Home / Privacy notice
Privacy notice
Last updated 8 October 2026
This notice explains what personal information we collect when you use our website and buy from us, why, who we share it with, how long we keep it, and your rights.
Who we are
The controller of your personal information is Plughathon Ltd. Contact us about privacy at:
- Email: hello@afiabiem.com
- Post: Afiabiem, Update store address in admin, HU1 3DY
What we collect
| Information | When |
|---|---|
| Name, email address, phone number | When you order |
| Delivery address and postcode | When you order for delivery |
| Your order: items, prices, delivery or collection choice, any note you add | When you order |
| Payment status and a payment reference (not your card number) | When you pay, via Stripe |
| Messages you send us | When you contact us |
| Technical information such as IP address and browser type, kept in server logs for security | When you visit |
We do not ask for or keep your card details, and we do not make automated decisions about you that have legal or similarly significant effects.
Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Taking payment, preparing, delivering or handing over your order, and sending order emails (confirmation, dispatch, reminders) | Contract |
| Handling cancellations, refunds, complaints and questions | Contract; legal obligation (consumer law) |
| Keeping sales and VAT records | Legal obligation (tax law) |
| Preventing fraud and keeping our website secure, including fraud checks by Stripe | Legitimate interests |
| Understanding how our website is used, using aggregate statistics only | Legitimate interests |
You need to give us your name, email and (for delivery) your address so we can fulfil your order. We do not send marketing emails. If we ever start, we will only do so with your permission.
Who we share it with
We share only what each provider needs, under contracts that require them to protect it:
- Stripe: card, Apple Pay and Google Pay payments and fraud prevention. Stripe acts as an independent controller for some purposes, such as fraud prevention and its legal obligations; see stripe.com/gb/privacy.
- Resend: sending our order emails.
- Vercel: hosting our website.
- Our server hosting provider: hosting our ordering system and database.
- Postcodes.io: checking the postcode you enter, to work out delivery options (we send the postcode only).
- Plausible Analytics: aggregate website statistics, with no cookies and no personal profiles (see Cookies & analytics).
- Delivery partners such as DPD: your name, delivery address and phone number, to deliver your order.
We may also share information where the law requires it, for example with HMRC or the police. We never sell your personal information.
International transfers
Some of our providers (such as Stripe, Resend and Vercel) may process data outside the UK, including in the United States. Where they do, the transfer is protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or by the UK International Data Transfer Agreement or Addendum.
How long we keep it
- Orders you paid for: 6 years from the order, because tax law requires us to keep sales and VAT records. After that we remove your name, contact details and address.
- Checkouts you started but did not pay for: personal details removed after 30 days.
- Server security logs: up to 90 days.
- Emails and messages with us: up to 2 years after we last dealt with your query, unless we need them longer for a legal claim.
Your rights
You have the right to:
- ask for a copy of your personal information;
- ask us to correct information that is wrong;
- ask us to delete information we no longer need (we must still keep order records required by tax law);
- object to, or ask us to restrict, how we use your information;
- ask for information you gave us in a portable format.
To use any of these rights, contact us using the details above. We will reply within one month. There is usually no charge.
Complaints
If you are unhappy with how we have handled your information, please tell us first so we can put it right; we will acknowledge your complaint within 30 days. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
Changes
We will update this notice if how we use your information changes, and show the date at the top.