Obsidian Flame Studios LTD (“Obsidian & Flame”, “we”, “us”) is committed to protecting your privacy. This policy explains what personal data we collect when you visit obsidianandflame.com or buy from us, how we use it, and the rights you have over it.

Who we are

Obsidian Flame Studios LTD is the data controller responsible for your personal data. We are a company registered in England and Wales.

• Contact: contact@obsidianflamestudios.com
• Registered address: [ADD YOUR REGISTERED ADDRESS]
• Company number: [ADD YOUR COMPANY NUMBER]

Information we collect

Information you give us. When you place an order, subscribe to our newsletter, or contact us by email, you may give us your name, email address, delivery and billing address, and phone number. Payment card details are entered directly into our payment provider’s secure checkout and are never seen or stored by us.

Information collected automatically. When you browse the site we may collect your IP address, browser type and version, device and operating system, and information about your visit such as the pages you viewed and how long you stayed. This is used to keep the site secure and working properly.

Information from others. We receive order and customer information from our shop platform when you complete a purchase, and subscription information from our email provider when you sign up to the newsletter.

Cookies

We use only essential cookies: those needed to remember the contents of your basket during checkout, and those set by our hosting provider to keep the site secure. We do not use advertising or cross-site tracking cookies. You can block or delete cookies in your browser settings, though parts of the checkout may then stop working.

How and why we use your data

Under UK GDPR we must have a lawful basis for using your personal data. Ours are:

• To fulfil your order — taking payment, arranging delivery, sending order confirmations and handling returns. Lawful basis: performance of a contract with you.
• To respond to enquiries you send us about a piece or an order. Lawful basis: legitimate interests (answering our customers).
• To send you our newsletter, where you have asked to receive it. Lawful basis: consent, which you may withdraw at any time.
• To keep the site secure and improve it, including troubleshooting and understanding which pieces visitors look at. Lawful basis: legitimate interests (running a safe, working shop).
• To meet our legal obligations, such as keeping records required by tax and accounting law. Lawful basis: legal obligation.

Marketing

We only send marketing emails to people who have asked for them, or to existing customers about pieces similar to those they have already bought. Every email includes an unsubscribe link, and you can opt out at any time by using that link or emailing us. We never sell or rent your details to other companies for their own marketing.

Who we share your data with

We share personal data only with the service providers that make the shop work, and only as far as they need it:

• Shopify — our shop and checkout platform, which processes orders and payments.
• Brevo — our email provider, which stores newsletter subscriptions and sends our emails.
• Cloudflare — our website host and security provider.
• Delivery and postal partners — to get your order to you.
• Our accountants and professional advisers, where required.

We may also disclose personal data if we are legally required to, or to protect our rights, property or safety. If our business or its assets were ever sold, customer data could transfer to the buyer.

International transfers

Some of our providers store or process data outside the UK. Where that happens, we rely on safeguards recognised under UK data protection law, such as UK adequacy regulations or the International Data Transfer Agreement, so your data keeps an equivalent level of protection.

How long we keep it

We keep order records for as long as we are legally required to for tax and accounting purposes — currently six years from the end of the relevant financial year. Newsletter subscriptions are kept until you unsubscribe. Enquiry emails are kept only as long as needed to deal with the matter.

Security

Payments are encrypted and handled by our payment provider, and the site is served over a secure connection. We take reasonable steps to protect your data, but no transmission over the internet can be guaranteed completely secure, so any transmission is at your own risk.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• ask us to delete your data, where there is no good reason for us to keep it;
• object to, or ask us to restrict, how we use your data;
• ask us to transfer your data to another provider;
• withdraw your consent to marketing at any time.

Exercising these rights is free, and we will respond within one month. To make a request, email contact@obsidianflamestudios.com.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

Other websites

Our site links to other websites, including our Instagram page and our checkout. Those sites have their own privacy policies, and we are not responsible for them. Please check their policies before giving them your details.

Changes to this policy

Any changes we make will be posted on this page with a new “last updated” date. Please check back from time to time.

Contact

Questions or requests about this policy are welcome — email contact@obsidianflamestudios.com.