UK GDPR
Privacy Policy
Last updated: 16 September 2026.
This policy explains what personal data we collect when you visit driftly-boutique.fr or place an order, why we use it, who we share it with, how long we keep it, and what your rights are. It applies in line with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.
1. Data controller
Driftly Limited, a company registered in the United Kingdom under number 17443340, registered office: Swan Buildings, 20 Swan Street, M4 5JW Manchester, United Kingdom. Contact for any question about your data: contact@driftly-boutique.fr.
2. Data collected and purposes
We only collect the data necessary for the purposes described below.
| Purpose | Data concerned | Legal basis (UK GDPR art. 6) |
|---|---|---|
| Order management: processing, payment, delivery, invoicing, tracking, after-sales service, guarantees, cancellations and returns | Identity (first name, last name), contact details (email, phone, delivery and billing addresses), order details, history of exchanges | Performance of the sales contract; legal obligations (accounting, guarantees) |
| Secure payment and fraud prevention | Card data (entered and processed only by our payment provider, never by us), amount, IP address, browser technical fingerprint | Performance of the contract; legitimate interest (transaction security); the provider's own legal obligations (anti-fraud and anti-money-laundering) |
| Customer relations: responding to your enquiries via the contact form or email | Name, email, message content | Legitimate interest (responding to enquiries); steps taken prior to entering a contract |
| Newsletter and marketing emails | Email address, date and proof of sign-up | Consent (Privacy and Electronic Communications Regulations 2003) — withdrawable at any time via the unsubscribe link |
| Exercising the online right to cancel and issuing the acknowledgement of receipt | First name, last name, email, order number and date, products concerned, time-stamp of the request | Legal obligation (Consumer Contracts Regulations 2013) |
| Running the site: basket, preferences, security, audience measurement | Trackers and technical identifiers (see the Cookie Policy) | Legitimate interest for strictly necessary trackers; consent for the others |
| Handling requests to exercise your rights and disputes | Identity, contact details, content of the request, proof of identity if necessary | Legal obligation; legitimate interest (defending our rights) |
Data marked as required in our forms is necessary to process your request or order; without it, we may not be able to proceed. We do not process any special category data and do not make any decision based solely on automated processing that has a legal effect on you. The Site is not aimed at children under 13; a purchase made by a minor is made under the responsibility of their parent or guardian.
3. Who we share data with
Your data is processed by authorised Driftly Limited staff. It is passed on, strictly as needed for each purpose, to the following processors and recipients:
- Stripe Payments UK, Ltd. (7th Floor, The Bower Warehouse, 211 Old Street, London EC1V 9NR, United Kingdom), with its affiliates Stripe Payments Europe, Ltd. (Dublin, Ireland) and Stripe, Inc. (San Francisco, United States) — secure card payment processing, 3-D Secure authentication, fraud prevention. Stripe acts as an independent controller for certain operations (fraud prevention, regulatory obligations); its privacy policy is available at https://stripe.com/gb/privacy.
- Royal Mail — standard order delivery (name, address, phone and email for parcel delivery and tracking notifications).
- DPD — express order delivery (name, address, phone and email for parcel delivery and tracking notifications).
- Website host and technical tools (hosting, transactional emails, backups) — Hostinger UK Limited — 6 Lloyds Avenue, Suite 4CL, London, England EC3N 3AX, United Kingdom.
- Regulated professionals and authorities (accountant, solicitors, ADR provider, government bodies and courts) where the law requires it or to exercise our rights.
We do not sell or rent your personal data to third parties.
4. International transfers
Driftly Limited is established in the United Kingdom and processes your data primarily in the UK. Some of our providers (in particular our website host and payment provider, whose parent companies are based in the United States) may process data outside the UK; these transfers rely on adequacy regulations made under UK GDPR, or on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, supplemented where needed by additional safeguards. A copy of the applicable safeguards can be requested at contact@driftly-boutique.fr.
5. Retention periods
| Data | Retention period |
|---|---|
| Customer account and order data (active database) | Duration of the business relationship, then 3 years from the last contact or order (for marketing) |
| Invoices, contracts and accounting records | 6 years from the end of the financial year (Companies Act 2006 s.388, and HMRC record-keeping requirements) — restricted-access archive |
| Payment data | Processed by Stripe for the duration of the transaction and any chargeback period; we only retain the transaction ID and the last four digits of the card |
| Cancellation requests and acknowledgements of receipt | 6 years (general limitation period) |
| Contact form messages | 3 years from the last exchange |
| Newsletter sign-up | Until consent is withdrawn, and at most 3 years after the last contact; proof of consent kept for 3 years after unsubscribing |
| Trackers and consent choices | Choice (accept or reject) and proof of the choice kept for no longer than 12 months; the lifetime of each tracker is stated in the Cookie Policy |
| Technical security logs | 12 months |
6. Your rights
Under UK GDPR arts. 15-22 and the Data Protection Act 2018, you have the following rights:
- Access to your data and to a copy of it;
- Rectification of inaccurate or incomplete data;
- Erasure, within the limits of our legal retention obligations;
- Restriction of processing in the cases set out in article 18;
- Portability of the data you have provided us, in a structured, commonly used format;
- Objection to processing based on our legitimate interest, for reasons relating to your particular situation, and objection at any time and without reason to direct marketing;
- Withdrawing consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
To exercise these rights, write to us at contact@driftly-boutique.fr or by post to Driftly Limited, Swan Buildings, 20 Swan Street, M4 5JW Manchester, United Kingdom, stating the purpose of your request. We respond within one month, extendable by two further months for complex requests. Where we have reasonable doubts about your identity, we may ask for proof.
If, after contacting us, you believe your rights have not been respected, you can complain to the Information Commissioner's Office (ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk/make-a-complaint).
7. Cookies and trackers
The Site uses trackers strictly necessary for it to work (basket, security, remembering your choices) and, subject to your consent, audience-measurement or marketing trackers. Details, retention periods and how to change your choices at any time are set out in our Cookie Policy.
8. Security
We implement appropriate technical and organisational measures to protect your data against loss, unauthorised access, disclosure or alteration: encrypted connections (HTTPS/TLS), access segregation, strong authentication for administrators, backups, and processors selected for their safeguards (Stripe is PCI DSS Level 1 certified; no card data passes through our servers). In the event of a data breach likely to result in a high risk to your rights and freedoms, we will inform you in line with UK GDPR art. 34.
9. Changes
We may update this policy to reflect changes to our services or the law. The update date is shown at the top of the page; in the event of a material change, customers with an order in progress will be informed by email.