Last updated: 30th September 2025

1. Introduction This Privacy Policy explains how The Petite Cartel ("we", "us", "our") collects, uses, and protects your personal data when you use our website, located at [Your Website Address]. We are committed to protecting your privacy and handling your data in an open and transparent manner in accordance with the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

By using our Site, you agree to the collection and use of information in accordance with this policy.

2. Who We Are For the purposes of the UK GDPR, the data controller is The Petite Cartel, a company registered in England under company number [Company Registration Number], whose registered office is at [Registered Address].

3. The Data We Collect About You We may collect, use, store, and transfer different kinds of personal data about you. This data is grouped into the following categories:

• Identity Data: Includes first name, last name, and title.

• Contact Data: Includes billing address, delivery address, email address, and telephone numbers.

• Financial Data: Includes payment card details for processing payments through our secure payment processor (Stripe). We do not store or have direct access to your full payment card details.

• Transaction Data: Includes details about payments to and from you and other details of products you have purchased from us.

• Technical Data: Includes your internet protocol (IP) address, browser type and version, time zone setting, browser plug-in types and versions, and operating system and platform.

• Profile Data: Includes your username and password (if you create an account), your purchases or orders, and your interests.

• Usage Data: Includes information about how you use our website and services.

• Marketing and Communications Data: Includes your preferences in receiving marketing from us and your communication preferences.

4. How and Why We Collect Your Data We use different methods to collect data from and about you, including:

• Direct Interactions: You may give us your Identity, Contact, and Financial Data by filling in forms or by corresponding with us by post, phone, email, or otherwise. This includes data you provide when you:

  • Purchase our products.

  • Create an account on our website.

  • Subscribe to our newsletter.

  • Contact us with an enquiry or to provide feedback.

• Automated Technologies or Interactions: As you interact with our website, we may automatically collect Technical and Usage Data about your equipment, browsing actions, and patterns. We collect this personal data by using cookies, server logs, and other similar technologies.

• Third Parties: We may receive personal data about you from third-party services, such as our payment processor (Stripe) and our shipping and delivery partners (Easyship).

We only use your personal data when the law allows us to. Most commonly, we use your data to:

• Process and deliver your order, which is necessary for the performance of the contract between us.

• Manage our relationship with you, which includes notifying you about changes to our terms or asking you to leave a review.

• Enable you to participate in a competition or complete a survey.

• Administer and protect our business and this website.

• Send you relevant marketing communications, but only if you have consented to receive them.

5. Sharing Your Personal Data We may have to share your personal data with the parties set out below for the purposes mentioned in section 4:

• Service Providers: We share your data with third-party service providers who assist us in our business operations, such as:

  • Squarespace: Our website platform.

  • Stripe: Our payment processor.

  • Easyship: Our shipping and delivery partner.

• Professional Advisers: Includes lawyers, bankers, and auditors who provide consultancy, banking, legal, and accounting services.

• Governmental and Regulatory Bodies: We may disclose your personal data where we are legally required to do so.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your data for specified purposes and in accordance with our instructions.

6. International Transfers Some of our third-party service providers may be located outside of the UK, which means the processing of your data will involve a transfer of data outside of the UK. Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by implementing at least one of the following safeguards:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK Government.

• Where we use certain service providers, we may use specific contracts approved by the UK Government which give personal data the same protection it has in the UK.

7. Data Security We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way. We limit access to your data to employees and service providers on a "need-to-know" basis.

8. Data Retention We will only retain your personal data for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.

9. Your Legal Rights Under data protection laws, you have rights in relation to your personal data. These include the right to:

• Request access to your personal data.

• Request correction of your personal data.

• Request erasure of your personal data.

• Object to processing of your personal data.

• Request restriction of processing your personal data.

• Request transfer of your personal data.

• Withdraw consent at any time.

If you wish to exercise any of these rights, please contact us at hello@thepetitecartel.com. We will aim to respond to all legitimate requests within one month.

10. How to Contact Us If you have any questions about this privacy policy or our data practices, please contact us at: Email: hello@thepetitecartel.com Address: [Your Business Address]

11. Changes to This Privacy Policy We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. We encourage you to review this Privacy Policy periodically for any changes.

Explanation of the Privacy Policy:

• Clarity and Structure: The policy is structured with clear headings and bullet points, making it easy for a customer to understand their rights and how their data is handled.

• Legal Compliance: It explicitly names the UK GDPR and the Data Protection Act 2018, which is a legal requirement. It also identifies your client as the "data controller."

• Specific Data Types: It breaks down the types of data collected (e.g., Identity, Contact, Financial Data) to be transparent with the user.

• Purpose of Processing: It provides specific legal bases for processing data (e.g., "performance of a contract," "legitimate interests"), which is a core GDPR requirement.

• Third-Party Disclosure: It correctly identifies the third-party services used (Squarespace, Stripe, Easyship), which is a crucial detail for transparency.

• Customer Rights: It outlines all the key rights a customer has under GDPR, including the right to access, rectify, or erase their data.

• International Transfers: It includes a clause on international transfers, which is vital as Squarespace and Easyship are US-based companies. This section explains the legal safeguards in place.

• Contact Information: It provides clear contact details for customers to exercise their rights or ask questions, as required by law.