Privacy Policy

Last updated: 9 July 2026

Your trust matters, especially when your order is as personal as your dog. Canine Keepsakes (Oliver Irwin trading as Canine Keepsakes) is the data controller, and we handle your data under UK GDPR and the Data Protection Act 2018. Questions: caninekeepsakes.admin@gmail.com.

What we collect

  • Your account: email and a securely hashed password.
  • Your orders: name, email, delivery address, and what you ordered.
  • Payments: taken by PayPal — we receive only confirmation and the amount, never card details.
  • Custom artwork: the photo you upload, your dog's name and breed, chosen design, notes, and payment confirmation.
  • Creators: submitted designs, display name, PayPal payout details.
  • Technical basics: e.g. IP address, via our hosting and security providers.
  • Messages: anything you email us and our replies.

Why we use it, and the lawful basis

We rely on performing our contract with you to run your account, process and deliver orders, create Custom Artwork, pay Creators, and send order/preview updates; on our legitimate interests in a secure, fraud-free shop and in understanding how our site performs (via cookieless Cloudflare Web Analytics that doesn't identify you); on our legal obligations for tax and accounting records; and on your consent for anything optional such as marketing, testimonials, or using your dog's photo publicly. You can withdraw consent at any time. We don't profile you for advertising and never sell your data.

Automated decisions

We do not make solely automated decisions that produce legal or similarly significant effects on you.

Who we share it with

Processors (act on our instructions):

  • Gelato — prints and ships your order (receives your name and delivery address).
  • Supabase — secure database, logins and private artwork storage (hosted in the EU).
  • Netlify — website hosting.
  • Cloudflare — content delivery, security, image/file storage, and privacy-friendly website analytics (Cloudflare Web Analytics) that uses no cookies and doesn't identify you.
  • Resend — sends order and account emails.

Independent controllers (decide their own processing for their service):

  • PayPal — processes your payment and any creator payout under its own terms and privacy policy.

International transfers

Where a provider processes data outside the UK, that transfer is protected by UK adequacy regulations, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or another lawful safeguard recognised under UK GDPR, depending on the provider.

How long we keep it

Account details while your account is active; order and payment records for about six years for tax and accounting, then deleted or anonymised; Custom Artwork photos and details only as long as needed to complete your order and support it, and no longer than 12 months after your order unless you ask us to delete them sooner.

Your rights

You can ask to see the data we hold (access), correct mistakes (rectification), ask us to delete it (erasure, where we're not legally required to keep it), limit or object to certain uses, and receive your data in a portable format. Email caninekeepsakes.admin@gmail.com and we'll respond within one month. If you're unhappy with how we've handled your data you can contact the Information Commissioner's Office at ico.org.uk — though we'd always rather put it right first.

Keeping your data safe

We protect your data with encryption in transit, encryption at rest where our providers support it, hashed passwords, least-privilege access, multi-factor authentication on our admin tools, and regular updates. No online service is ever completely secure, but we take it seriously and will notify you and the regulator of any serious breach where the law requires.

Children

The shop is for adults; we don't knowingly collect children's data. Tell us if you think we have, and we'll delete it.

Cookies

We use only the storage the shop needs — see our Cookie Policy.

Changes

If we change this policy we'll update the date above.