Privacy Policy

1. Who we are and how to contact us

Sunny's Workshop is an independent UK business and is the data controller for the personal information described in this policy, except where another organisation acts as an independent controller for its own service.

2. Personal information we collect

Depending on how you use our website and services, we may collect:

• Identity information, such as your name, username and customer reference.
• Contact information, such as your email address, telephone number, billing address and delivery address.
• Account information, including password hashes, account status and login/session information.
• Order and transaction information, including products, prices, discounts, delivery details, payment status, refunds and order history.
• Repair information, including device details, reported faults, diagnostic notes, approval decisions, photographs, repair history, tracking and return information. Where reasonably necessary, this may temporarily include a device passcode or details for a dedicated test account.
• Returns information, including the reason for return, selected items, supporting photographs, sender address, tracking and outcome.
• Custom-order content, such as names, photographs, artwork, wording and instructions supplied for 3D printed or sublimation products.
• Communications, including contact-form messages, emails and customer-service records.
• Marketing information, including subscriber name and email, confirmation status, consent or sign-up date, unsubscribe status, campaign delivery status and suppression records.
• Technical information, such as IP address, browser/device information, server logs and security events.

Payment providers may collect payment-card, bank or digital-wallet information. We do not store full payment-card details on our own website.

3. Where we obtain personal information

Most information is provided directly by you when you register, place an order, submit a repair or return, subscribe to email updates, contact us or provide custom content.

We may also receive information from:

• Payment providers when they confirm a payment, refund or failed transaction.
• Royal Mail and other delivery providers in connection with labels, tracking and delivery events.
• Website hosting, security and email systems through technical logs and delivery reports.
• Marketplaces or sales channels where you buy from us through that service.

4. Why we use personal information and our lawful bases

The main ways we use information and the lawful bases we normally rely on are summarised below. More than one basis may apply where the purposes are genuinely different.

Information needed to process payment, deliver an order or carry out a repair is normally required so that we can enter into or perform the contract. If required information is not provided, we may be unable to accept or fulfil the order, deliver the goods, provide the repair or complete a return.

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that took place before consent was withdrawn.

5. Who we share information with

We share only the information reasonably required for the relevant purpose. Recipients may include:

• Stripe and any payment or digital-wallet provider made available through the checkout process.
• Royal Mail and other delivery or returns providers.
• Website hosting, database, backup, email and cybersecurity providers.
• Website-content providers, including Google where externally hosted font files are requested by a visitor's browser.
• Professional advisers, insurers, accountants and legal advisers where needed.
• Government bodies, regulators, law enforcement or courts where disclosure is legally required or necessary to protect legal rights.
• A buyer or successor if all or part of the business is reorganised, sold or transferred, subject to appropriate confidentiality and legal safeguards.

Some providers, such as payment companies and marketplaces, may act as independent data controllers and process information under their own privacy notices.

We do not sell, rent or trade personal information.

6. International transfers

Some providers used for payments, website content, hosting, email, security or support may process information outside the United Kingdom, including in the United States. Providers may include Stripe and Google where their relevant services are used.

Depending on the provider and destination, a transfer may rely on UK adequacy regulations, including the UK-US data bridge where the recipient is appropriately certified, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard. You may contact us for information about the safeguard relevant to a particular provider or to request a copy where available.

7. How long we retain information

We retain information only for as long as reasonably necessary for the purpose collected, including legal, accounting, warranty, security and dispute-resolution requirements. Our usual approach is:

• Orders, invoices, payments and refunds: normally up to six years after the end of the relevant accounting period, or longer where legally required.
• Customer accounts: while the account is active and afterwards where records remain necessary for orders, legal obligations or disputes.
• Repair and warranty records: for the warranty period and normally up to six years where needed to manage service history or legal claims.
• Device passcodes and test-account details: only while reasonably required to diagnose and test the device. They are not retained as part of the ordinary six-year repair history and are deleted or securely destroyed after testing and return arrangements are complete.
• Custom photographs, artwork and production files: while needed to produce and check the order and normally for no more than 90 days after completion, unless a longer period is requested by the customer or required for a complaint, reprint, legal claim or other lawful reason.
• Repair photographs: while the repair is active and normally up to 12 months after closure, unless needed for a warranty issue, complaint, insurance matter or legal claim.
• Return requests and supporting evidence: while the case is active and normally up to 12 months after closure, unless required for a dispute, chargeback, fraud review or legal claim.
• General enquiries: normally up to two years after the last meaningful contact, unless linked to a transaction or dispute.
• Active marketing subscribers: until they unsubscribe or the record is no longer needed.
• Unsubscribed addresses: limited information may be kept on a suppression list for as long as necessary to ensure that the person is not contacted again.
• Pending newsletter confirmations: removed or anonymised when no longer reasonably required.
• Technical and security logs: retained for a limited period appropriate to security, troubleshooting and fraud prevention.

We may retain information longer where there is an active complaint, dispute, legal claim, regulatory requirement or law-enforcement request.

8. How we protect information

We use reasonable technical and organisational safeguards, including encrypted website connections, password hashing, access controls, restricted administrative permissions, private storage for supporting return files, security logging and reputable payment providers.

Where a device passcode is needed, we ask customers to use a temporary code or dedicated test account where practical. Access is limited to what is reasonably necessary for diagnosis and testing, and customers should change any temporary credential after the device is returned.

No internet or storage system is completely secure. If a personal-data breach creates a legal reporting or notification duty, we will take the steps required by applicable law.

9. Your data protection rights

Depending on the circumstances and lawful basis, you may have the right to:

• Request access to your personal information.
• Ask us to correct inaccurate or incomplete information.
• Ask us to erase information where the right applies.
• Ask us to restrict processing.
• Receive certain information in a portable format.
• Withdraw consent at any time where processing is based on consent.
• Complain to the Information Commissioner's Office.

To exercise a right, contact support@sunnysworkshop.co.uk. We may need to verify your identity. Rights are not absolute, and we will explain if an exemption or limitation applies. We normally respond without undue delay and within one month, although the law allows an extension for particularly complex or numerous requests.

10. Cookies, sessions and local storage

Our website uses first-party cookies and browser storage for functions such as customer and admin sessions, security, cart contents, sidebar preferences and dark/light mode. Session and authentication information normally expires when the session ends, the user signs out or the configured security period expires. Cart information may remain until checkout, removal by the user or the configured cart expiry. Appearance and sidebar preferences may remain until the user clears browser storage or changes the preference.

These technologies are used only for the purpose described. Where we use analytics, advertising or another technology that is not covered by a legal exception, we request consent before it is stored or accessed. Where an exception permits use without consent, we provide the required information and any required means of objection. Refusing or clearing essential storage may prevent sessions, accounts, carts or preferences from operating correctly.

Third-party content may also receive technical information needed to supply that content. For example, the current page requests the Outfit font from Google, which receives information such as the requesting IP address and browser information. We do not use that request to obtain payment-card information.

11. Email marketing and newsletter subscriptions

Marketing communications are separate from service messages about orders, accounts, payments, repairs, returns and security.

• Newsletter sign-ups require confirmation before becoming active.
• Registration or checkout marketing choices are optional and are not pre-selected.
• Campaign records may show whether an email is pending, sent, failed or suppressed.
• Every marketing email includes an unsubscribe route.
• When you unsubscribe, we stop future marketing and may retain limited suppression information to respect that choice.

12. Children's information

Orders and repair contracts must be placed by an adult aged 18 or over. Our website and account services are not directed at children under 13, and we do not knowingly invite children to create accounts or place orders.

An adult may provide a child's name, photograph or other content for a personalised product. We use that content only for the order and related support, retain it as described in section 7 and do not use it for unrelated marketing without an appropriate permission. If you believe a child has provided personal information without appropriate authority, contact us so that we can investigate and take suitable action.

13. Automated decision-making

We do not currently use personal information to make decisions that produce legal or similarly significant effects solely by automated means. We may use automated checks to support fraud prevention, security and email delivery, but significant decisions are reviewed where appropriate.

14. Questions and complaints

Please contact us first if you have a privacy concern so that we can try to resolve it.

• Email: support@sunnysworkshop.co.uk
• Contact form: sunnysworkshop.co.uk/contact

You may also complain to the Information Commissioner's Office at ico.org.uk.

15. Changes to this policy

We may update this policy when our services, suppliers, systems or legal obligations change. The latest version will be published here with a revised effective date.