Privacy policy
PRIVACY POLICY
Moss & Willow
Last updated: 16th August 2026
Privacy Summary
* We use your information to process orders, deliver purchases, provide customer support and improve your experience.
* We only send marketing if you ask us to (or where permitted by law), and you can opt out at any time.
* We share data only with trusted providers (such as Shopify, payment and delivery partners) to run our store.
* You can request access, correction or deletion of your data by emailing Contact@mossandwillow.co.uk.
Moss & Willow respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, share and protect your personal data when you visit our website, purchase from us, contact us, or otherwise use our services (the “Services”).
This Privacy Policy should be read alongside our Terms & Conditions, Shipping Policy, Returns & Refunds Policy, and Cookies Policy.
Nothing in this Privacy Policy affects your statutory rights.
1. Who we are (Controller) and how to contact us
Controller (data controller): Moss & Willow
ICO registration reference: [YOUR REFERENCE]
Contact email: Contact@mossandwillow.co.uk
Postal address: 13 Wareham Road, Lytchett Matravers, Poole, Dorset, BH16 6FH, United Kingdom
If you have any questions about this Privacy Policy or would like to exercise your rights, contact us using the details above.
Complaints
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.
We would appreciate the opportunity to resolve your concerns first, so please contact us in the first instance.
UK supervisory authority: Information Commissioner's Office (ICO)
2. The personal data we collect
“Personal data” means information that identifies you or can reasonably be linked to you.
We may collect and process the following categories:
Identity and contact
* Name, billing address, delivery address, email address, phone number
Order and transaction
* Items purchased, returns/exchanges, order history, payment status, delivery and tracking information
Payment
* Payment method and transaction references
Note: Card payments are processed by our payment providers; we do not store full card details.
Account (if you create one)
* Login details, saved addresses, preferences and settings
Communications
* Messages you send us (email/contact forms), customer support records, reviews (where enabled)
Technical and usage
* IP address, device identifiers, browser type, operating system
* How you navigate and interact with our site (pages viewed, clicks, timestamps)
Marketing preferences
* Your subscription status and preferences for receiving marketing
We do not intentionally collect “special category” data (e.g., health, religion) and do not require it to provide our Services.
3. How we collect your data
We collect personal data in the following ways:
* Directly from you (placing an order, creating an account, contacting us, subscribing to marketing)
* Automatically (cookies and similar technologies when you browse our website)
* From service providers (Shopify, payment processors, delivery partners, analytics and marketing providers)
* From third parties where permitted (e.g., fraud prevention signals and chargeback information)
4. How we use your personal data (and our lawful bases)
Under UK GDPR, we must have a lawful basis to process your data. We use your data for the purposes below:
A) To provide our Services (Contract)
* Process orders and payments
* Dispatch deliveries and manage returns/refunds
* Provide customer service and order updates
*Maintain your account (if you create one)
Lawful basis: performance of a contract
B) To operate and improve our business (Legitimate interests)
* Website performance, troubleshooting, analytics and reporting
* Improving product offering, customer experience and site functionality
* Preventing misuse of the website and protecting platform security
Lawful basis: legitimate interests (balanced against your rights)
C) Marketing and communications (Consent and/or legitimate interests)
* Send newsletters and promotional emails to those who have opted in
* If you have purchased from us, we may send marketing about similar products unless you opt out (soft opt-in), where permitted by law
* Measure campaign performance
Lawful basis: consent (where required), and/or legitimate interests (where permitted)
You can opt out at any time by using the unsubscribe link in our emails or contacting us.
D) Fraud prevention and security (Legitimate interests / Legal obligation)
* Detect and prevent fraud, account misuse, and suspicious transactions
* Maintain a secure shopping environment
Lawful basis: legitimate interests and/or legal obligation
E) Compliance and legal claims (Legal obligation / Legitimate interests)
* Comply with legal and regulatory duties
* Respond to lawful requests
* Establish, exercise or defend legal claims
Lawful basis: legal obligation and/or legitimate interests
5. Cookies and similar technologies
We use cookies and similar technologies to operate our website, remember preferences, analyse performance and (where enabled) support marketing.
For details of what we use and how to manage your choices, please see our Cookies Policy.
6. Who we share your data with
We only share personal data where necessary for the purposes above, including with:
* Shopify (our e-commerce platform host)
* Payment providers (to process payments securely)
* Delivery and fulfilment partners (to ship your orders)
* Customer support tools (email/helpdesk systems)
* Analytics providers (to understand site usage and improve performance)
* Marketing partners (only where permitted and based on your preferences/settings)
* Professional advisers (e.g., accountants, insurers, legal advisers), where necessary
* Regulators/authorities where required by law
We require service providers to protect your information and process it only under our instructions (or as independent controllers, where applicable).
7. Relationship with Shopify
The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services for you. Information you submit to the Services will be transmitted to and shared with Shopify and third parties located in countries other than your country of residence to provide and improve the Services for you. In addition, to help protect, grow, and improve our business, we use certain Shopify-enhanced features that incorporate data and information from your interactions with our Store, as well as with other merchants and with Shopify. To provide these enhanced features, Shopify may use personal information collected about your interactions with our store, with other merchants, and with Shopify. In these circumstances, Shopify is responsible for the processing of your personal information, including for responding to your requests to exercise your rights over the use of your personal information for these purposes. To learn more about how Shopify uses your personal information and any rights you may have, you can visit the Shopify Consumer Privacy Policy. Depending on where you live, you may exercise certain rights with respect to your personal information here Shopify Privacy Portal Link.
7.1 Shopify and platform processing
Our store is hosted on Shopify, which provides the e-commerce platform that allows us to sell products to you. Shopify processes personal data to provide and improve its services (including security, fraud prevention and platform performance).
Depending on how Shopify features are configured (e.g., analytics or enhanced services), Shopify may process certain data as a controller for its own purposes. You can learn more via Shopify’s privacy information and settings within your Shopify checkout/account experience (where available).
8. International transfers
Some of our service providers (including Shopify and certain technology partners) may process data outside the UK.
Where personal data is transferred internationally, we ensure appropriate safeguards are in place, such as:
* UK adequacy regulations, and/or
* the UK International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs, and/or
* other lawful mechanisms recognised under UK GDPR.
9. Data security
We use appropriate technical and organisational measures designed to protect your personal data. No system is completely secure, and we cannot guarantee absolute security—particularly for data transmitted over the internet.
Please avoid sending sensitive information through unsecured channels.
10. How long do we keep your data (Retention)
We retain personal data only for as long as necessary for the purposes described in this policy, including:
* to fulfil orders and provide customer service
* for accounting and tax recordkeeping
* to manage disputes, chargebacks or legal claims
* to comply with legal obligations
Retention periods vary depending on the type of data and legal requirements. We will securely delete or anonymise data when it is no longer needed.
11. Your rights under UK GDPR
You may have the right to:
* Access your personal data
* Rectify inaccurate personal data
* Erase your personal data (in certain circumstances)
* Restrict processing (in certain circumstances)
* Object to processing (including direct marketing)
* Data portability (where applicable)
* Withdraw consent at any time (where processing is based on consent)
To exercise your rights, contact us at Contact@mossandwillow.co.uk.
Identity verification
To protect you, we may request information to verify your identity before responding.
Marketing preferences
You can opt out of marketing at any time via the unsubscribe link or by contacting us. Opting out will not affect service messages about orders, returns, or account security.
12. Children’s privacy
Our Services are not intended for children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us, and we will take appropriate steps.
13. Third-party links
Our website may contain links to third-party websites or services. We are not responsible for their privacy practices. Please review their policies before providing any personal data.
14. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated version on our website and update the “Last updated” date.
15. Contact us
For privacy questions or rights requests:
Email: Contact@mossandwillow.co.uk
Post: Moss & Willow, 13 Wareham Road, Lytchett Matravers, Poole, Dorset, BH16 6FH, United Kingdom