The short version
- Cordwain collects only what is needed to take an order, deliver it, and answer questions.
- Cordwain does not sell personal data. Not to anyone, not ever.
- Card details never touch this website — payments are handled by the payment provider.
- Anyone can ask for a copy of their data, or ask for it to be deleted, by emailing [EMAIL].
The detail is below, written in plain language rather than legal shorthand. If anything here is unclear, ask — the answer will be given straight.
Who is responsible for your data
This website is operated by Cordwain Leather We are the data controller for the personal information described in this policy.
Questions, requests or complaints: [EMAIL].
What we collect, and why
When you place an order
- Name, delivery address, email address and phone number — to process and deliver the order, and to contact you about it.
- Order details and history — to fulfil the order, handle returns, and meet accounting obligations.
- Payment confirmation — we receive confirmation that payment succeeded. We never see or store your card number.
Legal basis: performance of a contract, and legal obligation for records we must keep.
When you ask for fit advice
If you send measurements through the fit finder, a form, or WhatsApp, we use them only to recommend a size. Height, weight and measurements are kept with the enquiry so we can answer follow-up questions, and are deleted on request.
Legal basis: your consent, and steps taken at your request before entering a contract.
When you subscribe to emails
Your email address is used to send new releases and care guides. Every email carries an unsubscribe link, and unsubscribing takes effect immediately.
Legal basis: consent, withdrawable at any time.
When you browse the site
- Cookies and similar technologies that keep your basket working and remember preferences.
- Analytics data — pages viewed, approximate location, device and browser — used in aggregate to understand what is useful and what is broken.
- Server logs, including IP address, kept for security and troubleshooting.
Legal basis: legitimate interests for essential functions and security; consent for analytics and marketing cookies where required.
Who else sees your data
Only the companies needed to run the shop, and only the data they need:
- Payment processing: [PAYMENT PROVIDER] — handles the transaction and holds the card details we never receive.
- Shipping and delivery: [COURIER] — receives name, address and phone number to deliver the parcel and handle customs.
- Website hosting: [HOST] — stores the site and its database.
- Email delivery: [EMAIL PROVIDER] — sends order confirmations and, if you subscribed, newsletters.
- Analytics: [ANALYTICS PROVIDER] — aggregate site usage.
- Messaging: WhatsApp, where you choose to contact us that way. Those conversations are covered by WhatsApp’s own privacy terms as well as this one.
Each of these acts on our instructions and cannot use your data for their own purposes. We may also disclose information where the law requires it.
What we never do
- We do not sell personal data.
- We do not share your details with advertisers or data brokers.
- We do not send marketing emails to people who did not ask for them.
- We do not store card numbers.
International transfers
Orders are shipped worldwide, so data may be processed in countries outside your own, including [COUNTRIES]. Where data leaves the UK or European Economic Area, it is protected by appropriate safeguards such as standard contractual clauses.
How long data is kept
- Order records: 1 years, as required for tax and accounting.
- Fit enquiries and messages: 3 months, then deleted.
- Newsletter subscriptions: until you unsubscribe.
- Analytics: 1 months in aggregate form.
- Server logs: 30 days.
Your rights
Wherever you live, you can ask us to:
- Give you a copy of the personal data we hold about you.
- Correct anything that is wrong.
- Delete your data, where we are not legally required to keep it.
- Stop using it for marketing, at any time.
- Send your data to another provider in a portable format.
- Object to processing based on legitimate interests.
Email [EMAIL] and we will respond within [30] days. No account or explanation is needed.
If you are in the UK or EU and are unhappy with our response, you can complain to your national data protection authority. If you are in California, you have the additional rights described under the CCPA, including the right to know what is collected and to opt out of sale — which does not apply here, because we do not sell data.
Cookies
Essential cookies keep the basket and checkout working and cannot be switched off without breaking the shop. Analytics and marketing cookies are optional, and where required we ask before setting them. Browser settings can block or delete cookies at any time, though the checkout may stop working if essential ones are blocked.
Children
This shop is not intended for children, and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, email us and it will be deleted.
Security
The site runs over an encrypted connection, access to order data is limited to people who need it, and payment details are handled entirely by the payment provider. No system is perfectly secure, but if a breach ever affected your data we would tell you and the relevant authority within the timeframes the law requires.
Changes to this policy
If this policy changes, the updated version appears here with a new date at the top. Material changes affecting how your data is used will be notified by email where we have your address.