Privacy Policy

Last updated: 9 October 2026

This Privacy Policy explains how Card Vaulty collects, uses and protects your personal data when you visit cardvaulty.com, create an account, place an order or sign up to our newsletter. We are committed to handling your data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

Who we are

Card Vaulty is run by Michael Odell, a sole trader based in England, trading as Card Vaulty. Our business address is 16 Chase Main Road, Longfield, DA3 7PS, United Kingdom. We are the data controller for the personal data described in this policy.

For any questions about this policy or your data, contact us at mikesw15@gmail.com or write to 16 Chase Main Road, Longfield, DA3 7PS, United Kingdom.

What personal data we collect

When you place an order

Our shop runs on WordPress and WooCommerce. When you order, we collect:

  • your name, billing address, delivery address, email address and phone number;
  • details of the products you buy, order totals and order history;
  • any notes you add to your order;
  • technical information recorded with the order, such as your IP address and browser type, which helps us prevent fraud.

When you create an account

If you register an account, we also store your login email and password (stored in encrypted form), and your saved addresses. You can choose to check out as a guest instead.

Payment information

Payments are processed securely by our payment provider (Stripe and/or PayPal). Your card details are entered into and handled by our payment provider, not stored on our website. We receive confirmation of payment and limited details, such as the payment method used. Our payment providers process your data under their own privacy policies: Stripe Privacy Policy and PayPal Privacy Statement.

Newsletter sign-up

If you sign up to our newsletter, we store the details you give us on the sign-up form, such as your email address, together with the date you signed up and your consent. Newsletter sign-ups are stored on our website (WordPress) only. You can unsubscribe at any time using the link in any email or by contacting us.

When you contact us

If you email us, we keep a record of your message and our reply so we can help you.

Cookies and website usage data

We use cookies and similar technologies. See the Cookies section below.

How and why we use your data

We only use your personal data where we have a lawful basis to do so:

  • To process and deliver your order, take payment, send order and dispatch emails, and handle cancellations, returns and refunds – performance of a contract.
  • To manage your account, if you create one – performance of a contract.
  • To keep financial and tax records – legal obligation.
  • To prevent fraud and keep our website secure – legitimate interests.
  • To answer your enquiries – legitimate interests, or performance of a contract where it relates to an order.
  • To send our newsletter and marketing emails – consent.

We do not sell your personal data. We do not use your data for automated decision-making that has legal or similarly significant effects on you.

Who we share your data with

We share personal data only where needed with trusted service providers who act on our behalf:

  • Payment processing: our payment provider (Stripe and/or PayPal)
  • Delivery: Royal Mail (name, delivery address and, where needed, email or phone number for delivery updates)
  • Website hosting: Hostinger

We may also share data where required by law, for example with HM Revenue & Customs or the police, or to protect our legal rights.

International transfers

Some of our service providers may store or process personal data outside the UK. Where this happens, we rely on the safeguards required by UK data protection law, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Please contact us if you would like more information.

How long we keep your data

  • Order records: we keep order records for as long as required for tax and accounting purposes (usually six years).
  • Accounts: until you ask us to delete your account. Order records linked to the account are kept as above.
  • Newsletter: until you unsubscribe. We may keep a record that you unsubscribed so we do not email you again.
  • Customer enquiries: for as long as we need them to deal with your enquiry and any related order, return or complaint.

Your rights

Under UK GDPR you have the right to:

  • access the personal data we hold about you;
  • rectification – have inaccurate or incomplete data corrected;
  • erasure – ask us to delete your data, where we do not need to keep it for legal reasons;
  • restriction – ask us to limit how we use your data;
  • data portability – receive the data you gave us in a commonly used format;
  • object to processing based on legitimate interests, and to direct marketing at any time;
  • withdraw consent at any time, where we rely on consent (for example, for the newsletter).

To use any of these rights, email mikesw15@gmail.com. We may need to confirm your identity. We will normally respond within one month. You can also view and update your account details in My Account.

Cookies

Cookies are small text files stored on your device. We use:

  • Strictly necessary cookies – required for the shop to work, such as keeping items in your basket, keeping you logged in and securing checkout. WooCommerce and WordPress set cookies such as woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* and, if you log in, wordpress_logged_in_*. These do not need your consent.
  • Payment cookies – our payment provider (Stripe and/or PayPal) may set cookies during checkout for security and fraud prevention.

We do not currently use analytics or advertising cookies. Because we only use cookies that are strictly necessary for the shop and checkout to work, we do not show a cookie consent banner. If we start using non-essential cookies, we will ask for your consent before setting them and update this policy. You can block or delete cookies in your browser settings, although some parts of the shop may not work without strictly necessary cookies.

How we protect your data

Our website uses HTTPS encryption. Access to customer data is limited to those who need it to run the shop.

Children

Our website is not intended for children to place orders. If you are under 18, please ask a parent or guardian to order for you.

Complaints

If you have a concern about how we use your data, please contact us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, helpline 0303 123 1113.

Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.