Cotton Lily Privacy Policy

Last updated: August 2026
 
This privacy notice explains how Cotton Lily collects, uses, stores and shares your personal information when you visit the website, place an order or contact me.
Cotton Lily is responsible for the personal information described in this notice and acts as the data controller.
 
Contact details
 
If you have any questions about this privacy notice, would like to exercise your data protection rights, or wish to make a data protection complaint, please contact:
 
Email: cottonlilyshop@gmail.com
 
What personal information I collect
 
Depending on how you use the website, I may collect:
 

• Your name

• Email address

• Delivery and billing address

• Order details and products purchased

• Information relating to payment and transactions

• Your order number

• Messages or enquiries you send through the website or by email

• Information relating to returns, complaints or damaged or incorrect orders
   

The website platform may also process technical information needed to operate and secure the website, such as IP address, browser or device information and cookie data.

Full card details are not normally provided directly to Cotton Lily. Payments are processed securely by the payment provider used at checkout.
 
How and why I use your personal information
 
Processing and delivering your order
 
I use your name, contact details, address and order information to:
 

• Process your order

• Make and prepare your items

• Take payment

• Pack and dispatch your order

• Send order and dispatch information

• Deal with returns, refunds or problems relating to your purchase
   

The lawful basis for using your information for these purposes is contract, because this information is necessary to provide the products you have ordered.
 
Responding to enquiries

If you contact Cotton Lily through the website or by email, I use the information you provide to respond to your enquiry and provide customer service.
 
Where your enquiry relates to an existing or potential order, the lawful basis may be contract.
 
For general enquiries, the lawful basis is legitimate interests. My legitimate interest is being able to respond to people who contact Cotton Lily about the business, products or services.
 
Keeping business and financial records
 
Some order and transaction information is retained because I am required to keep appropriate records for tax, accounting and other legal purposes.
 
The lawful basis for this is legal obligation.
 
Protecting the business and customers
 
Personal information may also be used where reasonably necessary to prevent fraud, protect the security of the website, resolve disputes or establish, exercise or defend legal claims.

Where applicable, the lawful basis is legitimate interests or legal obligation.

Where I get personal information from

Most personal information is provided directly by you when you:
 

• Place an order

• Complete the contact form

• Email me

• Contact me about an order, return or complaint
   

Limited transaction information may also be received from payment providers and information necessary to operate the website may be processed through the website platform.

Who your information may be shared with

I only share personal information where it is necessary to operate Cotton Lily, fulfil your order or meet a legal obligation.

This may include:

Wix
The website and online store are hosted using Wix, which processes customer and website information to provide the website and ecommerce services.

Payment providers, such as Stripe
Payment providers securely process payments and provide Cotton Lily with the information needed to confirm and manage transactions.

Royal Mail or other delivery providers
Your name and delivery address are provided to the delivery service where necessary to send your order.

HM Revenue & Customs and other authorities
Information may be provided where I am legally required to do so.

Professional advisers or service providers
Information may occasionally be shared with professional advisers or other service providers where reasonably necessary for accounting, legal, technical or business purposes.

I do not sell your personal information.

International transfers

Some of the companies used to operate the website and process payments are international businesses and may process or store personal information outside the United Kingdom.

Where personal information is transferred internationally, I use service providers that apply appropriate safeguards for international transfers in accordance with UK data protection law.

How long I keep your information

I do not keep personal information for longer than I reasonably need it.

Orders and transaction records

Order and financial records that form part of my business and tax records are retained for at least the period required by HM Revenue & Customs. For a self-employed business, this is generally at least five years after the 31 January submission deadline for the relevant tax year.

Some information may be retained for longer where this is required by law or reasonably necessary in connection with a dispute or legal claim.

General enquiries

Messages and contact-form enquiries that do not relate to an order are normally kept for up to 12 months after the enquiry has been resolved.

If an enquiry develops into an order, complaint or ongoing issue, relevant correspondence may be retained with the associated records.

Returns, complaints and disputes

Information relating to returns, complaints, damaged goods or disputes is kept for as long as reasonably necessary to resolve the matter and meet any legal, accounting or record-keeping obligations.

When personal information is no longer required, I will delete or anonymise it where reasonably possible.

Cookies

The Cotton Lily website uses cookies and similar technologies to help the website work correctly and securely.

Some cookies are essential for functions such as the shopping basket and checkout.

Other non-essential cookies may require your consent.

More information about cookies and your choices will be available through the website's cookie settings and Cookie Policy.

Marketing

Information provided when placing an order will not automatically be used to send you marketing emails.

If Cotton Lily introduces email marketing in future, you will be given an appropriate choice about whether you would like to receive it, and you will be able to unsubscribe.

Your data protection rights

Depending on the circumstances and the lawful basis being used, you may have the following rights:

Right of access

You can ask for a copy of the personal information I hold about you.

Right to rectification

You can ask me to correct information that is inaccurate or complete information that is incomplete.

Right to erasure

In certain circumstances, you can ask me to delete your personal information.

Right to restriction of processing

In certain circumstances, you can ask me to limit how your personal information is used.

Right to object

You may have the right to object to certain uses of your personal information, particularly where legitimate interests are relied upon.

Right to data portability

In certain circumstances, you can ask for information you provided to be transferred to you or another organisation.

Right to withdraw consent

Where consent is relied upon, you can withdraw that consent at any time.

Some of these rights do not apply in every situation. For example, I may need to retain certain records even after a deletion request where I have a legal obligation to keep them.

To exercise any of these rights, email cottonlilyshop@gmail.com.

I will respond within the timescale required by data protection law, normally within one month.

How to make a data protection complaint

If you have concerns about the way Cotton Lily has collected, used or stored your personal information, please contact me first so I have an opportunity to investigate and put things right.

Email: cottonlilyshop@gmail.com

I will acknowledge a data protection complaint within 30 days and will investigate it appropriately, keep you informed where necessary and let you know the outcome without undue delay.

If you remain unhappy with how your personal information has been handled, you also have the right to complain to the Information Commissioner's Office (ICO).

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline: 0303 123 1113

You can also make a complaint through the Information Commissioner's Office website.

Changes to this privacy notice

I may update this privacy notice from time to time if the way Cotton Lily collects or uses personal information changes.

The date at the top of this page will show when the notice was last updated.