Alderstone LTD · Registered company number required · Registered address required
Last updated: Date required on publication

1. Data controller

Alderstone LTD is the data controller for personal data collected through alderstones.co. Contact: privacy contact email required. Confirm whether a Data Protection Officer or EU/UK representative is required

2. What we collect

• Identity and contact data — name, email, phone, delivery and billing address
• Order data — what you bought, when, and the status of the order
• Payment data — handled by our payment provider; we receive confirmation and the last four digits only
• Account data — login credentials (hashed), saved addresses, preferences
• Subscription data — plan, renewal date, delivery history
• Technical data — IP address, device, browser, pages visited
• Marketing preferences — whether you have opted in and what you engage with

3. How we collect it

Directly from you when you order, create an account, subscribe or contact us; automatically through cookies and similar technologies; and from service providers such as our payment and shipping partners.

4. Why we use it (lawful bases)

• Performance of a contract — to take payment, fulfil and deliver your order, and run your subscription
• Legal obligation — tax, accounting and consumer law record-keeping
• Legitimate interests — fraud prevention, site security, service improvement and analytics
• Consent — marketing email, non-essential cookies and advertising pixels; withdrawable at any time

5. Marketing

We send marketing email only where you have opted in. Every message contains an unsubscribe link and we honour it immediately.

6. Cookies and tracking

See our Cookie Policy. Non-essential cookies, including advertising pixels, are set only after consent.

7. Who we share it with

• Payment provider — to process payment provider required
• Shipping carriers — to deliver your order carriers required
• Email platform — to send transactional and marketing email platform required
• Analytics and advertising platforms — where you have consented confirm which are live
• Professional advisers, and authorities where legally required

A full list of processors and their locations is required before publication

8. International transfers

Some providers process data outside your country. Where that happens we rely on appropriate safeguards such as standard contractual clauses. Confirm transfer mechanisms once processors are chosen

9. How long we keep it

Order and tax records are kept for the period required by law retention periods required. Account and marketing data are kept until you ask us to delete them or the account becomes inactive.

10. Your rights

• Access a copy of your data
• Correct inaccurate data
• Delete your data, where we are not required to keep it
• Restrict or object to processing
• Data portability
• Withdraw consent at any time
• Complain to your data protection authority supervisory authority details required

11. Security

We use HTTPS across the site, restrict internal access to personal data, and rely on PCI-compliant providers for payment. No system is perfectly secure, and we will notify you and the relevant authority of a qualifying breach as required by law.

12. Children

This site is not directed at children and we do not knowingly collect data from anyone under 16.

13. Changes

We will post any changes here and update the date at the top of this page.

Contact

Questions about this policy: Support email required · Contact page.