Privacy policy
Last updated: 30 July 2026
This notice explains what personal information Ivy Leighton collects when you visit www.ivyleighton.com, place an order, or contact us, and what we do with it. "You" means anyone using the website, whether you buy something or not.
Who is responsible
Ivy Leighton is the controller for the personal data described here. Our contact details are at the bottom of this page.
Which law applies
We process personal data in line with the UK GDPR and the Data Protection Act 2018 for our UK customers. Because the business is established in Germany, the EU GDPR applies to our processing as well. Where the two overlap, we apply the standard that gives you the stronger protection.
Updates to this notice
We revise this notice when our operations or legal obligations change. The current version is always on this page, with the date of the last revision at the top.
What we collect from you
When you order or get in touch, you give us your name, delivery and billing address, email address and phone number, the details of what you ordered, and the content of any message you send our support team. If you create an account, we also store your login details. Some of this is unavoidable: we cannot ship a parcel without an address.
What we collect automatically
While you browse, cookies and comparable technologies record technical and usage data: your IP address, browser and device type, the pages you open, and how you move through the site. This is how we tell a working checkout from a broken one.
What we receive from others
We also receive personal data from service providers we rely on, including Shopify as our platform provider, our payment providers, and our advertising and analytics partners such as Google. Data from those sources is handled under this notice.
Why we process your data
We use personal data to process and fulfil your order, to answer your support requests, to run and improve the website, to send service messages about an order you have placed, and to detect and prevent fraud and misuse. Depending on the purpose, our legal basis is performance of the contract with you, compliance with a legal obligation, our legitimate interests, or your consent. Marketing email goes out only where you have consented or where the law otherwise permits it, and every marketing message contains an unsubscribe link.
Cookies
Cookies keep the basket working, remember your session, measure how the site performs, and support our advertising measurement. Details of the cookies Shopify sets are published at https://www.shopify.com/legal/cookies. You can restrict or delete cookies in your browser settings; some parts of the checkout will stop working if you block them entirely.
Who we share data with
We pass personal data to third parties only where it is needed to run the shop: our platform and hosting provider, payment providers, the carriers that deliver your parcel, our fulfilment partners, IT service providers, and our analytics and advertising partners. We also disclose data to public authorities where the law requires it. We do not sell personal data.
International transfers
Some of our providers process data outside the United Kingdom and the European Economic Area. Where that happens, the transfer is covered by an adequacy decision or by standard contractual clauses together with the additional safeguards those clauses require.
How long we keep it
Order data is retained for as long as commercial and tax law requires us to keep it. Support correspondence and account data are kept while your account is active and for a reasonable period afterwards. Data we no longer need for a legal or operational purpose is deleted.
Security
We apply technical and organisational measures appropriate to the risk. Payment card details are entered and processed directly by our payment providers on encrypted connections; we never see or store your full card number.
External websites
Our site links to third-party websites. Their data practices are their own and this notice does not cover them.
Children
Our services are not aimed at anyone under 16, and we do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.
Your rights
You can ask us for a copy of the personal data we hold about you, have inaccurate data corrected, have data deleted, have processing restricted, object to processing based on legitimate interests, receive your data in a portable format, and withdraw a consent you previously gave. Withdrawing consent does not affect processing that already took place. Write to the email address below and we will respond within the statutory period.
Complaints
If you are unhappy with how we handle your data, please raise it with us first so we can look into it. You also have the right to complain to a supervisory authority: in the United Kingdom that is the Information Commissioner's Office (ico.org.uk), and in Germany it is the data protection authority responsible for our place of business.
Customer Support
Store Name: Ivy Leighton
Business Address: Am Deckelsbach 1b, 79215 Elzach, Germany
Warehouse Address: 196 Park Rd N, Birkenhead CH41 8AD, United Kingdom
Email: info@ivyleighton.com
Tel.: [TELEFONNUMMER EINSETZEN]
Contact Form: Contact
Customer service hours: Monday to Friday: 8:00 AM – 6:00 PM (GMT)
We aim to respond within 24 hours (Monday–Friday).