Privacy Policy

1. Who we are

Jules Of The Earth is a small independent apothecary and perfumery based in East Yorkshire. We are the Data Controller for personal data collected through this website.

Our website is www.julesoftheearth.uk, self-hosted on our own server in the United Kingdom.

2. What data we collect

Data you give us directly

When placing an order

Name, email address, delivery address, and phone number (if provided). Payment details are processed directly by Stripe and are never seen or stored by us in full.

When creating an account

Name, email address, and a password (stored as a secure hash — we cannot read it).

When signing up to our newsletter

Email address only. You can unsubscribe at any time via the link in any email we send.

When contacting us

Name, email address, and the content of your message.

Data collected automatically

When you visit our site, our server and Cloudflare (our security and content delivery provider) may log your IP address and browser type for security purposes. We do not use this data for marketing or analytics. We do not use Google Analytics or any other analytics platform.

3. How we use your data

• To process and fulfil your orders, including sending order confirmations and dispatch notifications
• To manage your account if you have registered one
• To send our newsletter, where you have subscribed (you can unsubscribe any time)
• To respond to your enquiries and support requests
• To protect the website against fraud, bots, and security threats
• To comply with our legal obligations

We do not use your data for advertising, profiling, or automated decision-making. We do not sell your data. Ever.

4. Lawful basis for processing (UK GDPR)

Contract

Processing your name, address, and order details to fulfil a purchase you have made with us.

Legitimate interests

Security logging and fraud prevention via Cloudflare. Our legitimate interest is protecting the website and our customers.

Consent

Sending our newsletter. You can withdraw consent at any time by unsubscribing.

Legal obligation

Retaining order records for tax and accounting purposes.

5. Service providers

We share data with the following third parties only to the extent necessary to operate this website. None of them are permitted to use your data for their own purposes.

Stripe (payment processing)

Processes your payment securely. We pass your name, email, and order total to Stripe. Your card details go directly to Stripe and are never seen by us. Stripe is PCI-DSS compliant. Stripe Privacy Policy

Cloudflare (security & delivery)

All traffic to this website passes through Cloudflare, which provides DDoS protection, bot management, and HTTPS. Cloudflare processes IP addresses and request metadata for security purposes. Cloudflare Privacy Policy

Zoho Mail (transactional email)

We use Zoho’s SMTP service to send order confirmations and newsletter emails. Your email address is passed to Zoho solely to deliver emails you have requested or that are required to fulfil your order. Zoho Privacy Policy

Our website and database are hosted on our own server located in the United Kingdom. Your data does not leave the UK except where processed by the service providers above (Stripe: UK/EEA; Cloudflare: global edge network; Zoho: EU data centre).

6. Cookies & local storage

We use only strictly necessary cookies and local storage. We do not use tracking, advertising, or analytics cookies. See our Cookie Policy for full details.

7. How long we keep your data

Order data

Retained for 7 years to comply with HMRC accounting requirements, then securely deleted.

Account data

Retained while your account is active. You can request deletion at any time by contacting us.

Newsletter subscribers

Retained until you unsubscribe. Removed promptly on request.

Contact messages

Retained for as long as needed to resolve your enquiry, then deleted.

Security logs

Cloudflare retains logs per their own policy (typically up to 30 days). We do not maintain separate server access logs.

8. Security

Our website is served exclusively over HTTPS. Our server is protected by Cloudflare’s security layer. Passwords are stored as secure hashes. Payment data is handled entirely by Stripe and never touches our server.

No method of transmission over the internet is 100% secure. If you believe your data has been compromised, please contact us immediately at [email protected].

9. Your rights (UK GDPR)

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the following rights:

Right of access

Request a copy of the personal data we hold about you.

Right to rectification

Request correction of inaccurate or incomplete data.

Right to erasure

Request deletion of your data where we no longer have a lawful basis to hold it (e.g. you close your account and have no outstanding orders).

Right to restrict processing

Ask us to pause processing your data in certain circumstances.

Right to data portability

Receive your data in a structured, machine-readable format.

Right to object

Object to processing based on legitimate interests (e.g. security logging). We will stop unless we have compelling grounds to continue.

Right to withdraw consent

Where we rely on consent (newsletter), withdraw it at any time via the unsubscribe link or by contacting us.

To exercise any right, contact us at [email protected]. We will respond within one month. If you are unhappy with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

10. Children

Our website is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy when our practices change or when required by law. The “Last updated” date at the top of this page will reflect the most recent revision. Significant changes will be communicated by email to account holders.

12. Contact us

For any questions about this Privacy Policy, or to exercise your data rights, please contact us: