Privacy policy

 

Last updated: November 2026

This policy explains what we do with your personal data when you visit graft-co.com or place an order with us. We are Graft & Co, and we are the data controller for the information described here. If you want anything on this page explained, email hello@graft-co.com and a person will answer you.

What we collect

When you place an order: your name, delivery and billing address, email address, phone number if you give us one, the items you bought and the amount you paid.

When you contact us: your email address and whatever you put in your message, including any photographs you send us for a guarantee or fault claim.

When you sign up to emails: your email address and, if you give it, your first name.

When you browse the site: your IP address, device and browser type, the pages you looked at, and how you arrived at the site. This comes in through cookies and similar technologies.

We never see or store your full card number. Card details go directly to our payment provider.

What we use it for, and on what basis

• Fulfilling your order, including passing your name and address to the carrier and to our fulfilment partner, confirming your order and dealing with returns, refunds and guarantee claims. Basis: performance of our contract with you.
• Customer service, answering your emails and keeping a record of the case. Basis: performance of our contract, and our legitimate interest in keeping a record of what was agreed.
• Marketing emails, where you have asked for them. Basis: your consent. Every email has an unsubscribe link, and unsubscribing takes effect immediately.
• Running and improving the site, including measuring which pages and adverts work. Basis: your consent for non-essential cookies, and our legitimate interest in a site that functions.
• Fraud prevention and accounting, including the records we are required to keep. Basis: our legal obligations and our legitimate interest in preventing fraud.

Who we share it with

We do not sell your personal data. We share it only with the companies that make the shop work:

• Shopify, which hosts the store and processes your order.
• Our payment providers, which take the payment and run their own fraud checks.
• Our fulfilment partner and the carriers, including Royal Mail, so your parcel can be packed and delivered.
• [Email marketing platform], if you have subscribed to our emails.
• [Analytics and advertising providers, for example Meta and Google], where you have accepted the relevant cookies.

We may also share data where we are legally required to, or to establish or defend a legal claim, for example in a payment dispute.

Transfers outside the UK

Some of the companies above are based outside the United Kingdom, and your order is dispatched from outside the UK, so your delivery details are transferred there in order to fulfil it. Where data leaves the UK, we rely on the safeguards permitted under UK data protection law, such as an adequacy decision for the country concerned or the International Data Transfer Agreement.

How long we keep it

Order and transaction records are kept for six years, because tax and accounting rules require it. Customer service correspondence is kept for up to three years, so we can honour the 365-shift guarantee and deal with any later dispute. Marketing data is kept until you unsubscribe, and then only the record needed to make sure we do not email you again. Analytics data is kept for the retention period set by the provider.

Cookies

Essential cookies keep your basket and your session working, and cannot be switched off. Analytics and advertising cookies are only set if you accept them, and you can change your mind at any time through the cookie settings on the site or by clearing cookies in your browser. Blocking non-essential cookies does not stop you ordering.

Your rights

Under the UK GDPR you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• ask us to delete data we no longer need;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• ask us to restrict processing, or to transfer your data to another provider;
• withdraw consent where we rely on it.

Email hello@graft-co.com to exercise any of these. We answer within one month. If you are not happy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live.

Children

The shop is not intended for under-18s, and we do not knowingly collect data about children. If you believe a child has given us their data, email us and we will delete it.

Changes to this policy

We may update this policy. The date at the top tells you when it last changed, and the version on this page is the one that applies.

Contact

[Registered company name]
[Registered address]
Email: hello@graft-co.com