Privacy Notice

Crown & Leaf by St. Clair’s (“we”, “us”, “our”) is responsible for the personal information described in this notice.

For questions about privacy or the way we use your personal information, contact us at contact@crownandleaf.uk.

Information You Give Us

We may collect information you provide directly to us, including your name, email address, telephone number, delivery and billing addresses, and the contents of messages you send through our website or by email.

Order Information

When you place an order, we collect information about the products you purchase, including any custom tea blend you create, together with order values, delivery details and information required to manage and fulfil your purchase.

Account Information

If you create an account, we collect the information needed to create, secure and manage that account, including your email address and authentication information.

Technical and Usage Information

When you use our website, we may collect technical information such as your IP address, browser type, device type, approximate location derived from your IP address, pages viewed and information about how you interact with the website.

Some of this information is collected through cookies and similar technologies, as explained below.

Information From Service Providers

We may also receive information from service providers involved in operating our website and fulfilling orders, such as confirmation of payments, order status and delivery information.

We use your personal information to:

• process, fulfil and deliver your orders and communicate with you about them;
• create and manage your customer account;
• respond to questions, requests and customer-service enquiries;
• administer our business and comply with accounting, tax and other legal obligations;
• maintain, secure and troubleshoot our website and services;
• understand and improve the performance and use of our website; and
• send you marketing communications where permitted by law.

Under UK data protection law, we must have a lawful basis for using your personal information.

We rely on performance of a contract where processing is necessary to process an order, deliver products or provide account services you request.

We rely on legal obligations where we need to retain or use information to comply with tax, accounting, regulatory or other legal requirements.

We may rely on our legitimate interests where necessary to operate and protect our business, respond to enquiries, prevent fraud, maintain website security and improve our services, provided those interests are not overridden by your rights and interests.

Where required, we rely on your consent, including for certain marketing communications and cookies or similar technologies. Where processing is based on consent, you may withdraw that consent at any time.

Our ecommerce checkout is provided using Shopify.

When you proceed to checkout, information necessary to complete your purchase is processed through Shopify and the relevant payment provider. This may include your name, contact information, billing and delivery addresses, order information and payment-related information.

We do not receive or store your full payment-card details. We receive the information necessary to confirm, administer and fulfil your order.

For many services, Shopify processes customer personal information on our behalf. For certain Shopify services or features, Shopify or a payment provider may process personal information for its own purposes and may act as a separate data controller. Where applicable, their own privacy notices will govern that processing.

We use cookies and similar technologies to operate our website, maintain your basket, keep you signed in, protect the website and understand how our services are used.

Some technologies are necessary for the website or services you request to function correctly and may be used without your consent where permitted by law.

We may also use technologies for statistical purposes to understand how visitors use our website and improve it where the applicable legal requirements for doing so without consent are satisfied.

Where consent is required, including for any non-essential tracking, advertising or similar technologies, we will ask for your permission before using them. You can change your choices through our cookie controls.

For details of the cookies and similar technologies we use, including their providers, purposes and duration, please see our Cookie Policy.

We may send you information about Crown & Leaf products, offers and news where you have consented to receive it or where another lawful basis permitted by applicable marketing law applies.

You can unsubscribe from marketing emails at any time by using the unsubscribe option included in the message or by contacting us at contact@crownandleaf.uk.

Withdrawing from marketing will not prevent us from sending service communications relating to an order or account.

We may share personal information where necessary with trusted organisations that help us operate our business, including:

• ecommerce and payment-service providers;
• delivery and fulfilment partners;
• website hosting and infrastructure providers;
• analytics, security and technical-service providers;
• email and customer-communication providers; and
• professional advisers, regulators, courts or public authorities where disclosure is required or permitted by law.

We require service providers acting on our behalf to handle personal information appropriately and only for authorised purposes.

We do not sell your personal information.

Some of the organisations that process personal information for us may operate in, or use systems located in, countries outside the United Kingdom.

Where personal information is transferred internationally, we take appropriate steps required by applicable data protection law to protect it. Depending on the destination and provider, these measures may include transfers to countries recognised as providing an adequate level of protection or the use of approved contractual safeguards.

You may contact us if you would like further information about the safeguards applying to your personal information.

We keep personal information only for as long as necessary for the purpose for which it was collected and to meet applicable legal, accounting and regulatory obligations. In particular:

• Order and transaction records: six years from the end of the financial year in which the order was placed, to meet UK accounting and tax requirements.
• Customer account information: retained while your account remains active and for 12 months after closure, unless information must be retained for another lawful purpose.
• Customer enquiries and correspondence: up to two years after the enquiry is resolved.
• Marketing information: retained until you withdraw your consent, unsubscribe or otherwise object, subject to retaining limited information where necessary to respect your marketing preferences.
• Technical and security records: up to 12 months, depending on the nature of the records and security requirements.

When personal information is no longer required, we will delete or anonymise it where appropriate.

Under UK data protection law, you may have rights in relation to your personal information, including the right to:

• request access to personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• request deletion of your information in certain circumstances;
• request restriction of processing in certain circumstances;
• object to certain uses of your information, including direct marketing;
• receive certain information in a portable format; and
• withdraw consent where we rely on your consent.

These rights are subject to certain conditions and exemptions under applicable law.

To exercise your rights, contact us at contact@crownandleaf.uk. We may need to confirm your identity before completing a request.

We will respond to valid requests within the period required by applicable law.

If you have concerns about how we use your personal information, we would appreciate the opportunity to address them first. You can contact us using the details below.

You also have the right to complain to the UK’s data protection regulator:

Further information is available from ico.org.uk.

We may update this Privacy Notice from time to time to reflect changes to our website, services, technology, business practices or legal requirements.

The version published on this page is the current version, and the date at the top shows when it was last updated.

If you have any questions about this Privacy Notice, your personal information or how we handle it, please contact: