Privacy & cookies

Who is responsible for your information

Willow Tree Crafts Ltd, trading as Willow Tree Crafts and as No Troubles Bubbles, is the controller of the personal information described on this page. This notice covers both trading names.

If you have any question about how we use your information, or want to use any of the rights described below, contact us using these details.

The information we collect

• Details you give us when you order or open an account: your name, email address, telephone number, and billing and delivery addresses.
• Details of your orders: what you bought, when, what you paid, delivery and tracking details, any store credit on your account, and any returns or refunds.
• Anything you send us for a personalised item, such as a photograph, a name or wording.
• Messages you send us and our replies.
• If you create an account: your login email address and a securely hashed version of your password. We cannot see your password.
• Technical information needed to run the website, such as your IP address, the type of browser you use, and the contents of your basket.

We do not receive or store your full card details. Payment is handled by our payment providers, who tell us only whether the payment succeeded and limited details such as the type of card and its last four digits.

We do not knowingly collect information from children. You must be 18 or over to order.

How we use it and our legal basis

Data protection law requires us to have a legal basis for each use of your information. Ours are:

• To take, make, deliver and support your order, including contacting you about it, handling returns and refunds, and running your account. Legal basis: this is necessary to perform our contract with you.
• To keep records of sales, payments and refunds for tax and accounting purposes, and to deal with product safety matters and legal claims. Legal basis: we are under a legal obligation, or it is in our legitimate interests to be able to establish and defend legal claims.
• To prevent fraud and misuse of the website and to keep it secure. Legal basis: our legitimate interests in protecting our business and our customers.
• To answer your enquiries. Legal basis: our legitimate interests in responding to people who contact us, or steps taken at your request before entering into a contract.
• To send you marketing by email, only if you have asked us to. Legal basis: your consent, which you can withdraw at any time using the link in any such email or by contacting us.

We do not sell your information, and we do not use it to make automated decisions that have a legal or similarly significant effect on you.

Photographs for personalised items

If you send us a photograph for an engraved or personalised item, we use it only to make your order and, if needed, to remake it. To engrave a crystal, your photograph is processed by a specialist service provider acting on our instructions. We do not use customers' photographs for advertising or on social media without asking first.

If your photograph shows other people, please make sure they are happy for you to send it to us.

Who we share it with

We share your information only with those who need it to provide our service to you, and only as much as they need:

• Payment providers, including Stripe, PayPal and Klarna, to take your payment and prevent fraud. If you choose Klarna or PayPal, they collect information from you directly under their own privacy notices.
• Royal Mail and any other carrier we use, to deliver your order and send you delivery updates. They receive your name, address and, where given, your email address and telephone number.
• Companies that host and protect this website and our systems, store our backups and deliver our email, including Cloudflare and Microsoft.
• A specialist provider that prepares photographs for crystal engraving.
• Our professional advisers, such as accountants and solicitors, where needed.
• Regulators, the police, courts or other authorities where the law requires it, for example HM Revenue and Customs, Trading Standards or the Office for Product Safety and Standards.

Our service providers act on our instructions under contracts that require them to keep your information secure. Some of them are based, or store information, outside the United Kingdom. Where that is the case we make sure your information is protected to the standard UK law requires, for example because the country is recognised by the UK as providing adequate protection or because the provider is bound by approved contractual safeguards.

How long we keep it

• Order, payment and refund records: six years after the end of the tax year they relate to, as tax law requires.
• Records needed for product safety, such as batch records for bath and body products: for as long as the law requires, which can be up to ten years after the last batch was sold.
• Account details: for as long as your account is open. You can ask us to close it at any time; we then keep only the order records we are required to keep.
• Photographs and other material for personalised items: only for as long as we need them to make and support your order.
• Enquiries that do not lead to an order: up to two years.

Keeping it secure

We take appropriate technical and organisational steps to protect your information, including encrypting the connection between your browser and this website, restricting access to our systems to the people who need it, and keeping encrypted backups. No method of sending or storing information is completely secure, so we cannot guarantee absolute security. If a breach occurs that is likely to put your rights at risk, we will tell you and the Information Commissioner as the law requires.

Your rights

Under data protection law you have the right to:

• ask for a copy of the personal information we hold about you
• ask us to correct information that is inaccurate or incomplete
• ask us to delete your information, where we have no legal reason to keep it
• ask us to restrict how we use your information, or object to our using it, in certain circumstances
• ask us to give you, or another organisation, the information you gave us in a portable form
• withdraw your consent at any time, where we rely on consent
• object at any time to your information being used for direct marketing

To use any of these rights, email [email protected]. We do not charge for this and will reply within one month. We may need to ask you to confirm who you are before acting on your request.

If you are unhappy with how we have handled your information, please tell us first so that we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

Cookies

A cookie is a small file that a website stores on your device. This website uses only cookies and similar storage that are strictly necessary for it to work. Because they are essential, the law does not require us to ask for your consent to them, and we do not show a cookie banner.

• Basket: a cookie that remembers your basket so that it is still there when you move between pages or come back later.
• Sign-in: if you log in to an account, a cookie that keeps you logged in.
• Security and payment: cookies set by Cloudflare, which protects the website from attack, and by our payment providers when you pay, which they use to process the payment and detect fraud.
• Announcements: if you dismiss a notice at the top of the site, your browser stores that choice so that the notice stays hidden.

We do not use advertising cookies, and we do not use analytics or tracking cookies to follow you around this website or other websites. If that changes, we will update this page and ask for your consent first where the law requires it.

You can delete or block cookies in your browser's settings. If you block the cookies described above, the basket, checkout and account will not work.

Changes to this notice

We may update this notice from time to time. The date at the top of the page shows when it was last changed. If we make a significant change to how we use your information, we will tell you.