Privacy policy

This explains what personal data we collect when you shop with Tallspin, why we use it, who we share it with, and the rights you have under UK data protection law.

Last updated 12 November 2026. Applies to orders delivered in the United Kingdom.

Draft: needs legal review before launch. Highlighted items are still to be filled in.

Who we are

Tallspin is run by Business name (company number Company number), Business address. We're the controller of the personal data described in this policy, which means we decide how and why it's used.

We handle personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

For any privacy question or request, email [email protected].

This policy was last updated on 12 November 2026. If we make changes, we'll update this page and the date.

What we collect

When you place an order or contact us, we collect:

  • your name, email address and delivery address
  • your phone number, if you choose to give it, so carriers can contact you about delivery
  • what you ordered, what you paid and your order history with us
  • a Stripe customer ID, which links your order to your payment record at Stripe
  • anything you send us when you get in touch, such as emails and photos of a product

When you visit our website, we also collect:

  • technical information, such as your IP address, browser and device type, and the pages you view
  • how you arrived at our site, such as campaign tags in the link you clicked (UTM parameters) and, if you came from a Meta ad and have accepted advertising cookies, the Meta click ID (fbclid)

Most of this information comes directly from you. Some comes from cookies and similar technology (see below), from Stripe (for example, whether a payment succeeded) and from carriers (for example, delivery updates).

We need your name, email address and delivery address to fulfil your order. If you don't provide them, we can't process it.

How we use it and our lawful basis

We only use your personal data when the law allows it. For each purpose, the lawful basis we rely on is:

  • Processing and delivering your order, sending order and tracking emails, and handling returns, refunds and faulty items: contract.
  • Taking payment, and charging for the Bathroom Finishing Kit if you accept the one-click offer: contract.
  • Saving your card with Stripe so we can show you the one-click offer straight after checkout: legitimate interests (offering you a quick way to add a related item, which you're free to ignore).
  • Keeping tax and accounting records, and meeting our duties under consumer law: legal obligation.
  • Preventing fraud, keeping our website secure, and dealing with disputes or legal claims: legitimate interests.
  • Storing campaign tags (UTM parameters) with your order so we can see which campaigns lead to sales: legitimate interests.
  • Using the Meta Pixel and Meta Conversions API, including storing the Meta click ID with your order: consent.
  • Sending marketing emails, if you've signed up to receive them: consent. You can unsubscribe at any time.

Where we rely on legitimate interests, we've balanced our interests against your rights, and you can object at any time (see Your rights and how to complain).

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Stripe uses automated checks to help detect fraudulent payments. If you think a payment was wrongly declined, contact us.

Payments and your saved card

Payments are processed by Stripe. Your card details go directly to Stripe and are never stored on our systems. We can see limited details in Stripe, such as the card type, last four digits and expiry date, but never your full card number or security code.

When you pay, your card is saved with Stripe so that we can offer you a one-click add-on straight after checkout: the Bathroom Finishing Kit. If you choose to add it, we charge the same card. The price is shown before you accept, and nothing more is charged unless you click to accept. Occasionally your bank may ask you to confirm the payment again.

We don't use your saved card for any other purchase. If you'd like us to remove it from Stripe, email [email protected] and we'll do it.

Stripe also uses some payment information for its own purposes, such as preventing fraud, as a separate controller under its own privacy policy at stripe.com/privacy.

Cookies and advertising

Cookies and similar technologies, such as local storage, store small pieces of information on your device. We use two kinds:

  • Strictly necessary: these remember what's in your shopping bag and your cookie choices, and let Stripe process payments securely and prevent fraud. Our shop can't work without them, so they don't need your consent.
  • Advertising: the Meta Pixel sets cookies (such as _fbp and _fbc) to tell Meta when you view a page, add something to your bag or make a purchase. This helps us measure how our ads perform and show them to people who are likely to be interested. We only use these if you agree.

We also use the Meta Conversions API, which sends details of purchases from our server to Meta. This can include the order value and items, your IP address and browser details, the Meta click ID, and your email address and phone number in hashed form (converted into a code before it's sent, which Meta uses to match the purchase to a Facebook or Instagram account). We only send this if you've accepted advertising cookies.

Likewise, if you arrive through a link containing a Meta click ID (fbclid), we only store it with your order and share it with Meta if you've accepted advertising cookies.

We and Meta are joint controllers for collecting this information and sending it to Meta. Meta is responsible for how it uses the information after that, under its own privacy policy. You can also control how Meta uses your information for ads in your Facebook or Instagram ad settings.

You can accept or reject advertising cookies when you first visit, and change your choice at any time using the cookie settings link at the bottom of every page. Rejecting them won't affect your ability to shop with us.

Who we share it with

We only share personal data as needed to run our store, with:

  • our suppliers and fulfilment partners, who pack and send your order (your name, delivery address, phone number if given, and what you ordered)
  • carriers and postal services that deliver your parcels
  • Stripe, which processes payments
  • Meta, for advertising measurement, if you've accepted advertising cookies
  • DigitalOcean and Supabase, which host our website and store our order records
  • the service we use to send order and delivery emails
  • professional advisers such as our accountant, and HMRC, regulators or law enforcement bodies where the law requires it

Some of these organisations are outside the UK, mainly in China (our suppliers and fulfilment partners) and the United States (Stripe, Meta and some of our technology providers).

Where a country isn't covered by UK adequacy regulations, we use safeguards approved under UK law, such as the International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework for certified US companies. Where those aren't available, we rely on the transfer being necessary to carry out our contract with you, for example giving your delivery address to the supplier who sends your order. You can ask us for more information about these safeguards.

How long we keep it and how we protect it

  • Order, payment and refund records: six years from the end of the financial year they relate to, to meet tax and accounting rules.
  • Emails and support requests: for as long as we need them to deal with your request and any follow-up questions or claims.
  • Your shopping bag and cookie choices: on your device until you clear them.
  • Information sent to Meta or held by Stripe: kept under their own retention policies.

Our website is hosted by DigitalOcean and our order records are stored in a Supabase database. Access is limited to the people who need it to run the store, and our website uses encrypted connections (HTTPS).

No system is completely secure, but we take appropriate steps to protect your data. If a personal data breach is likely to put your rights and freedoms at high risk, we'll tell you without undue delay.

Your rights and how to complain

Under UK data protection law, you have the right to:

  • ask for a copy of the personal data we hold about you
  • ask us to correct data that's wrong or incomplete
  • ask us to delete your data where we no longer have a reason to keep it
  • ask us to restrict how we use your data in some circumstances
  • object to our use of your data where we rely on legitimate interests, and object to direct marketing at any time
  • ask for data you gave us in a format you can take elsewhere (data portability)
  • withdraw your consent at any time where we rely on it, without affecting anything we did before

To use any of these rights, email [email protected]. We'll respond within one month and, in most cases, won't charge a fee. We may need to confirm your identity first.

If you have a concern or complaint about how we use your data, please tell us first so we can try to put it right. We'll acknowledge your complaint within 30 days and let you know the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.