Privacy policy

Quillet&Co ("we", "us", "our") operates this store and website to provide you with a curated shopping experience, trade sourcing, and affiliate recommendations (the "Services"). Quillet&Co is the Data Controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Our Services are hosted on Shopify, which provides the underlying e-commerce platform. This Privacy Policy describes how we collect, use, process, and disclose your personal information when you visit our website, request a quote, make a purchase, or communicate with us.

If you have any questions regarding this policy or wish to exercise your data protection rights, please contact us by email at enquiries@quilletandco.com

1. Personal Information We Collect

We collect information that identifies or can reasonably be linked to you ("Personal Data"). This includes:

• Contact Details: Name, billing address, delivery address, phone number, and email address.
• Financial & Transaction Details: Payment card details, transaction confirmations, and preferred payment methods (processed securely via our third-party payment providers).
• Trade & Supplier Details: Order specifications, project requirements, delivery postcodes, and (where you are an independent maker, vendor, or trade supplier) business name, contact details, and bank information necessary for payment settlement.
• Account & Communication Details: Order history, customer support messages, wishlist items, and shopping preferences.
• Technical & Device Information: IP address, browser type, internet service provider, time zone, referring/exit pages, and interaction details collected automatically via cookies, log files, pixels, and web beacons.

1. How We Collect Data & Tracking Technologies

We collect data directly from you during order checkout, inquiry forms, trade account applications, and newsletter sign-ups. Automatically collected technical data relies on:

• Cookies: Small data files stored on your device that retain preferences and track navigation.
• Log Files & Pixels: Server records and electronic tags that log site activity, browser specifications, and referral sources to optimize store performance and monitor marketing campaigns.

1. Legal Bases for Processing Your Data

Under UK GDPR, we only process your personal information when we have a valid legal ground to do so:

• Performance of a Contract: Processing your order, handling payments, fulfilling deliveries, requesting quotes from trade suppliers on your behalf, paying brand partners or makers, and managing customer support inquiries.
• Legitimate Interests: Monitoring store performance, preventing fraud, maintaining site security, and conducting general business analytics to improve our Services.
• Consent: Sending direct email marketing communications, passing specific trade inquiries to third parties at your explicit request, and placing non-essential cookies on your device. You may withdraw consent at any time.
• Legal Obligation: Maintaining transactional records for UK tax compliance (HMRC) or responding to valid legal requests.

1. How We Share & Disclose Personal Information

We do not sell your personal data. We disclose information only to essential service providers, suppliers, and partners who process data on our behalf:

• Shopify & Operational Vendors: Shopify hosts our storefront, order management, and core administrative database. We also share data with IT, hosting, and operational tools.
• Direct Merchants & Dropship Partners: Where items are dispatched directly from independent makers, workshops, or drop-ship partners, we share relevant delivery details (name, shipping address, and phone number) strictly to enable order fulfilment. • Trade Suppliers & Independent Makers: When you ask us to obtain manual quotes, bespoke estimations, or procurement details on your behalf, we share necessary order specifications and location details with relevant trade suppliers. 
• Payment Processors: Transaction data is transmitted directly to payment gateways (e.g., Shopify Payments, Stripe, PayPal) to process payments securely.
• Marketing & Analytics Partners: Where you have consented to tracking cookies, we share online usage activity with marketing platforms to measure performance and deliver relevant advertisements.

1. Outbound Links & Affiliate Disclosure

Our website and communications contain outgoing links to third-party websites, brand partners, and curated product recommendations. Some of these links are affiliate links, meaning we may earn a small commission if you click through and make a purchase on the merchant's site.

Please note that once you click an outbound link and leave our website, this Privacy Policy no longer applies. Third-party sites operated by merchants or affiliate networks operate under their own privacy policies and cookie practices. We strongly recommend reviewing the privacy policies of any third-party websites you visit.

1. International Data Transfers

Your information may be transferred to, stored, and processed outside the UK, including in Canada and the United States, where Shopify's primary servers and sub-processors reside. Whenever we transfer personal data out of the UK, we ensure equivalent protections are maintained using recognised statutory mechanisms, such as:

• Transfers to countries deemed "adequate" by the UK Government (e.g., Canada).
• The UK International Data Transfer Agreement (IDTA) or UK Addendumto the EU Standard Contractual Clauses.
• Certified data transfer frameworks (such as the UK Extension to the EU-US Data Privacy Framework).

1. Data Retention, Security & Age Eligibility

We retain billing, vendor, and transaction records for 6 years from the end of the financial year to comply with UK tax (HMRC) requirements. Other personal data (such as marketing subscribers) is retained only for as long as you use our Services or until you withdraw consent.

We implement appropriate technical and organizational security measures—including password protection, multi-factor authentication (MFA), and restricted administrative access—to protect your personal data from unauthorized access or loss.

Our Website and Services are intended solely for individuals aged 18 and over. We do not knowingly collect personal data from minors.

1. Your Rights Under UK GDPR

As a UK resident, you hold specific legal rights regarding your personal data:

• Right of Access (SAR): The right to request a copy of the personal data we hold about you.
• Right to Rectification: The right to ask us to update or correct inaccurate data.
• Right to Erasure ("Right to be Forgotten"): The right to request that we delete your personal information, subject to statutory retention exceptions.
• Right to Restrict Processing: The right to request that we restrict the processing of your personal data in certain circumstances.
• Right to Data Portability: The right to receive your personal data in a structured, machine-readable format or have it transferred to another controller.
• Right to Object: The right to object at any time to processing based on legitimate interests or direct marketing profiling.
• Right Regarding Automated Decision-Making: The right not to be subject to a decision based solely on automated processing or profiling that produces legal effects. • Right to Withdraw Consent: The right to withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please email us at studio@studioquillet.com. We will respond to valid requests within one calendar month.

1. Complaints & Regulatory Authority

If you have concerns about how we handle your data, please contact us first so we can resolve the issue. If you remain unsatisfied, you have the right to lodge a complaint with the UK data protection supervisory authority:

Information Commissioner’s Office (ICO)
Website: https://ico.org.uk Helpline: 0303 123 1113

1. Contact Information

Quillet&Co email: enquiries@quilletandco.com 
Contact Form: Via the contact page on our official website.

Last updated: 1st October 2026