Privacy Policy
Last updated: 8 October 2026
This Privacy Policy explains how Handmade by Cathy Ashton (“I”, “me”, “we” or “us”) collects, uses and protects your personal information when you visit handmadebycathy.co.uk, place an order, request a custom item or sewing service, or get in touch. I am committed to keeping your information safe and only using it for the reasons set out below, in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
1. Who I am
Handmade by Cathy Ashton is a small handmade business run by Cathy Ashton, based in Liverpool, L11 0AG, United Kingdom. I am the “data controller” for the personal information described in this policy.
- Email: [email protected]
- Phone: 07926244957
- Location: Liverpool, L11 0AG, United Kingdom
2. Information I collect
Information you give me:
- Order details: your name, billing and delivery address, email address, phone number and the items you order.
- Personalisation details: names, dates, wording, colours, fonts or designs you ask me to embroider or create. These often include a child’s or baby’s name, date of birth or other details about family members.
- Custom, keepsake and sewing service requests: measurements, photographs, descriptions and any clothing or fabric you send me (for example, for memory bears, memory cushions, alterations or repairs). Some keepsake orders may involve information about a loved one who has passed away; I treat this with particular care and confidentiality.
- Contact form messages: your name, email address and message when you use the contact form on my website, as well as anything you send by email, phone, Facebook or Instagram.
- Account details: if you create an account on my website, your login email, password (stored securely and encrypted) and order history.
- Newsletter sign-ups: your email address if you subscribe for new products, offers and updates.
- Reviews: your name and comments if you leave a review that I share on my website or social media.
Information collected automatically:
- When you browse the website, technical information such as your IP address, browser type, device, pages visited, how you arrived at the site and the date and time of your visit may be collected through cookies and similar technologies (see section 7).
Payment information: card payments are processed securely by WooPayments (powered by Stripe), which accepts all major credit and debit cards, and PayPal payments are processed by PayPal. You enter your payment details directly with these providers. I never see or store your full card details.
3. How I use your information and the legal basis
| What I use it for | Legal basis under UK GDPR |
|---|---|
| Processing, making, personalising and delivering your order, and taking payment | Performance of a contract |
| Quoting for and carrying out custom work, keepsakes, alterations and repairs | Performance of a contract, or steps taken at your request before a contract |
| Answering your questions and keeping you updated about your order | Performance of a contract and legitimate interests |
| Handling returns, refunds, faults and complaints | Performance of a contract and legal obligation |
| Keeping accounts and records for tax purposes (HMRC) | Legal obligation |
| Preventing fraud and keeping payments secure | Legitimate interests and legal obligation |
| Sending my newsletter with new products, offers and updates | Consent (you can unsubscribe at any time) |
| Understanding how visitors use the website (Google Analytics) | Consent |
| Measuring and showing adverts on Facebook and Instagram (Facebook Pixel) | Consent |
| Running, securing and improving the website | Legitimate interests |
| Sharing photos of finished work on my website or social media | Consent (I will always ask first and will remove personal details such as names unless you agree) |
4. Children’s information
Many of my products are made for babies and children, so orders often include a child’s name or other details. This information is provided by the parent, family member or gift-giver placing the order, and I use it only to make and deliver the item. My website and services are intended for adults; I do not knowingly collect personal information directly from children under 13. If you believe a child has given me their information, please contact me and I will delete it.
5. Who I share your information with
I never sell your personal information. I only share it with trusted service providers who help me run my business, and only as much as they need:
| Provider | What they do |
|---|---|
| Hostinger | Hosts the website and stores website, order and account data |
| WordPress and WooCommerce | Run the website and online shop |
| Ninja Forms | Powers the website contact form; messages are stored on my website and sent to my email |
| WooPayments (powered by Stripe) | Processes card payments |
| PayPal | Processes PayPal payments |
| Mailchimp | Will be used to manage newsletter subscriptions and send emails (from when it is introduced) |
| Google Analytics and Google Tag Manager (Google) | Measure website visits and manage website tags |
| Facebook Pixel (Meta) | Measures adverts and helps show relevant adverts on Facebook and Instagram |
| Royal Mail and other couriers | Deliver your order |
| My accountant | Tax and legal compliance, where needed |
I may also share information where I am legally required to, for example with HMRC or the police. If you order a gift to be sent to someone else, I will use the recipient’s name and address only to deliver it.
6. International transfers
Some of my service providers, including Google, Meta, Stripe, PayPal and Mailchimp, may store or process data outside the UK, for example in the EU or USA. Where this happens, appropriate safeguards are in place, such as UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, or approved contractual clauses.
7. Cookies and tracking
Cookies are small text files saved on your device when you visit a website. Similar technologies such as tracking pixels work in the same way. My website uses:
- Essential cookies: set by WordPress and WooCommerce for the shopping basket, checkout, account login and website security, and by WooPayments and PayPal to process payments safely and prevent fraud. These cannot be switched off.
- Analytics cookies: Google Analytics collects information such as pages visited, time spent on the site and how you found it, so I can understand what customers like and improve the website. This information is grouped and does not directly identify you.
- Marketing cookies: Facebook Pixel (Meta) helps me see how well my Facebook and Instagram adverts work and show adverts to people who may be interested in my products.
- Google Tag Manager: a tool I use to manage the analytics and marketing tags above. It does not collect personal information itself.
- Social media content: links to Facebook and Instagram may set their own cookies, covered by those companies’ privacy policies.
Analytics and marketing cookies are only used if you agree to them through the cookie banner on my website. You can change your choice at any time using the cookie settings link, or delete cookies through your browser settings. You can also opt out of Google Analytics at tools.google.com/dlpage/gaoptout and manage Facebook advert settings in your Facebook account. Blocking essential cookies may stop parts of the website, such as the checkout, from working.
8. How long I keep your information
- Order and financial records: 6 years after the end of the financial year, as required for HMRC tax purposes.
- Personalisation, custom and keepsake details: up to 12 months after your order is completed, in case you need a repeat or matching item, unless you ask me to delete them sooner.
- Contact form messages: up to 2 years, unless they lead to an order.
- Newsletter subscriptions: until you unsubscribe.
- Customer accounts: until you close your account or it has been inactive for 3 years.
- Analytics data: kept by Google Analytics for up to 14 months.
Photographs and measurements you send for custom work are deleted when no longer needed.
9. Keeping your information safe
I take sensible steps to protect your information, including secure (HTTPS) encryption across the website, secure payment processing through WooPayments and PayPal, password-protected devices and accounts, regular website updates, and limiting access to your information to me and the services listed above. No method of sending information over the internet is completely secure, but I work hard to protect your data.
10. Your rights
Under UK data protection law, you have the right to:
- ask for a copy of the personal information I hold about you;
- ask me to correct information that is wrong or incomplete;
- ask me to delete your information (where I am not legally required to keep it);
- ask me to limit or stop using your information in certain ways;
- object to me using your information for legitimate interests or marketing;
- ask for your information in a format you can take elsewhere;
- withdraw your consent at any time, for example by unsubscribing from the newsletter or changing your cookie settings.
To use any of these rights, email [email protected]. I will respond within one month. There is normally no charge.
11. Complaints
If you are unhappy with how I have handled your information, please contact me first so I can try to put things right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.
12. Changes to this policy
I may update this Privacy Policy from time to time, for example when I start using new services. The latest version will always be on this page, with the date it was last updated shown at the top.