Privacy policy

Last updated: June 29, 2026

This Privacy Policy explains how OneShed collects, uses and protects personal information when you use our online store. We use Shopify and selected third‑party service providers to run the store, process orders, take payments, arrange delivery, provide customer support, and keep the website secure.

In practice, we mainly see and use the customer details needed to manage orders and customer enquiries, such as your name, contact details, delivery address, order details, and messages you send to us. Payments, website hosting, security, analytics, cookies and other technical services are handled by Shopify and/or other trusted service providers.

Nothing in this policy affects your rights under UK data protection law.

1. Personal Information We Collect or Process

When we use the term “personal information”, we mean information that identifies you or can reasonably be linked to you.

The information we directly handle as a store owner is mainly what we need to take, fulfil, deliver, refund, support and keep records of customer orders. Depending on how you use the store, this may include:

  • Contact details – such as your name, billing address, shipping address, phone number and email address.

  • Payment and transaction information – such as payment confirmation, payment method type, transaction status, order value, refunds and related payment details. Full card details are handled by Shopify and payment providers and are not stored by us directly.

  • Account information – if you choose to create an account, such as login details, order history, preferences and settings.

  • Transaction information – including the items you view, put in your cart, add to your wishlist, or purchase, return, exchange or cancel, and your past transactions.

  • Communications with us – including the information you include in communications with us, for example when sending a customer support enquiry.

  • Technical information – such as device type, browser, IP address, cookie identifiers and usage information. This is generally collected and processed by Shopify and other technical service providers that help operate and secure the store.

We do not intentionally collect more data than we reasonably need to operate the store and fulfil orders.

2. Personal Information Sources

We collect personal information from:

  • You directly – for example when you place an order, contact us, create an account, request a return, or sign up to receive updates or marketing from us.

  • Shopify and technical services – which may collect website, cookie, device, security, analytics and payment‑related information when you use the store.

  • Service providers that help us operate the store – such as payment providers, delivery companies, fulfilment partners, email providers, fraud‑prevention tools, analytics providers and customer support tools.

3. How We Use Your Personal Information

We use personal information for the purposes below. We’ve included the usual UK GDPR lawful basis for each purpose for clarity.

Orders and customer service

We use your information to process orders, take payment, arrange delivery, provide order updates, manage returns and refunds, respond to enquiries and deal with customer support.

  • Legal basis: performance of a contract with you; in some cases, our legitimate interests in running the business and providing customer service.

Marketing

If you sign up to receive marketing from us, we may use your email address to send store news, offers and product updates. You can unsubscribe at any time using the link in our emails or by contacting us.

  • Legal basis: your consent, or where permitted by law, our legitimate interest in promoting our store to existing customers.

We do not send marketing emails without a lawful basis and will always respect your marketing preferences.

Security and fraud prevention

Shopify, payment providers and other technical services may use information to help keep the store secure, detect fraud, verify transactions and protect customers and our business.

  • Legal basis: our legitimate interests in operating a safe online store and protecting against misuse and fraud, and where applicable, compliance with legal obligations.

Business records

We keep order, payment, refund, tax and accounting records where needed to run the business and comply with legal obligations.

  • Legal basis: legal obligation (for example UK tax and accounting requirements) and, where relevant, our legitimate interest in keeping accurate business records.

Legal reasons

We may use personal information where necessary to comply with law, respond to lawful requests, enforce our terms, resolve disputes or protect our rights.

  • Legal basis: legal obligation or legitimate interest, depending on the circumstances.

We do not use your personal information for automated decision‑making in a way that produces legal or similarly significant effects without informing you and having a lawful basis.

4. How We Disclose Personal Information

We do not sell customer information.

We only share personal information where needed to run the store, fulfil orders, meet legal obligations, or use trusted services that support the business. This may include:

  • Shopify and technical service providers – including payment processors, IT, hosting, analytics, email, customer support, fulfilment and shipping providers that help us operate the store and deliver orders.

  • Marketing or email service providers – if we use them to send communications that you have requested or that we are otherwise permitted to send.

  • Delivery, courier, fulfilment or returns providers – so that your order can be delivered, returned, exchanged or refunded.

  • Professional advisers, authorities or other parties – where needed for accounting, tax, legal compliance, fraud prevention, dispute resolution or protection of our business.

We require service providers to handle your personal information securely and only for the purposes we specify.

5. Relationship with Shopify

Our store is powered by Shopify. Shopify provides the ecommerce platform, hosting, checkout, payment‑related tools, security and related services that allow us to operate the store.

Information you submit through the store may be processed by Shopify and by third‑party providers used by Shopify or by us to provide these services. Shopify may also process certain information for its own purposes, such as security, fraud prevention, service improvement and features offered through the Shopify platform.

You can read Shopify’s own privacy information via Shopify’s privacy links (for example, in Shopify’s global Privacy Policy and GDPR guidance).

6. Third‑Party Websites and Links

Our website and online services (“Services”) may provide links to websites or other online platforms operated by third parties.

If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We are not responsible for the privacy or security practices of such sites, including the accuracy, completeness or reliability of information found on them.

Information you provide on public or semi‑public venues, including information you share on third‑party social networking platforms, may be viewable by other users of the Services and/or users of those third‑party platforms. Our inclusion of such links does not by itself imply endorsement of the content on those platforms or of their owners or operators.

7. Children’s Data

Our store is not intended for children, and we do not knowingly collect personal information from children.

If you believe a child has provided personal information to us, please contact us so we can review and, where appropriate, delete it in accordance with applicable law.

8. Security and Retention of Your Information

We take reasonable steps to protect personal information, including using Shopify’s secure platform, SSL encryption on our store and limiting access to customer data to authorised personnel.

However, no security measures are perfect or impenetrable, and we cannot guarantee “perfect security”. Information you send to us may not be secure while in transit, depending on the channel you use. We recommend that you do not use unsecure channels to communicate sensitive or confidential information to us.

We keep personal information only for as long as reasonably needed for the purposes described in this policy. For example, we may keep order and transaction records for as long as required for tax, accounting, legal, refund, dispute and fraud‑prevention purposes. When information is no longer needed, we will delete it or anonymise it where appropriate.

9. Your Rights and Choices

Under UK data protection law (and, where applicable, similar laws in other countries), you may have some or all of the rights listed below in relation to your personal information. These rights are not absolute, may apply only in certain circumstances, and in some cases we may decline your request as permitted by law.

  • Right to Access / Know – to request access to personal information that we hold about you.

  • Right to Delete – to request that we delete personal information we maintain about you, subject to legal and business‑record requirements.

  • Right to Correct – to request that we correct inaccurate personal information we maintain about you.

  • Right of Portability – to receive a copy of certain personal information and request that we transfer it to a third party, in certain circumstances.

  • Managing communication preferences – you can opt out of promotional emails at any time by using the unsubscribe option in our emails. If you opt out, we may still send non‑promotional emails such as those about your account or orders.

If you reside in the UK or European Economic Area, and subject to exceptions and limitations provided by local law, you may also have:

  • Right to object to processing and right to restrict processing – to ask us to stop or restrict our processing of personal information for certain purposes.

  • Right to withdraw consent – where we rely on consent to process your personal information, you have the right to withdraw this consent. If you withdraw consent, this does not affect the lawfulness of processing based on consent before withdrawal.

You may exercise your rights by contacting us using the details in the Contact section below. Some rights may be limited where we need to keep information for legal, tax, accounting, fraud‑prevention, order fulfilment or dispute‑resolution reasons.

Shopify may also handle certain privacy requests relating to information it processes through the Shopify platform, and may direct you to its own channels where appropriate.

We will not discriminate against you for exercising your rights. We may need to verify your identity before we can process requests, as permitted or required under applicable law. In accordance with applicable laws, you may designate an authorised agent to make requests on your behalf; before accepting such a request, we may require proof of your authorisation and may ask you to verify your identity directly with us.

We will respond to your request within the timeframes required by law.

10. Complaints

If you have concerns about how we handle your personal information, please contact us first so we can try to resolve the issue.

If you are in the UK, you also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator. Details are available on the ICO website.

11. International Transfers

Because we use Shopify and other service providers, your personal information may be processed or stored outside the UK.

Where this happens and the law requires it, we rely on appropriate safeguards or recognised transfer mechanisms (for example, standard contractual clauses or equivalent measures adopted by Shopify and other providers) to protect your information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal or regulatory reasons. We will post the revised Privacy Policy on this website, update the “Last updated” date, and provide any additional notice required by law.

13. Contact

If you have any questions about this Privacy Policy or would like to exercise your data protection rights, please contact us by email at: office@oneshed.co.uk.

For the purpose of applicable data protection laws, OneShed is the data controller of the personal information we directly collect and use to manage orders and customer enquiries.