Privacy Policy

SISTROS. Crafted Luxury ('we', 'our', 'us') is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit our website (sistros.co.uk), place orders, or interact with our services. By using our website, you consent to the practices described in this policy. We operate in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

We collect information that you provide directly to us and information that is automatically gathered when you use our website.

We use your personal information for the following purposes:

• Processing and fulfilling your custom embroidery orders
• Communicating with you about your orders, designs, and account
• Providing customer support and responding to enquiries
• Sending marketing communications (with your consent)
• Improving our website, products, and services
• Detecting and preventing fraud or unauthorised access
• Complying with legal obligations and resolving disputes

We do not sell, rent, or trade your personal information. We may share your data with:

• Payment processors: Stripe processes payments securely; we never store full card details
• Shipping partners: Royal Mail, DPD, and international couriers receive your delivery address
• Email service providers: for order confirmations and marketing (with consent)
• Analytics providers: anonymised usage data to improve our website
• Legal authorities: when required by law or to protect our rights

All third-party partners are contractually obligated to protect your data and process it only for the purposes we specify.

We retain your personal information only as long as necessary:

• Order data: 7 years (for tax and legal compliance)
• Account information: until you request deletion
• Marketing preferences: until you unsubscribe
• Design files: 12 months after order completion (unless you request earlier deletion)
• Website analytics: 26 months (anonymised)

You may request deletion of your data at any time by contacting us at [email protected].

Our website uses cookies to enhance your browsing experience:

• Essential cookies: required for website functionality (cart, checkout, security)
• Analytics cookies: help us understand how visitors use our site (Google Analytics)
• Marketing cookies: used to deliver relevant advertisements (only with consent)

You can manage cookie preferences through your browser settings or our cookie consent banner. Disabling essential cookies may affect website functionality.

Under UK data protection law, you have the right to:

• Access: request a copy of the personal data we hold about you
• Rectification: correct inaccurate or incomplete data
• Erasure: request deletion of your data ('right to be forgotten')
• Restriction: limit how we process your data
• Data portability: receive your data in a structured, machine-readable format
• Object: opt out of direct marketing or processing based on legitimate interests
• Withdraw consent: revoke consent for marketing or non-essential cookies at any time

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. If you are unsatisfied with our response, you may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We implement appropriate technical and organisational measures to protect your personal data, including:

• SSL/TLS encryption for all data transmission
• PCI DSS-compliant payment processing via Stripe
• Regular security audits and vulnerability assessments
• Access controls limiting data access to authorised personnel
• Encrypted storage for sensitive information

While we take every reasonable precaution, no method of transmission over the internet is completely secure.

Your data is primarily stored and processed within the United Kingdom. Where we use service providers based outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses and adequacy decisions, in compliance with UK GDPR requirements.

Our website and services are not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by posting a notice on our website or sending you an email. The 'Last updated' date at the top of this page indicates when the policy was last revised.

If you have questions about this Privacy Policy or our data practices, please contact us: