Privacy policy

1.Who we are

Scented Shea (“we”, “us”) sells naturally scented shea body butter direct to customers in the United Kingdom through scentedshea.com. We are the data controller for the personal data described here.

You can reach us about anything in this policy at contactus@scentedshea.com. Our registered business name and postal address are to be confirmed before this policy is published.

2.What we collect, and when

We only collect what an order or a message actually needs.

• When you place an order — your name, email address, delivery address, order contents and the amount paid. Card details are entered on Stripe’s payment pages and are never seen by or stored on our systems; we receive only a payment reference and the last four digits of the card.
• When you join our newsletter — your email address, and the fact that you signed up.
• When you send us an enquiry — your name, email address and whatever you write in the message.
• When you browse — aggregated, cookieless analytics about pages viewed (see section 5), and standard server logs held briefly by our hosting provider for security and reliability.

We do not knowingly collect data from children, we do not buy personal data from third parties, and we do not make automated decisions about you.

3.Why we are allowed to use it

• Performance of a contract — processing, packing, delivering and supporting your order, and sending the confirmation and dispatch emails that go with it.
• Legal obligation — keeping sales and tax records for the period UK law requires.
• Consent — sending you marketing emails, which you give when you subscribe and can withdraw at any time using the unsubscribe link or by emailing us.
• Legitimate interests — replying to enquiries, keeping the site secure and free of abuse, and understanding in aggregate which pages people find useful. We use privacy-preserving analytics precisely so this interest does not come at your expense.

4.Who else handles your data

We use a small number of service providers who process data on our instructions. Each is bound by a contract and may only use your data to provide the service to us.

• Stripe — payment processing and fraud prevention. Stripe is a controller in its own right for payment data; see its privacy policy at stripe.com/gb/privacy.
• Resend — sending transactional email such as order confirmations.
• Supabase — the database holding orders, enquiries and newsletter subscriptions.
• Vercel — hosting the website and its analytics.

Some of these providers operate outside the UK. Where data is transferred abroad it is protected by UK adequacy regulations or by standard contractual clauses with the UK addendum. We do not sell your data, and we do not share it for anyone else’s marketing.

5.Cookies, storage and analytics

We set no tracking or advertising cookies. There is no consent banner gating this site because there is nothing non-essential to consent to.

• Your bag is kept in your browser’s local storage so it survives a refresh. It stays on your device, is strictly necessary for the shop to work, and is never sent to us as a cookie.
• A small notice preference is stored the same way, so the cookie notice does not reappear once you have dismissed it.
• Analytics are provided by Vercel Analytics, which is cookieless: it counts page views and basic device and country information without cookies and without building a profile of you or tracking you across other sites.
• Checkout takes place on Stripe’s own pages, where Stripe sets cookies that are necessary for payment and fraud prevention. Those are governed by Stripe’s privacy policy.

You can clear local storage at any time in your browser settings. Doing so empties your bag and brings the notice back.

6.How long we keep it

• Order and transaction records — six years after the end of the relevant tax year, as UK tax law requires.
• Newsletter subscriptions — until you unsubscribe, and we remove inactive addresses periodically.
• Enquiries — up to two years after we have dealt with them, then deleted.
• Server and analytics data — short retention periods set by our hosting provider; it is aggregated, not personal, in the case of analytics.

7.Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• ask us to delete data we no longer need (this does not override our duty to keep sales records);
• ask us to restrict how we use your data, or object to use based on legitimate interests;
• receive certain data in a portable format;
• withdraw consent to marketing at any time, without affecting anything we sent before you did.

Email contactus@scentedshea.com and we will respond within one month. We will never charge you for making a request.

8.Complaints

If you think we have handled your data badly, please tell us first — we would rather fix it. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk/make-a-complaint or on 0303 123 1113.

9.Changes to this policy

If we change how we use personal data we will update this page and the date at the top. Material changes affecting you will be sent to subscribers by email.

See also our terms and conditions and shipping and returns.