Privacy and cookies policy

Last updated: 7 October 2026

1. Introduction

1.1 We are committed to safeguarding the privacy of our website visitors, customers and sellers. This policy explains what personal information we process, why we use it, who we share it with and your rights.

1.2 Ingenious Gifts is operated by Andrew Spackman, trading as Ingenious Gifts. In this policy, “we”, “us” and “our” refer to that business. Our contact details are in section 16.

1.3 This policy applies where we act as a controller of personal information: where we determine why and how it is processed. Independent sellers and certain service providers may also act as controllers for their own purposes.

1.4 We use cookies and similar technologies. Sections 11–15 explain their purposes and how to manage them. Where consent is required, we ask for it before using the relevant technology.

1.5 You can contact us about your information at hello@ingeniousgifts.co.uk or use our data access request page. That page is for privacy requests; it does not replace browser cookie controls.

2. How we use your personal information

2.1 We receive information directly from you when you browse, create an account, buy or sell products, subscribe to communications or contact us. We also receive relevant information from sellers, payment and delivery providers, connected services and website technologies.

2.2 Website usage. We may process IP addresses, browser and device details, referring pages, pages viewed and interaction information to operate and secure our website and understand its use. We use Google Analytics for website analytics. Necessary operational and security processing is based on our legitimate interests in maintaining a secure, usable website. Consent-based analytics processing is based on your consent.

2.3 Accounts. We process account information such as your name, email address, login details and account preferences to create and administer your account, provide services and communicate with you. The basis is performance of our contract with you, or steps you ask us to take before entering into it. Security and fraud prevention are based on our legitimate interests in protecting our customers, sellers and business.

2.4 Seller profiles and published content. We process seller business details, profile information, product descriptions, images and other content supplied for publication to administer marketplace listings and seller services. The basis is performance of the seller service contract where applicable. Where optional publication of personal information relies on consent, we explain this when obtaining it. Public content can be viewed by visitors and indexed by search engines.

2.5 Enquiries. We use the information in your enquiries to answer questions and provide requested information. The basis is taking steps at your request before a contract, where applicable, or our legitimate interests in answering enquiries and administering our business. An enquiry does not automatically subscribe you to marketing.

2.6 Customer and seller relationships. We process contact details and communications to administer relationships, resolve problems and maintain service records. The basis is performance of our contract where applicable, and our legitimate interests in providing support and keeping appropriate records.

2.7 Purchases and payments. We process your name, contact details, billing and delivery addresses, purchased items, order notes, payment status and transaction references to administer purchases, delivery, cancellations and refunds. The basis is performance of the relevant contract and compliance with applicable accounting and other legal obligations. Fraud prevention and handling disputes are based on our legitimate interests in protecting transactions and resolving claims. Payment details are handled through our payment providers; their privacy information is linked in section 3.

2.8 Notifications and newsletters. We use contact details to send service messages needed to administer your account or purchases, based on the relevant contract or our legitimate interests in providing the service. We send consent-based newsletters and marketing on the basis of consent. You can unsubscribe using the link in a marketing email or by contacting us. Withdrawing marketing consent does not prevent necessary order or account communications.

2.9 Correspondence. We process messages and associated information, including dates and contact-form metadata, to communicate with you and keep appropriate records. The basis is our legitimate interests in administering our business and supporting users, or performance of a contract where applicable.

2.10 Claims and professional advice. We may use relevant information to establish, exercise or defend legal claims, manage risks, obtain professional advice and maintain insurance. The basis is our legitimate interests in protecting our business and legal rights, or a legal obligation where applicable.

2.11 Legal obligations. We may process information where necessary to comply with a legal obligation. In exceptional circumstances we may process it to protect someone’s vital interests.

2.12 Required information. Some account, purchase and delivery information is necessary to provide the requested service or meet legal requirements. If you do not provide it, we may be unable to create an account, process a purchase or arrange delivery. We explain required fields when collecting information.

Shopify store connections

2.13 Approved Ingenious Gifts sellers may authorise a connection to a Shopify store they own or are authorised to manage. We process authorised store information to import selected products, update linked prices and inventory and provide enabled IG order and shipment syncing.

2.14 We hold the seller’s Shopify store address, seller-account association, authorised connection credentials, stock-location information, product and variant identifiers, imported product information, inventory mappings and synchronisation results. We also retain identifiers and confirmation records linking relevant Ingenious Gifts orders, refunds and shipments to their Shopify records. These help us maintain the connection, investigate errors, reconcile transactions and avoid duplicate operations.

2.15 Where order synchronisation is enabled, we send information about your purchase to the relevant seller’s Shopify store. Depending on the order, this can include your name, email address, telephone number, billing and delivery addresses, purchased products and selected options, quantities, prices, discounts, taxes, delivery charges, order identifiers, dates and notes. We may also send related refund amounts and reasons, cancellation information, external payment references, and supported dispatch, tracking and delivery updates.

2.16 We share this information to administer and fulfil the marketplace purchase, based on performance of the purchase contract where applicable, and our legitimate interests in accurately coordinating seller orders and preventing reconciliation errors. Seller connection administration is based on the seller service contract; security and fault investigation are based on our legitimate interests in protecting the integration. Relevant statutory record-keeping is based on legal obligations. Exporting an order does not subscribe the customer to marketing.

2.17 Your purchase takes place through Ingenious Gifts. Payments and payment refunds continue to be handled through Ingenious Gifts and its payment providers, including Stripe. The integration records the externally handled payment or refund in Shopify without collecting another payment from you. It does not send your payment-card details to Shopify or subscribe you to marketing. It disables its Shopify customer receipts and refund notifications, although the seller’s own settings, automations or connected services may send order-related messages. The integration reads the Shopify records needed to reconcile its own exported orders; it does not import unrelated Shopify orders or Shopify customer profiles. Printable postage labels are not copied to Shopify.

2.18 The seller and Shopify receive this information to administer and fulfil your order, manage deliveries, maintain order records and reconcile payments and refunds. Information may also be processed by services the seller has connected to their Shopify store for these purposes. Shopify explains its own handling at Shopify’s privacy policy. Sellers are responsible for their own use of customer information, including their store settings and other connected applications.

2.19 Saved Shopify access and refresh tokens are encrypted, and communication with Shopify uses HTTPS. Seller connection pages are restricted to the associated account, while authorised administrators manage setup and privacy requests. Temporary copies of order and refund information awaiting transmission or confirmation are stored encrypted. Once the relevant operation is confirmed, the integration removes its saved request copy. This does not delete the underlying Ingenious Gifts order or the record already received by the seller’s Shopify store. Failed or unconfirmed operations may retain information while we investigate and reconcile them, subject to the retention review described in section 5. Necessary order, transaction and shipment identifiers, financial information and operation records may remain for administration and reconciliation.

2.20 Disconnecting a store locally stops synchronisation and removes saved connection credentials. It does not uninstall the Shopify app or automatically delete previous orders, Shopify records or imported product listings. Some settings and mappings may remain to support permitted reconnection. Previously imported listings may remain available for manual management, subject to the seller’s marketplace agreement and applicable deletion obligations. Uninstallation and deletion requests are handled separately under section 5; removing integration identifiers alone does not erase all imported content.

2.21 We receive Shopify customer access, customer deletion and store deletion requests. Authorised administrators review requests against relevant integration records and Ingenious Gifts orders. We may need sufficient information to verify the request and identify the correct records; a Shopify customer identifier alone is not used to identify an Ingenious Gifts customer. We retain limited information to track privacy requests and their handling, including a store reference, request topic, supplied request reference, receipt time, deadline and resolution record. Matching information, including relevant contact details, supplied order references and associations with affected exports, is stored encrypted and removed from the integration’s request record when handling is completed. A minimal audit record and duplicate-detection information remain. We do not retain the complete original Shopify privacy-request message. A hashed store reference may be retained to prevent old jobs or callbacks reactivating a detached connection.

2.22 Where removal of captured integration information is required, administrators can pause the affected exports and remove stored customer details, notes and refund-request copies. Necessary financial identifiers, amounts and reconciliation records may be retained separately. This action does not automatically erase independent Ingenious Gifts orders, information already held in Shopify, logs, backups or other systems; these require separate review and any necessary action. Receiving a request or removing a stored export copy does not itself complete the request. Our handling includes manual review of relevant retained records and other systems, and communication of the outcome to the verified requesting merchant where appropriate. Section 5 explains retention and section 7 explains how to exercise your rights.

3. Sharing your personal information

3.1 Sellers and delivery providers. We share relevant order information with the seller responsible for your purchase so they can fulfil it and handle related enquiries. Relevant names, addresses, contact details and delivery instructions may also be shared with postal, courier and shipping services, including Royal Mail Click & Drop where used to arrange delivery or tracking.

3.2 Payment providers. Stripe processes payments and payment refunds on Ingenious Gifts. We share information necessary to process payments, refunds and payment queries, including transaction information and relevant contact and billing details. See Stripe’s privacy policy. Where PayPal is offered and selected, the relevant payment information is processed by PayPal; see PayPal’s privacy statement.

3.3 Hosting and website services. Our website is hosted using DigitalOcean. Its privacy information is available at DigitalOcean’s privacy policy. We also use providers supporting website operation, search, email delivery, security and maintenance. They receive information relevant to the services they provide.

3.4 Connected Shopify stores. Relevant information is shared with connected sellers’ Shopify stores, Shopify and relevant seller-connected services as explained in sections 2.13–2.22. This does not give an unrelated seller access to another seller’s connection or orders.

3.5 Professional advisers. We may disclose relevant information to insurers, accountants, legal advisers and other professional advisers where reasonably necessary for their work, managing risk or handling claims.

3.6 Legal disclosures. We may disclose information where necessary to comply with a legal obligation, protect vital interests or establish, exercise or defend legal claims. We limit disclosures to information relevant to the purpose.

4. International transfers

4.1 Some service providers, including providers of payment, analytics and connected-store services, operate internationally. Personal information may therefore be processed outside the United Kingdom.

4.2 Where a transfer requires safeguards under applicable data protection law, we must ensure the appropriate transfer requirements are met. Depending on the destination and arrangement, these may include recognised adequacy arrangements or approved contractual safeguards. You can contact us for information about the arrangements relevant to your information.

4.3 Information you choose to publish publicly, such as a seller profile or product listing, can be accessed worldwide. Please avoid including personal information that is unnecessary for publication.

5. Retaining and deleting information

5.1 We keep personal information only for as long as needed for the purposes described in this policy, taking account of applicable legal obligations, unresolved transactions, disputes and claims.

5.2 The retention period depends on the type of information and its purpose. Our criteria include:

1. For account and seller-service information: whether the account or service remains active, and whether information is needed to close it or resolve outstanding matters.
2. For orders, payments and refunds: applicable accounting and tax obligations, fulfilment, warranties, disputes and potential legal claims. Closing an account does not automatically remove required transaction records.
3. For enquiries and support: whether the enquiry remains open and whether the correspondence is needed to resolve a related complaint or demonstrate how it was handled.
4. For marketing preferences: whether consent remains active. Where necessary, we may retain a minimal suppression record to respect an unsubscribe request.
5. For integration settings and mappings: whether the connection remains authorised and whether the records are needed for permitted reconnection, reconciliation, privacy handling or preventing unauthorised reactivation.
6. For logs, scheduler records and privacy-request records: what is needed for security, fault investigation, reconciliation and demonstrating appropriate handling of requests.

5.3 When a seller uninstalls the Shopify app or a relevant deletion request is received, we review and remove API-derived merchant data in accordance with applicable requirements. Imported product content may need to be removed or replaced with content supplied independently to Ingenious Gifts. We do not assume that disconnecting a store, removing identifiers or obtaining seller consent creates an exemption from deletion requirements.

5.4 Information independently collected by Ingenious Gifts, including marketplace purchases, refunds and legally required financial records, is assessed separately under the relevant retention obligations. Independently supplied seller content is handled under the marketplace terms and this policy.

5.5 Information may also exist in backups. Backup copies and restored data must be considered when handling deletion requests; deletion from a live database is not a statement that every backup copy has immediately disappeared. Contact us for details of the arrangements applicable to a request.

5.6 We may retain information where required by law or necessary to establish, exercise or defend legal claims. Such retention must be limited to what is necessary for the relevant purpose.

5.7 Shopify integration retention is reviewed manually using the criteria above. This includes failed or unconfirmed exports, reconciliation and financial records, privacy-request records, logs and backups. Completion of a privacy request removes encrypted matching details from the integration’s request record, while limited handling and duplicate-detection records may remain where necessary. There is no universal automatic expiry for every integration record. We assess the underlying Ingenious Gifts order separately, including outstanding purchases, refunds, disputes, legal obligations and claims; a deletion request does not automatically erase every order or financial record.

6. Changes to this policy

6.1 We may update this policy by publishing a revised version on this page and changing the date above.

6.2 Where appropriate, we will bring material changes to your attention through email, your account or another suitable notice. Where a change requires fresh consent, we will seek it. Continuing to use the website is not automatically consent to every new processing purpose.

7. Your rights

7.1 Subject to the conditions and exceptions in applicable data protection law, your rights include:

1. Access to your personal information and information about its use.
2. Correction of inaccurate information and completion of incomplete information.
3. Erasure of information in appropriate circumstances.
4. Restriction of processing in appropriate circumstances.
5. Objection to processing, including direct marketing.
6. Data portability where the relevant conditions apply.
7. Withdrawal of consent where processing relies on consent.
8. Complaint to a data protection regulator.

7.2 Access. You can ask whether we process your information, request a copy and obtain information about the purposes, categories, recipients and retention involved. Copies are normally provided free of charge, subject to lawful exceptions and protection of other people’s rights.

7.3 Correction. You can ask us to correct inaccurate personal information or complete incomplete information, taking account of the purpose for which it is held.

7.4 Erasure. You can request deletion in circumstances such as where information is no longer needed, consent is withdrawn and there is no other basis for processing, or information has been processed unlawfully. This right is not absolute: legal obligations and the establishment, exercise or defence of claims may justify retaining relevant information.

7.5 Restriction. You may ask us to restrict use of information in circumstances such as a dispute about accuracy or a qualifying objection being considered. Restricted information may still be stored and used in limited circumstances permitted by law.

7.6 Objection. Where we rely on legitimate interests, you can object on grounds relating to your situation. We will stop the relevant processing unless a lawful reason permits it to continue. You can object to use of your information for direct marketing at any time.

7.7 Portability. Where automated processing is based on consent or a contract, you may be entitled to receive information you supplied in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.

7.8 Consent. You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

7.9 Requests. Contact hello@ingeniousgifts.co.uk or use our data access request page. You do not need an active account to email us. We may request proportionate information to verify identity. We respond within applicable statutory time limits and explain any lawful extension or refusal.

7.10 Complaints. Please contact us if you have concerns. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint/, or another competent supervisory authority where applicable.

7.11 Shopify-related requests. You can use the same contact details to ask about information shared through a connected Shopify store. We also receive privacy requests through Shopify and review them manually as described in section 2.21–2.22. Where relevant, we coordinate with the verified requesting merchant and consider independent Ingenious Gifts records and other systems before recording fulfilment. Deleting an integration copy alone does not complete a request.

8. Third-party websites

8.1 Our website includes links to third-party websites and services. Their own privacy notices explain how they handle information collected through those services.

8.2 Linking to a service does not mean we control its practices. Our own sharing of information remains subject to our responsibilities under applicable law.

9. Children’s information

9.1 Our website accounts and services are intended for adults aged 18 and over. We do not knowingly invite children to create accounts.

9.2 If you believe a child has provided information directly through an account or enquiry, please contact us so we can assess and address it. An adult may provide information relating to a child when ordering a personalised gift; please provide only what is necessary for the order.

10. Keeping information up to date

10.1 Please update your account details or contact us if information we hold about you is inaccurate or changes.

11. About cookies

11.1 Cookies are small files stored by a website in your browser. Similar technologies may store information on, or access information from, your device.

11.2 Session cookies generally expire when the browser session ends. Persistent cookies remain until their expiry date or until you delete them.

11.3 Cookies may contain identifiers and other information linked to your device or account. They can therefore involve personal information even where they do not contain your name.

12. Cookie purposes

12.1 Our website uses cookies and similar technologies for purposes including:

1. Accounts and authentication: recognising an authenticated session and allowing you to use account and seller-dashboard features.
2. Shopping cart and checkout: remembering cart contents and maintaining the session needed to complete a purchase.
3. Security: protecting accounts, detecting misuse and securing website requests.
4. Privacy preferences: remembering your cookie choices.
5. Analytics: understanding website use and performance through tools such as Google Analytics, subject to the applicable consent requirements.
6. Shopify connection security: associating an authorisation return with the authenticated browser that started the connection, using a short-lived security cookie.

12.2 Strictly necessary technologies support the service you request. Optional technologies requiring consent should remain disabled unless you choose to enable them.

13. Service-provider cookies

13.1 Services used on our website may also use cookies or similar technologies. Their use depends on the feature and your applicable consent choices.

13.2 We use Google Analytics to help understand website usage. Google’s privacy information is available at Google’s privacy policy.

13.3 Payment and other third-party features may use technologies needed for their operation, authentication and security. Relevant providers’ notices are linked in section 3.

14. Managing cookies in your browser

14.1 Most browsers let you view, block and delete cookies through their privacy or security settings. Consult your browser’s current help instructions for the available controls.

14.2 Blocking all cookies may prevent account login, shopping carts, checkout and other requested features from working correctly.

14.3 Deleting cookies may also remove saved preferences. Browser controls do not necessarily manage every type of tracking technology or change information already collected.

15. Cookie and marketing preferences

15.1 Where the website presents cookie choices, use those controls to accept or reject optional categories. You can also manage cookies through your browser or contact us for help with website preferences.

15.2 To stop marketing emails, use the unsubscribe link in the email or contact hello@ingeniousgifts.co.uk. This is separate from cookie settings.

15.3 To exercise data protection rights, use the contact details or request page in section 7.

16. Our details

16.1 This website is owned and operated by Andrew Spackman, trading as Ingenious Gifts.

16.2 Our business correspondence address is 94 Greenfields, Earith, Huntingdon, Cambridgeshire PE28 3QY, United Kingdom.

16.3 You can contact us:

1. By post to the address above.
2. Using our website contact form.
3. By telephone using the contact number published on our website.
4. By email at hello@ingeniousgifts.co.uk.