Who we are

Our website address is: https://thornberryshop.com.

1. Overview

This Privacy Policy explains how we collect, use, and protect your personal information when you visit or make a purchase from our website (“Site”).

By using our Site, you agree to the practices described in this Privacy Policy.

2. Information We Collect

When you visit our Site or place an order, we may collect the following information:

2.1 Personal Information

  • Full name
  • Email address
  • Shipping and billing address
  • Phone number
  • Payment details (processed securely by third-party payment providers; we do not store full payment information)

2.2 Device and Usage Data

  • IP address
  • Browser type and version
  • Device information
  • Time zone and location data
  • Pages viewed and browsing activity
  • Cookies and tracking technologies

3. How We Use Your Information

We use the information we collect for the following purposes:

  • To process and fulfill orders
  • To manage payments and transactions
  • To deliver products and provide shipping updates
  • To offer customer support
  • To improve our website, products, and services
  • To detect and prevent fraud or security issues
  • To send marketing communications (only with your consent)

4. Cookies

We use cookies and similar technologies to enhance your browsing experience, including:

  • Remembering items in your shopping cart
  • Maintaining login sessions
  • Analyzing website traffic and performance
  • Improving marketing and advertising effectiveness

You can disable cookies in your browser settings, but some features of the Site may not function properly.

5. Sharing Your Information

We do not sell your personal data.

However, we may share your information with trusted third parties, including:

  • Payment processors (e.g., Stripe, PayPal)
  • Shipping and logistics providers
  • Website hosting and IT service providers
  • Marketing and analytics providers (e.g., Google Analytics, Meta Ads, TikTok Ads)
  • Legal authorities when required by law or to protect our rights

6. Data Security

We take appropriate technical and organizational measures to protect your personal information, including:

  • SSL encryption for data transmission
  • Secure servers and restricted access
  • Regular security monitoring

However, no method of transmission over the internet is 100% secure.

7. Your Rights (GDPR)

If you are located in the UK or EU, you have the following rights:

  • The right to access your personal data
  • The right to correct inaccurate data
  • The right to request deletion of your data (“right to be forgotten”)
  • The right to restrict or object to processing
  • The right to data portability
  • The right to withdraw consent at any time

To exercise your rights, please contact us using the details below.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, including legal, accounting, or reporting requirements.

9. Third-Party Services

We may use third-party services that process data on our behalf, such as:

  • Payment gateways (Stripe, PayPal, etc.)
  • Analytics tools (Google Analytics)
  • Advertising platforms (Meta, TikTok, Google Ads)
  • Shipping carriers and fulfillment services

Each third party has its own privacy policy governing their use of your information.

10. Children’s Privacy

Our Site is not intended for individuals under the age of 16. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date.

Comments

When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.

An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.

Media

If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

Cookies

If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.

Embedded content from other websites

Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Who we share your data with

If you request a password reset, your IP address will be included in the reset email.

How long we retain your data

If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue.

For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

What rights you have over your data

If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

Where your data is sent

Visitor comments may be checked through an automated spam detection service.