Privacy Policy

Version 2.3 — Last updated: 21 September 2026

Who we are

The Little Stationery Shop is an independent stationery business based in the United Kingdom.

For the purposes of UK data-protection law, The Little Stationery Shop is the data controller responsible for the personal information described in this policy.

Contact details:

The Little Stationery Shop
33 Curzon Road
Ashton-under-Lyne
Greater Manchester
OL6 6PS
United Kingdom

Email: flic@thelittlestationeryshop.co.uk

This Privacy Policy explains how and why personal information is collected, stored, used and shared when you:

  • visit https://thelittlestationeryshop.co.uk;
  • place an order or create an account;
  • subscribe to the mailing list;
  • contact us for help or support;
  • communicate through WhatsApp;
  • interact with The Little Stationery Shop on Facebook, Instagram, TikTok, Etsy or another platform; or
  • use another service that links to this Privacy Policy.

1. Information we collect

Information you provide

We may collect information that you voluntarily provide when you:

  • place an order;
  • create or use an account;
  • subscribe to the mailing list;
  • enter a promotion;
  • submit a review;
  • contact us with a question or request;
  • request a return, refund or exchange; or
  • communicate through social media or WhatsApp.

This information may include:

  • your name;
  • email address;
  • telephone number;
  • billing address;
  • delivery address;
  • account username and login information;
  • order details;
  • product choices and personalisation details;
  • correspondence and customer-service messages;
  • return and refund information;
  • social-media username; and
  • any other information you choose to provide.

Please do not send sensitive personal information unless it is necessary for us to deal with your request.

Payment information

Payments made through the website are processed securely using WooPayments and its supporting payment infrastructure.

WooPayments is provided by Automattic and works in partnership with Stripe. Payment details are securely tokenised and complete card information is not stored on The Little Stationery Shop website.

Payment providers may process information including:

  • your name;
  • billing address;
  • payment-card details;
  • transaction value;
  • transaction identifiers;
  • device and fraud-prevention information; and
  • information needed to authenticate or process the payment.

The payment provider processes this information under its own terms and privacy information.

Further information is available from:

Information collected automatically

When you visit the website, certain technical information may be collected automatically, including:

  • IP address;
  • browser type and version;
  • device type;
  • operating system;
  • pages viewed;
  • referring website;
  • approximate location derived from an IP address;
  • dates and times of visits;
  • actions taken on the website; and
  • cookie or similar technology identifiers.

Some information is necessary for security and the operation of the website. Optional analytics information is collected only in accordance with your cookie choices.

More information is available in the Cookie Policy.

2. How we use personal information

Personal information may be used to:

  • process, prepare and deliver orders;
  • take payments and manage refunds;
  • provide order confirmations and dispatch updates;
  • create and manage customer accounts;
  • respond to questions, complaints and support requests;
  • process cancellations, returns and exchanges;
  • prevent fraud and protect the website;
  • maintain business and financial records;
  • improve the website, products and customer experience;
  • send marketing where permission has been given;
  • request customer feedback where you have opted in;
  • manage social-media interactions;
  • establish, exercise or defend legal claims; and
  • comply with legal and regulatory obligations.

We will not sell your personal information.

3. Lawful bases for processing

UK data-protection law requires a lawful basis for processing personal information.

Depending on the circumstances, we rely on the following bases:

Contract

We process information when it is necessary to:

  • accept and fulfil an order;
  • take payment;
  • deliver products;
  • provide order updates;
  • manage returns, refunds and exchanges; or
  • respond to a request made before you place an order.

Legal obligation

We process and retain certain information where necessary to comply with legal duties, including:

  • tax and accounting requirements;
  • consumer-protection obligations;
  • fraud-prevention requirements; and
  • responding to lawful requests from public authorities.

Legitimate interests

We may process information where it is reasonably necessary for the legitimate interests of operating and protecting the business, provided those interests are not overridden by your rights.

This may include:

  • responding to customer enquiries;
  • maintaining website and account security;
  • preventing fraud and misuse;
  • improving the website and services;
  • maintaining appropriate business records;
  • handling complaints and legal claims; and
  • understanding the general performance of the business.

Consent

We rely on consent where you:

  • subscribe to marketing emails;
  • accept optional analytics or advertising cookies;
  • opt in to a Google Customer Reviews survey; or
  • give permission for content to be used in a way that requires your consent.

You may withdraw consent at any time. Withdrawing consent does not affect processing that took place before it was withdrawn.

4. Order and transactional emails

WooCommerce generates essential emails connected with purchases and customer accounts, including:

  • order confirmations;
  • payment and refund notifications;
  • dispatch updates;
  • account messages; and
  • password-reset emails.

The appearance of these emails may be customised using YayMail.

These messages are necessary to administer your order or account and are not marketing emails. They will still be sent where required even if you have unsubscribed from marketing.

5. Email marketing

MailPoet is used to manage the mailing list and send newsletters, new-product information, offers and other marketing messages.

If you subscribe, MailPoet may process:

  • your name;
  • email address;
  • subscription status;
  • signup source;
  • consent record;
  • email delivery information; and
  • information about email opens or link clicks, where tracking is enabled.

Marketing is optional and is not required to complete a purchase.

You can unsubscribe at any time by:

We may retain limited information on a suppression list after you unsubscribe so that your marketing preference can be respected.

6. Cookies and analytics

The website uses cookies and similar technologies.

Some cookies are essential for:

  • the basket and checkout;
  • account login;
  • security;
  • payment processing; and
  • remembering privacy choices.

Optional cookies are used only in accordance with the choices made through the cookie banner.

Full details about the cookies used and how to change your preferences are available in the Cookie Policy.

Google Analytics 4

Google Analytics 4 may be used to understand how visitors use the website.

Where you consent to analytics cookies, Google may collect information including:

  • pages visited;
  • approximate location;
  • device and browser information;
  • referral source;
  • interactions with the website; and
  • session information.

This information is used to understand website performance and improve the customer experience. Analytics data may be aggregated or pseudonymised, but should not be treated as completely anonymous in every circumstance.

You can withdraw analytics consent through the website’s cookie settings.

7. Google Customer Reviews

Google Customer Reviews is used to collect optional feedback about shopping experiences.

After completing an order, you may be invited to opt in to receive a one-time survey from Google. Participation is optional.

If you opt in, limited information may be shared with Google for the purpose of sending the survey, including:

  • your order ID;
  • email address;
  • delivery country; and
  • estimated delivery date.

Google processes this information in accordance with its own privacy policy.

More information is available in the Google Privacy Policy.

8. Social media and user-generated content

If you contact or interact with The Little Stationery Shop through Facebook, Instagram, TikTok, Etsy or another platform, the relevant platform may also process your information under its own privacy policy.

Information received may include:

  • your profile name;
  • social-media username;
  • public profile information;
  • messages;
  • comments;
  • order information provided through a marketplace; and
  • photos or other content you share.

If you publicly tag The Little Stationery Shop or share a photograph of an order, we may ask for permission to reshare it.

Personal or identifying information—such as addresses, order paperwork or full names—will not knowingly be reshared publicly. Identifying details shown in a photograph will be obscured or omitted where necessary.

9. WhatsApp communication

If you contact us using WhatsApp, your telephone number, profile information and messages will be processed through WhatsApp, which is operated by Meta Platforms.

Messages may remain available within the business WhatsApp account for as long as reasonably necessary to respond to your enquiry and maintain an appropriate record.

Please do not send payment-card information, passwords or other sensitive information through WhatsApp.

WhatsApp and Meta process information in accordance with their own privacy policies.

10. Who we share information with

Personal information is shared only where reasonably necessary to operate the business, fulfil orders, comply with the law or provide a service you have requested.

Recipients may include:

  • WooCommerce and Automattic, for website, store and payment functionality;
  • WooPayments and Stripe, for payment processing, authentication and fraud prevention;
  • Hostinger, for website hosting and related technical services;
  • MailPoet and relevant email-delivery services, for mailing-list and email management;
  • Royal Mail or another delivery provider, for dispatching orders;
  • Google, where analytics cookies are accepted or you opt in to Google Customer Reviews;
  • Meta and WhatsApp, when you communicate through those services;
  • Etsy or another marketplace, when you purchase or communicate through that platform;
  • professional advisers, such as an accountant, legal adviser or insurer;
  • fraud-prevention and website-security providers; and
  • government, regulatory, law-enforcement or tax authorities where legally required.

Some providers act as processors on our behalf. Others, such as payment providers, delivery companies, marketplaces and social-media platforms, may act as independent data controllers for the information they process through their own services.

11. International data transfers

Some service providers may process or store information outside the United Kingdom.

Where personal information is transferred internationally, we take reasonable steps to ensure that an appropriate legal safeguard is used. Depending on the destination and provider, this may include:

  • UK adequacy regulations;
  • the UK International Data Transfer Agreement;
  • the UK Addendum to approved standard contractual clauses; or
  • another safeguard permitted by UK data-protection law.

Further information about a particular provider’s international transfers can be found in that provider’s privacy policy.

12. How long information is kept

Personal information is kept only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting and tax requirements.

Typical retention periods include:

  • Order, payment, invoice and refund records: generally up to six years after the relevant accounting period, where needed for tax, accounting, consumer or legal purposes.
  • Customer accounts: while the account remains active or until deletion is requested, subject to information that must be retained for legal purposes.
  • Customer-service correspondence: normally for up to two years after the enquiry is resolved, unless a longer period is reasonably required.
  • Return, complaint or legal-claim records: for as long as reasonably necessary to resolve the matter and meet applicable legal time limits.
  • Marketing information: until you unsubscribe or consent is otherwise withdrawn, with limited suppression information retained where necessary to respect your preference.
  • Analytics information: according to the retention period configured within the relevant analytics service.
  • Cookie information: for the periods described in the Cookie Policy.

Information may be securely deleted or anonymised when it is no longer needed.

13. How we protect information

Reasonable technical and organisational measures are used to protect personal information against:

  • unauthorised access;
  • accidental loss;
  • misuse;
  • alteration;
  • disclosure; and
  • destruction.

These measures may include secure website connections, access controls, software updates, security monitoring, backups and the use of reputable service providers.

No internet or storage system can be guaranteed to be completely secure. If you believe your information or account has been compromised, contact us as soon as possible.

14. Data breaches

If a personal-data breach occurs, we will investigate it and take appropriate action.

Where required by law, the breach will be reported to the Information Commissioner’s Office and affected individuals will be informed.

15. Children’s privacy

The website is intended for adults purchasing stationery products.

We do not knowingly collect personal information directly from children where parental or guardian involvement would be required. Orders must be placed by someone aged 18 or over.

If you believe that a child has provided personal information without appropriate permission, contact us so that the matter can be investigated and the information deleted where appropriate.

16. Your data-protection rights

Depending on the circumstances, you may have the right to:

  • request access to the personal information held about you;
  • ask for inaccurate or incomplete information to be corrected;
  • ask for personal information to be deleted;
  • ask for processing to be restricted;
  • object to processing based on legitimate interests;
  • withdraw consent;
  • request the transfer of information you provided in a portable format;
  • object to direct marketing; and
  • complain to the Information Commissioner’s Office.

These rights are not absolute and may be limited where information must be retained or processed for a lawful reason.

To exercise a right, email flic@thelittlestationeryshop.co.uk. We may need to request information to verify your identity before responding.

There is normally no fee for exercising a data-protection right. We aim to respond within one month, although the law allows additional time in certain circumstances.

17. Complaints

If you have concerns about how your personal information has been handled, please contact us first so that we can try to resolve the issue.

You also have the right to complain to the UK supervisory authority:

Information Commissioner’s Office
https://ico.org.uk/make-a-complaint/

You may contact the ICO without contacting us first.

18. Automated decision-making

The Little Stationery Shop does not use personal information to make solely automated decisions that produce legal or similarly significant effects.

Payment providers and fraud-prevention services may use automated systems to assess transactions. Further information can be found in the relevant provider’s privacy information.

19. Changes to this Privacy Policy

This policy may be updated when business practices, website services or legal requirements change.

The current version number and last-updated date will be shown at the top of the policy.

Significant changes will be highlighted on the website or communicated directly where appropriate.

20. Contact details

For questions, requests or concerns about personal information, contact:

The Little Stationery Shop
33 Curzon Road
Ashton-under-Lyne
Greater Manchester
OL6 6PS
United Kingdom

Email: flic@thelittlestationeryshop.co.uk

Change log

  • 21 September 2026 — Version 2.3: Updated the business and data-protection contact address; replaced the standalone Stripe payment wording with details of WooPayments, Automattic and its Stripe-supported payment infrastructure; added lawful bases for processing, clearer retention periods, UK data-protection rights and ICO complaint information; clarified analytics, MailPoet tracking, WhatsApp, social media, third-party providers and international data transfers; and improved the overall structure and wording.
  • 14 January 2026 — Version 2.2: Added Google Customer Reviews participation, data-sharing clarification, opt-in survey details and third-party data-controller information.
  • 05 December 2025 — Version 2.1: Added MailPoet email analytics, Google Analytics 4 clarification, WhatsApp communication, cookie-preference management and improved formatting.
  • 02 August 2025 — Version 2.0: Entire policy redrafted to cover the principal areas required at the time.
  • 02 August 2025 — Version 1.1: Updated the contact email address and formatting.