Privacy Policy

1. Who controls your information

The data controller is Memory Bears by Laura.

2. Information we may collect

Depending on how you use the website, we may collect:

• your name;
• email address;
• telephone number;
• delivery address;
• account/login information;
• order details;
• products and extras selected;
• personalisation instructions;
• notes supplied in connection with your keepsake;
• communications between you and us;
• order status;
• tracking information;
• payment transaction references;
• technical information about website use; and
• analytics information where enabled.

We do not intend to collect or store full payment-card details ourselves.

Payment-card information is processed by the payment provider.

3. Why we use your information

We use personal information to:

• process and fulfil orders;
• match customer clothing with the correct order;
• communicate about orders;
• send clothing-receipt, production and dispatch updates;
• manage customer accounts;
• provide customer support;
• prevent fraud and misuse;
• maintain security;
• comply with accounting and legal obligations;
• improve our services; and
• understand website use where analytics are enabled.

4. Lawful bases

Contract

Where information is required to take, produce, manage and deliver an order.

Legal obligation

Where information must be retained or processed to comply with tax, accounting or other legal requirements.

Legitimate interests

For proportionate activities such as protecting the website, maintaining appropriate records, preventing misuse and improving our service, where those interests are not overridden by your rights.

Consent

Where consent is appropriate, including optional analytics and similar technologies.

5. Payment information

Payments are processed by our payment provider.

We may receive transaction identifiers, payment status and other information necessary to reconcile and manage an order.

We do not store your full card number or card security code.

6. Who we share information with

Where necessary to operate the business, service providers may include:

• Railway, for website and database infrastructure;
• Resend, for transactional emails;
• Stripe, where used for payment processing;
• postal and courier providers used to deliver orders;
• Google Analytics, where enabled;
• Microsoft Clarity, where enabled; and
• professional advisers, regulators or public authorities where required by law.

Only information reasonably necessary for the relevant service should be shared.

We do not sell your personal data.

7. Analytics

Where enabled through our cookie controls, we may use Google Analytics and Microsoft Clarity to understand how visitors use the website and identify usability problems.

We do not intentionally send:

• customer names;
• email addresses;
• postal addresses;
• telephone numbers;
• tracking numbers;
• bear notes; or
• personalisation text

to analytics providers.

Sensitive/customisation areas should remain masked from Microsoft Clarity where appropriate.

8. International processing

Some service providers may process information outside the United Kingdom.

Where personal information is transferred internationally, appropriate lawful safeguards and transfer mechanisms should be used as required by UK data-protection law.

9. How long we keep information

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected and to meet legal, tax and accounting obligations.

Order and transaction records may need to be kept for several years.

Information which is no longer required should be deleted, anonymised or otherwise securely disposed of where appropriate.

10. Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, alteration or disclosure.

No internet service can guarantee absolute security, but we take proportionate measures to protect information entrusted to us.

11. Your rights

Depending on the circumstances, UK data-protection law may give you rights to:

• access personal information;
• correct inaccurate information;
• request deletion of information;
• restrict certain processing;
• object to certain processing;
• receive certain information in a portable format; and
• withdraw consent where processing relies on consent.

These rights may be subject to legal conditions and exemptions.

To make a request, email [email protected].

We may need to confirm your identity before responding.

12. Complaints

If you have concerns about how we use your personal information, please contact us first.

You also have the right to complain to the Information Commissioner's Office.

13. Changes to this policy

We may update this Privacy Policy as our services, providers or legal obligations change.

The current version will remain available on this website.

For more about website cookies and analytics choices, read our Cookie Policy.