1. Who we are

This website is operated by Mariposa Beads, a family-run business born from a love of crafting, creativity and beautiful beads.

For the purposes of UK data protection law, Mariposa Beads is the controller of the personal information described in this policy.

2. Information we collect

The information we collect depends on how you interact with our website and services. It may include:

• Your name, billing address, delivery address, email address and telephone number.
• Order information, including products purchased, order value, delivery method and transaction history.
• Customer account details, preferences and saved information.
• Information you provide when contacting us by email, live chat, contact form or social media.
• Marketing preferences and records of whether you have subscribed, unsubscribed or objected to marketing.
• Competition, survey or promotion entries where you choose to participate.
• Technical information such as your IP address, browser type, device information, approximate location, website activity and cookie identifiers.
• Fraud-prevention and security information relating to transactions or activity on our website.

Payment card details are processed securely by our payment providers. We do not receive or store your complete card number or card security code.

3. How we collect your information

We may collect information when you:

• Place or attempt to place an order.
• Create or use a customer account.
• Subscribe to marketing communications.
• Contact our customer service team.
• Use our website, cookies or similar technologies.
• Enter a competition, promotion or survey.
• Interact with us through social media.

We may also receive limited information from trusted service providers involved in processing your order, preventing fraud, delivering your parcel or helping us operate our website.

4. How and why we use your information

5. Marketing communications

We may send marketing emails where you have actively subscribed or where the law otherwise permits us to contact an existing customer about similar products and services.

Every marketing email includes an unsubscribe option. You can also withdraw your consent or object to direct marketing at any time by emailing hello@mariposa-beads.co.uk .

Unsubscribing from marketing will not stop us sending essential service messages about an order, payment, delivery, account or customer-service enquiry.

6. Cookies and similar technologies

Our website uses cookies and similar technologies. Cookies are small files stored on your browser or device.

They may be used to:

• Keep the website and checkout working correctly.
• Remember your preferences and shopping basket.
• Protect the website and detect suspicious activity.
• Measure website performance and understand how visitors use it.
• Support advertising and personalisation where you have given the required permission.

Where required, non-essential cookies will only be used after you have made a choice through our cookie banner. You can update your preferences through the cookie settings available on our website.

Disabling some cookies may affect the way certain parts of the website work.

7. Who we share information with

We do not sell personal information.

We may share the minimum information necessary with trusted organisations that help us keep Mariposa Beads running smoothly, including:

• Shopify, which hosts and operates our online store.
• Payment processors and fraud-prevention providers.
• Royal Mail, couriers and delivery partners.
• Website, analytics, cookie-management and technical providers.
• Email and customer-communication providers.
• Professional advisers, accountants, insurers and legal advisers.
• Regulators, courts, law-enforcement agencies or public authorities where disclosure is required or permitted by law.
• A purchaser or adviser involved in a legitimate sale, restructure or transfer of the business, subject to appropriate confidentiality and data-protection safeguards.

Service providers may only use personal information to provide their contracted services, comply with the law or protect their legitimate legal rights.

8. International transfers

Some of our service providers, including Shopify and its subprocessors, may process information outside the United Kingdom.

Where personal information is transferred internationally, appropriate safeguards must be used in accordance with applicable data protection law. These may include adequacy regulations, approved contractual protections or other lawful transfer mechanisms.

9. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including meeting legal, tax, accounting, fraud-prevention and customer-service requirements.

• Order, invoice and transaction records will generally be retained for at least six years where required for tax purposes.
• Customer-service correspondence will be retained for as long as needed to resolve the matter and manage any resulting legal or contractual obligations.
• Customer account information will generally be kept while the account remains active and for a reasonable period afterwards.
• Marketing information will be retained until you unsubscribe, withdraw consent or object, although we may retain a limited suppression record so we can respect your choice.
• Cookie and analytics information is retained according to the settings and retention periods of the relevant service.

We may keep information for longer where required by law, necessary for a legal claim or needed to prevent fraud or misuse.

10. How we protect your information

We use reasonable technical and organisational measures designed to protect personal information against accidental loss, unauthorised access, alteration, disclosure or misuse.

Access is limited to people and service providers who need the information for legitimate business purposes.

No internet service can guarantee complete security. You are responsible for keeping customer-account passwords confidential and should not share them with anyone.

We will never ask you to send complete payment-card details by email, text message or live chat.

11. Your data-protection rights

Depending on the circumstances, you may have the right to:

• Ask for access to the personal information we hold about you.
• Ask us to correct inaccurate or incomplete information.
• Ask us to delete certain personal information.
• Ask us to restrict the way we use your information.
• Object to processing based on legitimate interests.
• Object at any time to the use of your information for direct marketing.
• Ask to receive or transfer certain information in a portable format.
• Withdraw consent where our use of information relies on consent.
• Ask for human review of a decision made solely through automated processing where applicable.

These rights are not absolute and may be subject to legal exemptions. We may ask for information needed to verify your identity before responding.

To exercise a right, email hello@mariposa-beads.co.uk .

We do not normally charge a fee for responding to a data-protection request. A reasonable fee may be charged, or a request refused, where permitted by law because it is manifestly unfounded or excessive.

12. Complaints

Please get in touch with us first if you have any concerns about how we have handled your personal information. We will do our best to help and resolve the issue.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection.

Information about raising a complaint is available at ico.org.uk .

13. Third-party websites

Our website may link to websites, social-media platforms or services operated by other organisations. We are not responsible for their privacy practices.

Please review the privacy information provided by those organisations before submitting personal information to them.

14. Children’s information

Our website and products are not directed specifically at children, and we do not knowingly collect personal information directly from children for marketing purposes.

Orders should be placed by an adult or with the involvement and permission of a parent or guardian.

15. United States privacy information

Depending on where you live, certain US state privacy laws may provide rights relating to targeted advertising or the sharing of personal information.

Where applicable, you may use the form below to submit an opt-out request. We may also recognise a supported Global Privacy Control preference signal where legally required.

16. Changes to this policy

We may update this privacy policy when our services, systems or legal obligations change. The latest version will always be published on this page.

Significant changes may also be communicated through our website or by another appropriate method.

17. Contact us

Have a question, request or concern about your information? Please get in touch and we will be happy to help.