Privacy Policy

Who is responsible for your data

Trove is the data controller for the personal data described on this page. You can reach us at [email protected], or through the contact page.

Our registered company name, number and address are to be confirmed and will be published here before launch.

What we collect, and why

When you send an enquiry

We collect your name, email address, telephone number if you give one, any item reference you quote, and whatever you write in the message. We use it to answer you and to keep a record of the conversation about a particular piece. The lawful basis is our legitimate interest in responding to people who contact us about our stock.

When you place an order

We collect your name, email address, billing and delivery address, the items ordered, the amount paid, and a reference to the payment. We use it to fulfil the order, arrange insured delivery, handle returns and answer questions afterwards. The lawful basis is performance of our contract with you, and legal obligation for the records we are required to keep for tax purposes.

When you subscribe to the newsletter

We collect your email address and the date you subscribed. We use it only to send occasional emails about new pieces. The lawful basis is your consent, and every email carries an unsubscribe link that works immediately. If you unsubscribe we keep a record of that so we do not email you again by mistake.

When you use the site

Our server keeps standard access logs — IP address, the page requested, the time, and the browser's user-agent string — for security and troubleshooting. The lawful basis is our legitimate interest in keeping the site running and safe from abuse.

Card details

We never see or store your card details. Payment is taken on a page hosted by Stripe, our payment processor, and your card number is entered directly into Stripe's systems. It does not pass through, and is not stored on, any Trove server. We receive only confirmation that the payment succeeded, the amount, and the last four digits and card type for reconciliation. Stripe processes that data as a data controller in its own right under its own privacy policy.

Who else sees your data

Only the suppliers we need to run the shop, and only the minimum they need:

• Stripe, to take payment and handle refunds.
• Our delivery carrier, to deliver an insured, tracked parcel to you.
• Our email provider, to send order confirmations, replies and the newsletter.
• Our hosting provider, which stores the site and its database.

We do not sell personal data, and we do not share it for anyone else's marketing. Where a supplier processes data outside the UK, that transfer is covered by the appropriate safeguards, such as the UK International Data Transfer Addendum.

How long we keep it

• Orders and payment records: six years after the end of the financial year in which the order was placed, which is the period HMRC requires for business records.
• Enquiries: two years from the last message, then deleted, unless the enquiry led to an order.
• Newsletter subscriptions: until you unsubscribe. We then keep your email address on a suppression list so we cannot re-add you.
• Server access logs: a rolling period of no more than twelve months.

Your rights

Under UK GDPR you can ask us to do any of the following, free of charge, and we will respond within one month:

• Give you a copy of the personal data we hold about you.
• Correct anything that is wrong or incomplete.
• Delete it, where we do not have to keep it for a legal reason such as tax records.
• Restrict what we do with it while a question about it is resolved.
• Give you, or another provider, a portable copy of data you gave us.
• Stop processing it where we rely on legitimate interests.
• Withdraw consent to marketing at any time, which you can also do yourself with the unsubscribe link in any newsletter.

Email [email protected] to make any of these requests. We may ask you to confirm your identity first, so that we do not hand your data to someone else.

Complaints

If you are unhappy with how we have handled your data, please tell us first and give us the chance to put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.

Cookies

We use only strictly necessary cookies. At present that means a session cookie that remembers what is in your bag and keeps you signed in if you have an account, and a security token cookie that protects forms against cross-site request forgery. Neither is used to track you, and neither needs your consent under the Privacy and Electronic Communications Regulations.

There is no analytics, no advertising pixel and no third-party tracking script on this site. Our fonts are served from our own server, so loading a page sends no request to a third party. If we ever add analytics, we will ask for your consent first and update this page before doing so.

Stripe sets its own cookies on the checkout page it hosts, for fraud prevention. Those are covered by Stripe's own policy.

Children

The shop is intended for adults. We do not knowingly collect personal data from anyone under 16.

Changes to this policy

If we change how we handle personal data, we will update this page. Where the change is significant and we hold your email address, we will tell you directly.

Related: Delivery & Returns explains the 14-day return process, and our Terms & Conditions cover the sale itself.