Privacy policy

Last updated : [CONFIRM : RGP-08 · date de version de la politique de confidentialité]

This policy explains what personal data we collect when you visit our website or buy from us, why we use it, who we share it with, and the choices and rights you have. We've tried to keep it plain and specific.

1. Who we are

The controller of your personal data is [CONFIRM : ENT-01 · raison sociale ou nom du commerçant], trading as Arc & Story, [CONFIRM : ENT-04 · adresse géographique au Royaume-Uni]. ICO registration number: [CONFIRM : ENT-06 · numéro d'enregistrement auprès de l'ICO (data protection fee payé)].

2. How to contact us about your data

Email [CONFIRM : RGP-01 · adresse e-mail dédiée aux questions de données personnelles, ou adresse du service client] or write to us at the address above.

3. What we collect

When you order - Your name, email address, phone number, billing and delivery addresses. - What you ordered, the price, the delivery date you chose and any note you add. - Payment confirmation. Your card details are handled by our payment providers; we never see or store your full card number.

When you contact us - What you tell us by email, phone, WhatsApp or the contact form, and the photos or videos you send (for example of a damaged chair).

When you browse - Information about your device and how you use our website (pages viewed, basket activity, approximate location from your IP address), collected through cookies and similar technologies, as explained in section 12.

If you choose to - Your email address for our newsletter. [CONFIRM : RGP-06 · newsletter ou e-mails marketing prévus, outil d'envoi, soft opt-in clients] - A review of your chair. [CONFIRM : AVI-01 · application d'avis, calendrier des demandes après livraison, règle de modération] - Your answers to a short question after your order, such as who the chair is for. [CONFIRM : RGP-09 · question post-achat mise en place, outil utilisé]

4. Information about your health or pregnancy

We don't ask for your due date or any information about your health, and you don't need to give it to buy from us. When you choose a delivery date, we only record the date.

If you mention a pregnancy or a health matter in a message to us, we'll use it only to answer that message and won't use it for anything else. [CONFIRM : RGP-10 · durée de conservation des messages du service client]

5. Why we use your data, and our lawful basis

| What we do | Data used | Lawful basis (UK GDPR) | |---|---|---| | Process, deliver and support your order, including returns and faults | Order and contact details | Performance of our contract with you | | Answer your questions and complaints | Messages and the details you give | Our legitimate interest in helping you, or contract if it's about an order | | Keep accounting and tax records, and meet consumer law duties | Order and payment records | Legal obligation | | Prevent fraud and keep the website secure | Order, device and payment information | Our legitimate interest in protecting our customers and our business | | Send you our newsletter or offers | Email address | Your consent, or, for customers, our legitimate interest in telling you about similar products, with an easy way to opt out (PECR "soft opt-in") [CONFIRM : RGP-06 · newsletter ou e-mails marketing prévus, outil d'envoi, soft opt-in clients] | | Ask for and publish reviews | Name or initials, order, review content | Our legitimate interest in showing honest reviews | | Measure and improve the website and our advertising | Cookie and device data | Your consent (section 12), except strictly necessary cookies |

6. Who we share it with

We only share what each provider needs to do its job, under a written contract.

| Who | Why | [CONFIRM : RGP-02 · liste réelle des prestataires et applications installés] | |---|---|---| | Shopify | Runs our online shop, checkout and order records | | | Payment providers | Take your payment securely | [CONFIRM : PAY-01 · moyens de paiement acceptés] | | Instalment provider | If you choose to pay in instalments | [CONFIRM : PAY-02 · Klarna ou Clearpay] | | Delivery company | Delivers your chair and sends tracking updates | [CONFIRM : LIV-06 · transporteur] | | Email service | Sends order emails and, if you agreed, our newsletter | [CONFIRM : RGP-06 · outil d'envoi] | | Reviews service | Collects and publishes verified reviews | [CONFIRM : AVI-01 · application d'avis] | | Google | Measures visits and our adverts (only with your consent) | [CONFIRM : RGP-07 · Google Analytics, balises Google Ads, Mode Consentement] | | Messaging service | If you contact us on WhatsApp | [CONFIRM : SAV-02 · téléphone ou WhatsApp] |

We may also share data when the law requires it, or with professional advisers. We never sell your personal data.

If you pay with an option that has its own account (for example a digital wallet or an instalment provider), that company also uses your data under its own privacy policy.

7. Transfers outside the UK

Some of our providers store or access data outside the UK. When they do, we make sure it's protected by UK adequacy regulations or by approved safeguards such as the UK International Data Transfer Agreement or Addendum. [CONFIRM : RGP-03 · pays de traitement de chaque prestataire et garanties de transfert utilisées]

8. How long we keep it

| Data | How long | |---|---| | Orders, invoices and payment records | [CONFIRM : RGP-04 · durées de conservation par catégorie, selon les obligations fiscales et comptables] | | Customer service messages | [CONFIRM : RGP-10 · durée de conservation des messages du service client] | | Newsletter subscription | Until you unsubscribe | | Cookies | See section 12 |

9. Your rights

You have the right to: - access the personal data we hold about you; - correct it if it's wrong or incomplete; - delete it, in some circumstances; - restrict how we use it, in some circumstances; - object to how we use it, including at any time to direct marketing; - receive it in a portable format, or have it sent to another organisation; - withdraw your consent at any time, where we rely on consent. This doesn't affect what we did before.

To use any of these rights, contact us (section 2). We'll reply within one month. If your request is complex, we may need longer and will tell you why. We don't charge a fee in most cases.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Our checkout uses automated fraud checks; if an order is held, a person reviews it. [CONFIRM : RGP-11 · analyse de fraude Shopify activée, revue manuelle des commandes signalées]

10. Complaints

If you're unhappy with how we've handled your data, please tell us first so we can try to put it right. You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk.

11. Keeping your data safe

Our website uses an encrypted connection (HTTPS). Access to customer data is limited to the people who need it to help you, and our providers are bound by contract to protect it.

12. Cookies

What they are

Cookies are small files stored on your device when you visit a website. Some are needed for the shop to work. Others help us understand how the site is used or measure our adverts. We only use those with your consent.

Your choice

When you first visit, a banner lets you accept or refuse non-essential cookies. Refusing is as easy as accepting. You can change your mind at any time with the Cookie settings link at the bottom of every page, or by clearing cookies in your browser.

The cookies we use

| Category | What for | Needs your consent? | |---|---|---| | Strictly necessary | Your basket, checkout, security, remembering your cookie choice | No | | Preferences | Remembering choices such as your region | Yes | | Analytics | Counting visits and seeing which pages help | Yes [CONFIRM : RGP-07 · Google Analytics, balises Google Ads, Mode Consentement] | | Marketing | Measuring whether our adverts lead to orders, and showing our adverts on other sites | Yes [CONFIRM : RGP-07 · Google Analytics, balises Google Ads, Mode Consentement] |

[CONFIRM : RGP-05 · outil de bannière de cookies (paramètres de confidentialité client Shopify ou application), liste réelle des cookies avec nom, fournisseur, finalité et durée, issue d'un scan du site publié]

Exemples de noms de cookies à vérifier par le scan, ne pas publier sans contrôle : _tracking_consent, cart, _shopify_y, _shopify_s (Shopify) ; _ga (Google Analytics) ; _gcl_au (Google Ads).

13. Children

Our website is for adults. We don't knowingly collect personal data from children, and we don't ask for any information about your baby.

14. Changes to this policy

If we change how we use your data, we'll update this page and the date at the top. If the change is significant, we'll tell you by email or on the website.