Last updated: 12 November 2026
Who we are
The data controller is DemandOS Ltd, trading as Garden Spa Shop, company number 17351268, registered office 26 North Parade, York, YO30 7AB. Email hello@gardenspashop.co.uk. ICO registration number: TBC.
What we collect and why
| Information | Why we use it | Lawful basis |
|---|---|---|
| Name, delivery and billing address, email, phone number, order details | To take and deliver your order, and to handle cancellations, returns and faults | Contract |
| Payment confirmation details (we do not see or store full card numbers; payment provider: TBC) | To take payment and issue refunds | Contract |
| Messages you send us | To answer your questions and keep a record | Legitimate interests (running the shop), or contract |
| Order and accounting records | To meet tax and company law obligations | Legal obligation |
| Cookie choice (stored on your device only) | To remember your choice | Strictly necessary |
Who we share it with
Your name, delivery address and phone number are passed to the supplier and courier who deliver your order, so that they can deliver it. We also use service providers for website hosting, email and payment processing (names TBC). They may only use your data to provide their service to us. We do not sell your data and we do not use it for advertising profiling.
Transfers outside the UK
Some providers may process data outside the UK. Where they do, we rely on an adequacy decision or the UK International Data Transfer Agreement or Addendum, or another safeguard recognised under UK GDPR.
How long we keep it
Order and accounting records are kept for 6 years after the end of the tax year to which they relate. Enquiries that do not lead to an order are kept for up to 12 months.
Marketing
We will only send you marketing email if you ask us to, and you can withdraw at any time. At present we send none.
Your rights
Under UK GDPR you have the right to access your data, have it corrected or erased, restrict or object to its use, receive it in a portable form, and withdraw consent where we rely on it. Email hello@gardenspashop.co.uk to use these rights. We will reply within one month.
Complaints
If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113, or write to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Changes
We will update this notice when our practices change and show the date at the top.