Who we are
Joyaholic ("we", "us") runs joyaholic.com and is the controller of the personal information described here, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For anything about your data, email sales@joyaholic.com with "Privacy" in the subject line.
What we collect
| Information | Where it comes from |
|---|---|
| Order details: your name, email address, delivery address, the items you bought, the price paid and your PayPal order number | PayPal shares these with us when you pay |
| Personalisation: the name, initial, birthstone, size and other choices for your piece | You, at checkout |
| Photos for photo lockets | You, by email after ordering |
| Messages: emails you send us and our replies | You |
| Technical data: IP address, browser type and pages requested | Recorded automatically by our web host's server logs |
We never receive your card details. Payments are made on PayPal's secure system, and PayPal does not share full card numbers with us.
We don't knowingly collect information about children. Photos you send of children are used only to make your locket.
How we use it, and why
| What we do | Our lawful basis under UK GDPR |
|---|---|
| Make, personalise and deliver your order, and send you order and tracking emails | Contract: we need it to fulfil your order |
| Answer your questions, and handle returns, refunds and complaints | Contract, and our legitimate interest in looking after customers |
| Keep sales records for tax and accounting | Legal obligation |
| Prevent fraud and keep our website secure | Legitimate interests |
We don't send marketing emails, we don't run a newsletter, and we don't use your information for automated decision-making or profiling. If we ever start a newsletter, we will only add you if you sign up yourself.
Who we share it with
We only share what each party needs to do its job:
- PayPal processes your payment. PayPal is a separate controller of the data you give it, and its own privacy statement applies.
- Our production partner, ⟦who makes and/or dispatches the pieces, and in which country⟧, receives your personalisation details, photos and delivery address so they can make and send your piece.
- Delivery carrier ⟦carrier name⟧ receives your name and delivery address, and your email for tracking updates.
- Our email and website hosting providers store our emails and run our website.
- Professional advisers and authorities, such as our accountant or HMRC, where the law requires it.
We never sell or rent your personal information to anyone.
International transfers
Some of the services above may process data outside the UK. When that happens, we make sure the information is protected, either because the UK government has confirmed the country's protection is adequate, or by using the UK's approved International Data Transfer Agreement or Addendum. Email us if you would like more detail.
How long we keep it
- Order and payment records: 6 years from the end of the financial year of the sale, as UK tax law requires.
- Locket photos: deleted 60 days after your order is dispatched, so we can remake your piece if it arrives damaged. Ask us and we delete them sooner.
- Customer service emails: 2 years from our last contact, unless they relate to an open complaint or claim.
- Server logs: kept by our host for a short period for security, then deleted.
Your rights
Under UK GDPR you have the right to:
- ask for a copy of the information we hold about you
- ask us to correct information that is wrong
- ask us to delete your information (we may need to keep order records for tax reasons)
- ask us to limit how we use it, or object to how we use it
- ask us to send your information to you or another organisation in a usable format
To use any of these rights, email sales@joyaholic.com. It is free, and we reply within one month.
Cookies
Cookies are small files that websites store on your device. Joyaholic does not set any cookies of its own, and we don't use analytics, advertising or social media tracking.
| Service | Where | Why |
|---|---|---|
| PayPal | Checkout page only | PayPal sets cookies that are strictly necessary to process your payment securely and prevent fraud. You can't turn these off and still pay. See PayPal's cookie statement. |
| Google Fonts | Every page | Our fonts load from Google's servers, which receive your IP address to deliver the font files. Google Fonts does not set cookies. |
Because we only use strictly necessary cookies, we don't show a cookie banner. If we ever add analytics or advertising cookies, we will ask for your consent first and update this policy.
Security
Our website is served over an encrypted (HTTPS) connection. Payments run on PayPal's secure system. We limit access to your information to the people who need it to fulfil your order.
Changes and complaints
We will update this page if anything changes and show the date at the top. If you are unhappy with how we have handled your information, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.