1. Data Controller

Water of Siloe Ltd.
57 Woolacombe Road, SE3 8QJ, London, United Kingdom
Email: info@waterofsiloe.co.uk

2. What data we collect and why

2.1 Account registration and user profile

Data collected: first name, last name, email address, password, billing address (street, postcode, city, county, country), shipping address (street, postcode, city, county, country), phone number, company name, VAT number.

Purpose: to manage your account, process your orders, issue invoices, and arrange deliveries.

Legal basis: performance of a contract (Art. 6(1)(b) UK GDPR).

Retention: for the duration of your account. If you request account deletion, your data will be removed except where retention is required by law (see section 6).

2.2 Orders and payments

Data collected: order details (products, quantities, prices), payment transaction data, discount applied, currency, exchange rate.

Purpose: to fulfil your order, process payment, and comply with tax and accounting obligations.

Legal basis: performance of a contract (Art. 6(1)(b)) and compliance with legal obligations (Art. 6(1)(c) UK GDPR).

Retention: 10 years from the date of the transaction, as required by UK tax legislation (HMRC requirements).

2.3 Contact form

Data collected: name, email address, message content.

Purpose: to respond to your enquiry.

Legal basis: your consent (Art. 6(1)(a) UK GDPR), given when you submit the form.

Retention: 12 months from receipt, unless a commercial relationship is established.

2.4 Session cookies (shopping cart)

Data collected: a technical session identifier stored in your browser's local storage.

Purpose: to maintain your shopping cart contents while you browse the site.

Legal basis: this is strictly necessary and does not require consent (Regulation 6(4) PECR).

Retention: until you clear your browser data or log out.

3. Third parties and data sharing

3.1 PayPal

If you choose to pay by PayPal, the following data is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A.: your name, shipping address, company name, VAT number, order details, and transaction amount. PayPal processes this data as an independent data controller under its own privacy policy: paypal.com/privacy.

3.2 Google Fonts

This site loads fonts from Google Fonts. When a page is displayed, your browser connects to Google servers and transmits your IP address. Google's privacy policy applies.

Legal basis: legitimate interest in consistent site presentation (Art. 6(1)(f) UK GDPR).

4. International data transfers

Some of the third-party services listed above (Google, PayPal) may process data outside the United Kingdom. These transfers are protected by UK adequacy decisions where available, and UK International Data Transfer Agreements (IDTAs) or the UK Addendum to EU Standard Contractual Clauses.

5. Your rights

Under the UK GDPR and EU GDPR, you have the right to:

Access your personal data and obtain a copy;
Rectify inaccurate or incomplete data;
Erase your personal data ("right to be forgotten"), subject to legal retention obligations;
Restrict processing in certain circumstances;
Data portability — receive your data in a structured, commonly used format;
Object to processing based on legitimate interest;
Withdraw consent at any time.

To exercise any of these rights, please email us at info@waterofsiloe.co.uk. We will respond within one month.

6. Data retention

Data category	Retention period	Reason
Account and profile data	Until account deletion request	Contract performance
Orders and invoices	10 years	UK tax law (HMRC)
Payment transaction data (PayPal)	10 years	UK tax law (HMRC)
Contact form messages	12 months	Enquiry follow-up

7. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. All data is transmitted over HTTPS and passwords are stored using bcrypt hashing.

8. Cookies

This site uses the following categories of cookies:

Strictly necessary: session cookie (shopping cart), authentication cookies. These do not require consent.

You can change your cookie preferences at any time by clearing your browser cookies and revisiting the site.

9. Supervisory authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with:

UK residents: Information Commissioner's Office (ICO) — ico.org.uk
EU residents: your local Data Protection Authority. For Italy: Garante per la protezione dei dati personali — garanteprivacy.it

10. Changes to this policy

We may update this privacy policy from time to time. The date at the top of this page indicates the last revision. We encourage you to review this page periodically.

Reset your password