy explains how Annasach collects, uses and protects your personal data, in line with UK GDPR and the Data Protection Act 2018.

WHO IS RESPONSIBLE FOR YOUR DATA:

Annasach is the data controller. Contact: hello@annasach.uk. 

WHAT WE COLLECT:
• Order details: your name, delivery address, email and order history.
• Payment information: processed securely by our payment provider; we do not store your
full card details.
• Communications: messages you send us by email or contact form.
• Marketing data: your email address, if you sign up to our mailing list.
• Website data: basic analytics and cookie data when you browse our site.

HOW WE USE YOUR DATA:
• To process and deliver your orders and handle returns.
• To respond to your enquiries.
• To send marketing emails, where you have consented, which you can opt out of at any
time.
• To meet our legal and accounting obligations.

LEGAL BASES:
We rely on: performance of our contract with you (to fulfil orders); your consent (for marketing); and our legitimate interests (to run and improve our business), and where we are under a legal obligation (such as keeping financial records).

SHARING YOUR DATA:
We share data only as needed to run the business: with our website and payment platform, our delivery provider (Royal Mail), and our accountant. We do not sell your data. Some providers may process data outside the UK; where they do, appropriate safeguards are in place.

HOW LONG WE KEEP IT:
We keep order and transaction records for as long as required for tax and accounting purposes (generally six years). Marketing data is kept until you unsubscribe.

YOUR RIGHTS:

Under UK data protection law, you have the right to access your data, correct it, ask us to delete it, object to or restrict processing, and withdraw consent to marketing. To exercise any of these, email hello@annasach.uk.

COOKIES:
Our website uses cookies to function and to understand how visitors use the site. You can
control cookies through your browser settings and our cookie banner.

COMPLAINTS:
If you have a concern about how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

CHANGES TO THE POLICY:
We may update this policy from time to time. The current version is always available on our website.