Privacy Policy

We do not sell your personal information to third parties.

We share your data with the following trusted third-party processors who help us operate our business:

• Stripe (Payment Processing): Processes card payments securely. Stripe is PCI-DSS Level 1 certified. Data may be transferred to the USA under adequate safeguards (Standard Contractual Clauses).
• Supabase (Database & Authentication): Stores customer data and manages user accounts. Data is stored in EU/UK data centers where possible.
• Resend (Email Communications): Sends transactional and marketing emails on our behalf.
• Vercel (Website Hosting): Hosts our website infrastructure. Data may be processed in the USA and EU.
• Shipping Carriers: Delivery companies who need your name and address to deliver your order (e.g., Royal Mail, DPD, etc.).

We also share information when:

• Required by Law: To comply with legal obligations, court orders, or regulatory requirements
• Business Transfers: In connection with a merger, acquisition, or sale of assets (you will be notified)
• With Your Consent: When you've given explicit permission

All third-party processors are carefully selected and required to provide appropriate security measures and comply with UK data protection laws.

We use cookies and similar technologies in compliance with the Privacy and Electronic Communications Regulations (PECR).

Managing Cookies: You can control and delete cookies through your browser settings. Please note that disabling essential cookies may affect the functionality of our website.

For more information about cookies and how to manage them, visit www.aboutcookies.org or www.allaboutcookies.org.

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy or as required by law:

• Order and Transaction Records: 7 years from date of transaction (HMRC requirement for tax purposes)
• Customer Account Information: As long as your account is active, plus 7 years after account closure
• Marketing Consent Records: Until consent is withdrawn, plus 3 years to demonstrate compliance
• Website Analytics Data: 26 months maximum
• Communication Records: 3 years from last contact
• CCTV or Security Footage (if applicable): 30 days maximum

After the retention period expires, we will securely delete or anonymize your personal data. Some data may be retained longer if required by law or for legitimate business purposes (e.g., ongoing legal claims).

Some of our third-party service providers are located outside the United Kingdom and European Economic Area (EEA), which means your personal data may be transferred to and processed in other countries, including the United States.

When we transfer your data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office
• Adequacy decisions where the destination country provides adequate data protection
• Certification schemes (e.g., EU-US Data Privacy Framework where applicable)

For more information about the safeguards we use for international transfers, please contact us at hello@keepitwhat.com.

We will only send you marketing communications if you have given us your consent or where we have a legitimate interest (and you have not opted out).

You can opt-out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Contacting us at hello@keepitwhat.com
• Updating your preferences in your account settings

Note: Opting out of marketing does not affect transactional emails (e.g., order confirmations, shipping updates) which are necessary for the service.

If you have questions about this Privacy Policy, how we handle your data, or wish to exercise your data protection rights, please contact us:

We aim to respond to all legitimate requests within one month. Occasionally it may take us longer if your request is particularly complex or you have made multiple requests.