Privacy
Policy.

Last updated: May 2025

1. Who I Am

Just Shirley is my UK-based sole trader home business, specialising in handcrafted crystal jewellery. When I refer to "I", "me" or "my" in this policy, I mean me, Shirley.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller is me, Shirley.

If you have any questions about this policy or how I handle your data, please contact me at hello@justshirley.co.uk.

2. What Information I Collect

I collect only the information necessary to fulfil your order and provide you with a good service:

• Name — so I know who the order is for
• Delivery address — so I can post your jewellery to you
• Email address — so I can send order confirmations and respond to your enquiries
• Phone number (if provided) — only used if there is an issue with your delivery

If you subscribe to my newsletter, I will also hold your email address for that purpose.

3. What I Do NOT Collect

I never see, store or have access to your payment card details, bank information or any financial data. All payments are processed entirely by PayPal. My handling of your financial information is governed by PayPal's own Privacy Policy. I only receive confirmation that payment has been made.

4. How I Use Your Information

I use your personal information for the following purposes, all of which I consider necessary to perform my contract with you or to comply with my legal obligations:

• To process and fulfil your order
• To post your jewellery to the correct address
• To communicate with you about your order (confirmations, dispatch notifications, queries)
• To handle returns, exchanges or complaints in line with the Consumer Rights Act 2015
• To comply with my legal and tax obligations (e.g. HMRC record-keeping)

If you have given me consent, I may also use your email address to send you occasional newsletters with new collections, crystal guides and special offers. You can unsubscribe at any time.

5. Who Sees Your Information

Just Shirley is a cottage industry — a genuine small home business. Your information is treated with the same care and discretion you would expect from dealing with a real person directly.

The following people may see your name, delivery address and order details:

• Shirley — the owner and maker, who processes and fulfils every order
• Immediate family members — who occasionally assist with packing and dispatch during busy periods (e.g. party packs, larger orders, seasonal rushes)

That's it. Your information is never sold, rented, shared with marketing companies, or disclosed to any third party outside of Just Shirley's immediate circle.

The only external parties involved are:

• PayPal — who process your payment (they have their own privacy policy)
• Royal Mail / delivery courier — who receive only the information necessary to deliver your parcel (name and address on the label)

6. How I Protect Your Information

I take reasonable steps to keep your personal data safe. Order information is stored securely and access is limited to the people listed above. I do not store your data on publicly accessible systems or share it electronically with anyone outside of my fulfilment process.

However, please be aware that no method of electronic storage or transmission is 100% secure. I do my best, but I am a small home business, not a multinational corporation with a data centre — and I believe that honesty about that is important.

7. How Long We Keep Your Information

• Order records — kept for 6 years from the date of purchase, as required by HMRC for tax purposes
• Customer enquiries — kept for up to 2 years, then deleted
• Newsletter subscribers — kept until you unsubscribe

8. Your Rights Under UK GDPR

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the right to:

• Access — request a copy of the personal data I hold about you
• Rectification — ask me to correct any inaccurate information
• Erasure — ask me to delete your data (subject to my legal obligations to retain certain records)
• Restrict processing — ask me to limit how I use your data
• Object — object to me using your data for direct marketing
• Data portability — request your data in a structured, machine-readable format

To exercise any of these rights, email me at hello@justshirley.co.uk. I will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data has been mishandled.

9. Cookies

This website uses a small number of cookies:

• Essential cookies — to remember your shopping basket contents and your theme preference (light/dark mode). These are strictly necessary for the site to function and do not require consent.
• No tracking cookies — I do not use Google Analytics, Facebook Pixel, or any third-party tracking or advertising cookies.

By continuing to browse this website, you accept the use of these essential cookies in accordance with the Privacy and Electronic Communications Regulations (PECR) 2003.

10. Changes to This Policy

I may update this privacy policy from time to time. Any changes will be posted on this page with an updated date. I encourage you to review this page periodically.

11. Contact

If you have any questions or concerns about your privacy or this policy, please get in touch:

Email: hello@justshirley.co.uk
Or use my: Contact Form