Privacy Policy

Written for this store and current as of the date above, but not reviewed by a solicitor or a data protection specialist. Anything still shown in blue needs your input. If you have not registered with the ICO, check whether you need to.

This policy explains what personal data we collect when you use illunation.store, why we collect it, and what rights you have. We are the data controller for that information.

1. Who we are

Illunation, operated by [TRADING NAME] of [REGISTERED ADDRESS]. Contact: Hello@graftdesign.co.uk. ICO registration number: [ICO NUMBER, IF REGISTERED].

2. What we collect

• Order information — name, email, billing and delivery address, phone number, and what you ordered.
• Payment information — handled by Stripe and PayPal. We receive confirmation and the last four digits of a card, never the full card number.
• Account information — if you create an account, your username and password (stored hashed).
• Enquiries — anything you send us by email or a form on the site.
• Technical data — IP address, browser type, pages viewed and referring site, collected through cookies and server logs.

3. Why we use it, and our lawful basis

• To fulfil your order — taking payment, having your order printed and delivered, and providing support afterwards. Lawful basis: performance of a contract.
• To meet legal obligations — keeping tax and transaction records. Lawful basis: legal obligation.
• To protect the site — preventing fraud and abuse. Lawful basis: legitimate interests.
• To send marketing — only where you have opted in. Lawful basis: consent, which you can withdraw at any time.

4. Who we share it with

We do not sell your personal data. We share it only with providers who help us run the store, each acting under their own privacy terms:

• Stripe and PayPal — payment processing
• Prodigi — our UK print partner. We pass them your name and delivery address so they can make your order and post it to you.
• Hostinger — website hosting
• Google Search Console — anonymised statistics about how the site appears in search results. It does not place cookies on your device.
• Law enforcement or regulators, where we are legally required to

5. International transfers

Prodigi prints and posts UK orders from within the United Kingdom. Some of our other providers process data outside the UK; where that happens we rely on appropriate safeguards, such as UK adequacy regulations or standard contractual clauses.

6. How long we keep it

Order and transaction records are kept for 6 years to meet HMRC requirements. Account data is kept for as long as your account is open. Marketing consent is kept until you withdraw it. General enquiries are kept for 24 months.

7. Cookies

We use cookies that are strictly necessary for the site, your basket and the checkout to work. We do not use analytics or advertising cookies, so there is no consent banner to click through. You can control cookies through your browser settings. If we add analytics or advertising cookies later, we will add a consent banner and update this policy.

8. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Ask us to erase your data, where that applies
• Restrict or object to how we use it
• Receive your data in a portable format
• Withdraw consent at any time

To exercise any of these, email Hello@graftdesign.co.uk. We will respond within one month. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk.

9. Security

The site is served over HTTPS and access to order data is restricted. No system is completely secure, but we take reasonable steps to protect your information.

10. Children

This site is not intended for children under 16, and we do not knowingly collect their data.

11. Changes

We may update this policy. The date at the top shows when it last changed.