PRIVACY POLICY

Last updated: 2 September 2026

1. Who we are

SULSAL LTD ("SULSAL", "we", "us", "our") is the data controller responsible for your personal data.

• Registered company name: SULSAL LTD
• Company number: 17180318 (registered in England and Wales)
• Registered office: 76 Sherfield Gardens, London, SW15 4PR, United Kingdom
• Contact for data protection matters: support@sulsal.store
• ICO registration number: [ADD ONCE REGISTERED]

This policy explains what personal data we collect, why we collect it, what we do with it, and what rights you have. It applies to sulsal.store and to any orders you place with us.

We are not required to appoint a Data Protection Officer. Data protection questions should go to support@sulsal.store.

2. What we collect

When you place an order

• Name
• Billing and delivery address
• Email address
• Phone number
• Order contents and history
• Payment confirmation details

We do not see or store your full card number. Card payments are handled directly by our payment providers.

When you create an account

• Name, email address, password (stored encrypted)
• Saved addresses
• Order history

When you join our email list

• Email address
• Name, if you give it
• Whether you open our emails and which links you click

When you contact us

• Your name, email address, and the contents of your message

When you submit a review or photograph

• Your name or chosen display name, your review text, and any images you send

Automatically, when you browse

• IP address
• Browser type and device information
• Pages viewed, time spent, and referring website
• Cookie identifiers

3. Why we use it, and our legal basis

On marketing. If you buy from us, we may email you about similar products under the soft opt-in rule. If you have not bought from us, we will only email you if you have asked us to. Either way, you can unsubscribe from any email in one click, and we will stop.

On legitimate interests. Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights. You can object to this processing at any time — see section 8.

4. Who we share it with

We share your data only with organisations that help us run our business. Each is bound to protect it and may only use it for the purposes we specify.

Shopify Inc. — hosts our online store, processes checkout, and stores order and account data. Shopify is based in Canada with servers in the United States.

Payment providers — Shopify Payments and PayPal process card and wallet payments. They receive your payment and billing details directly. We receive only a confirmation and the last four digits of your card. Each operates under its own privacy policy.

Klaviyo — manages our email marketing. Receives your email address, name, purchase history, and email engagement data. Klaviyo is based in the United States.

Track123 — powers order tracking on our website. Receives your order and tracking numbers.

Delivery carriers — receive your name, delivery address, and phone number so they can deliver your order and contact you about it.

Professional advisers — accountants and, if needed, legal advisers, where required for our business or legal obligations.

Authorities — where we are legally required to disclose information, or to establish or defend legal claims.

We do not sell your personal data, and we do not share it with third parties for their own marketing.

5. Sending data outside the UK

Some of our providers, including Shopify and Klaviyo, are based outside the UK — principally in the United States and Canada.

Where personal data leaves the UK, we make sure it is protected by one of these safeguards:

• the country has UK adequacy status (Canada has partial adequacy for commercial organisations);
• the UK–US Data Bridge, where the recipient is certified under it; or
• the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

You can ask us for details of the safeguard used for any specific transfer by emailing support@sulsal.store.

6. How long we keep it

Where we must keep records for legal or accounting reasons, we hold only what is necessary and restrict access to it.

7. Cookies

We use cookies and similar technologies. Essential cookies keep the site working — remembering your basket, keeping you logged in, and securing checkout. These do not require your consent.

Analytics and marketing cookies are only set if you agree via our cookie banner. You can change your choice at any time through the banner or your browser settings.

We do not currently run advertising or social media pixels. If that changes, we will update this policy and our cookie banner before those cookies are set.

Full detail is in our Cookie Policy.

8. Your rights

Under UK data protection law you have the right to:

• Access — get a copy of the personal data we hold about you
• Rectification — have inaccurate data corrected
• Erasure — ask us to delete your data, where we have no overriding reason to keep it
• Restriction — ask us to pause processing while a concern is resolved
• Portability — receive data you gave us in a machine-readable format
• Object — object to processing based on legitimate interests, and to direct marketing at any time
• Withdraw consent — where we rely on consent, withdraw it at any time

To exercise any of these, email support@sulsal.store. We will respond within one month. We may ask you to confirm your identity first. Exercising these rights is free.

9. Security

We use appropriate technical and organisational measures to protect your data, including encrypted connections (SSL/TLS) across our site, encrypted password storage, restricted access on a need-to-know basis, and providers who maintain recognised security standards.

No system is completely secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the ICO within 72 hours and tell you directly where the risk is high.

10. Children

Our website and products are not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us their data, contact us and we will delete it.

11. Automated decision-making

We do not make decisions about you using automated processing alone that have legal or similarly significant effects. Our payment providers may run automated fraud checks on transactions; if a payment is declined on that basis you can contact us to discuss it.

12. Changes to this policy

We may update this policy. The date at the top shows when it was last changed. If we make a significant change to how we use your data, we will tell you by email or by a notice on this website.

13. Complaints

If you are unhappy with how we have handled your data, please contact us first at support@sulsal.store so we can try to put it right.

You also have the right to complain to the Information Commissioner's Office:

Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Helpline: 0303 123 1113 ico.org.uk

SULSAL LTD · Registered in England and Wales, company no. 17180318 · Registered office: 76 Sherfield Gardens, London, SW15 4PR · support@sulsal.store