Privacy Policy
Last updated: 30 September 2026
The question most people actually have about a privacy policy is not what does this shop collect — it's who else ends up with it.
So this one is organised by recipient. Part 1 sets out what we hold and why. Part 2 names every category of organisation that receives any of it, what they get and what they may do with it. Part 3 says who never gets it.
Warmfell LTD is the data controller. We process personal data under the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.
We do not sell personal data, and we do not rent, swap or supply our customer list to anyone for their own marketing.
| Controller | Warmfell LTD |
| Address | Merrion Way, Leeds LS2 8NG, United Kingdom |
| support@warmfell.com | |
| Phone | +44 113 222 1283 |
| Customer service | Monday to Friday, 9:00 am–5:00 pm UK time. Saturday and Sunday closed. |
| Privacy enquiries | support@warmfell.com, subject line "Privacy request" |
Part 1 — What we hold
| What | Where it comes from | Why we have it | Lawful basis | How long we keep it |
|---|---|---|---|---|
| Name, delivery address, billing address, email, phone | You, at checkout | To fulfil your order | Performance of a contract | 6 years from the end of the financial year — HMRC record-keeping |
| Order contents, order number, order value, delivery and return history | Generated when you order | To fulfil, deliver, return and account for the order | Contract, and legal obligation for the accounting record | 6 years, as above |
| Payment confirmation, card type, last four digits | Our payment processor | To confirm payment and investigate disputes | Contract; legitimate interests in fraud prevention | With the order record |
| Your emails and calls to us, and photographs you send | You | To answer you and to run carrier and warranty claims | Contract; legitimate interests in running customer service | 2 years after the matter closes. Fault, complaint and warranty files 6 years, because a Consumer Rights Act claim can be brought that long after delivery |
| Email address and the fact you opted in | You, at signup or checkout | Marketing email | Consent, or the PECR soft opt-in described below | Until you unsubscribe. We then keep a suppression record indefinitely so you are not re-added by mistake |
| IP address, browser, device, operating system, pages viewed, referring page, session behaviour | Automatically, when you visit | Security, keeping the shop working, understanding what's broken | Legitimate interests for security and essential measurement; consent for analytics and advertising cookies | 26 months |
| Review text, the display name you choose, photographs you attach | You | To publish the review | Consent | Until you ask us to remove it |
| Your cookie choices | The consent banner | To honour what you chose | Legal obligation under PECR | 12 months, then we ask again |
We don't ask for anything we don't need. There's no date of birth field, no gender field, no marketing questionnaire.
Where the account record sits
If you create an account, the above is held against it. Ask us to close the account and we delete what we're not legally required to keep — the order and accounting record stays for the six years HMRC requires, and no request can shorten that. Everything else goes.
Part 2 — Who else sees it
Each block below is a category of recipient. We've said what they get rather than only that they exist.
The e-commerce platform
Gets: effectively everything in Part 1, because the shop runs on it — the order record, your account, your contact details, your browsing of the site.
Why: it is the shop. Product pages, checkout, order management and the customer database all sit there.
What they may do with it: process it on our written instructions, as our processor. They are not free to use it for their own purposes.
The payment processor
Gets: your card details, entered directly into their form, plus the amount and the order reference.
Why: to take the payment and screen it for fraud.
What they may do with it: process the payment, run fraud checks, and meet their own regulatory obligations as a payment institution — for which they are a controller in their own right, not our processor.
What we get back is a confirmation, the card type and the last four digits. The card number never enters our systems. Our customer service team cannot see it, retrieve it or repeat it back to you, and will not ask you for it by email or on the phone.
The people who pack and despatch your order
Gets: the recipient's name, delivery address, phone number where the carrier requires one, and the items ordered.
Why: somebody has to put the product in a box with your address on it. For part of our range that is a fulfilment partner or the manufacturer rather than a warehouse of our own.
What they may do with it: fulfil that order and nothing else. Some are located outside the United Kingdom — see Sending data abroad below.
The carrier
Gets: recipient name, delivery address, and your email or mobile number where you've asked for delivery notifications.
Why: to deliver the parcel and to tell you where it is.
What they may do with it: deliver, attempt redelivery, hold at a depot or access point, and handle a claim if the parcel is lost or damaged. Carriers are controllers of their own tracking and notification services.
Our email provider
Gets: your email address, your name, and the content of what you send us and we send you.
Why: order confirmations, dispatch notices, replies from customer service, and the newsletter if you're on it.
What they may do with it: deliver and store the mail on our instructions, as our processor.
Analytics providers
Gets: pages viewed, time on page, device and browser, approximate location from your IP address, and how you arrived.
Why: to see what's working on the site and what isn't.
What they may do with it: produce reports for us, and — depending on the provider — use the data to improve their own service in aggregated form.
These run only if you accept statistics cookies. Decline, and they don't load.
Advertising platforms
Gets: an identifier for your browser or device, the pages and products you looked at, and whether you completed a purchase. Where a platform supports it, a hashed version of your email address may be used to match you to an existing account of theirs.
Why: to measure whether our advertising works and to show you our ads on other sites.
What they may do with it: attribute conversions, build audience segments, and — as controllers in their own right — use it within their own advertising products in ways set out in their own policies.
This is the category most people mean when they ask who gets their data. It runs only on marketing cookies, only after you accept them in the banner, and it stops when you withdraw that consent.
Our accountant and professional advisers
Gets: the transaction record. Invoices, order values, refunds.
Why: to prepare accounts and VAT returns.
What they may do with it: exactly that, under professional confidentiality obligations.
HMRC, the ICO, courts and law enforcement
Gets: whatever we are legally obliged to provide, and no more.
Why: because the law requires it.
What they may do with it: whatever their statutory powers permit. We don't hand data to anyone in this category on request alone — we check that the request is lawful and properly made, and we push back where it isn't.
A buyer of the business
Gets: customer records, if we are ever sold, merged or restructured.
Why: the business and its obligations to you move together; you can't be sold a going concern without the orders it has to deliver.
What they may do with it: they take on our obligations under this policy. We would tell you before your data moved to a new controller, and your right to object to marketing would travel with you unchanged.
Part 3 — Who never sees it
Data brokers, list brokers and audience marketplaces. We have never sold, rented or exchanged customer data and we don't intend to. There is no arrangement under which your details are passed to another business to market to you.
Other retailers. Your email address does not appear in anyone else's newsletter because you bought from us.
Our own staff, for your card number. Nobody here has ever seen it.
Anyone at all, for a special category of data. We don't collect health, religious, political, biometric, genetic, sexual-orientation or trade-union data, and we ask you not to send it to us. If you tell us about a health condition because it bears on how you'll use a heater, we deal with your question and don't file it against your record.
Marketing email, and the rule that applies to you
Two different rules exist in the UK and it matters which one you're under.
If you ticked the box — signup form, checkout, or a landing page — that's consent under PECR regulation 22. You can withdraw it at any moment.
If you bought something from us and we obtained your address in the course of that sale, we may send you marketing about similar products, provided we gave you the chance to refuse at the time and give you that chance in every message. This is the soft opt-in at PECR regulation 22(3), and it's the basis on which most of our post-purchase email goes out.
Either way:
- Every marketing email has a one-click unsubscribe. It takes effect immediately, and you don't have to log in or explain yourself.
- The right to object to direct marketing is absolute. There's nothing for us to weigh; we stop.
- Order confirmations, dispatch notices and delivery updates are not marketing. They're part of the contract and they go out regardless of your marketing preferences. You can't unsubscribe from being told your parcel is on its way.
- Buying from us does not put you on the newsletter by default.
Cookies
| Category | What it does | Set before you choose? |
|---|---|---|
| Strictly necessary | Basket, checkout, login, security, load balancing | Yes — the shop cannot function without them, and PECR exempts them |
| Preference | Remembers settings you've chosen | No |
| Statistics | Measures visits and performance | No |
| Marketing | Advertising measurement and remarketing | No |
Nothing in the bottom three rows is set until you accept it in the banner. That's what PECR regulation 6 requires, and a pre-ticked box or a "by continuing to browse you agree" bar does not count as consent. Neither does this page.
Change your mind at any time by reopening the banner from the link in the footer. Withdrawing consent stops new cookies being set; it does not delete cookies already on your device, which you remove through your browser settings.
Remarketing is what makes our ads follow you around other sites after you've visited us. It runs on marketing cookies and stops when you withdraw that consent.
We don't put directly identifying information inside a cookie.
Sending data abroad
Some of the organisations in Part 2 are outside the United Kingdom — in the EEA, the United States, and in the case of certain fulfilment partners, in Asia.
Where a transfer goes to a country the UK government has found adequate, the adequacy decision covers it. Everywhere else we rely on one of:
- the International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses; or
- for a US recipient self-certified under it, the UK Extension to the EU–US Data Privacy Framework.
In each case we carry out a transfer risk assessment and apply additional safeguards where the assessment calls for them.
Ask us which mechanism covers a particular recipient and we'll tell you. That is a real offer, not a formula — email us with the subject line "Privacy request".
Your rights
Under the UK GDPR you have the right to:
- Be told what we do with your data — which is what this document is for
- Access the personal data we hold about you, and receive a copy
- Rectify anything inaccurate or incomplete
- Erase your data, except where we're legally required to keep it
- Restrict processing while an objection or a correction is being resolved
- Object to processing based on legitimate interests — and absolutely, with no balancing exercise, to direct marketing
- Portability — receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller
- Withdraw consent at any time, without affecting the lawfulness of what was done before you withdrew it
- Not be subject to a solely automated decision with legal or similarly significant effects
How to use them
Email support@warmfell.com with "Privacy request" in the subject line.
We'll verify who you are — usually by matching the email address against a previous order, which means we rarely need to ask for anything more. We will never ask you to send us a copy of your passport or driving licence to access your own shopping history.
We respond within one month. If the request is complex or you've made several, we can extend by a further two months, and we'll tell you inside the first month if that's happening.
It's free. We can charge a reasonable fee or refuse only where a request is manifestly unfounded or excessive, and we'd explain why in writing.
Automated decisions
We do not carry out profiling or automated decision-making that produces legal effects or similarly significant effects for you.
The checkout's fraud screening can flag an order for manual review. The decision to cancel an order is always taken by a person, and you can ask us why.
Security
The site runs over TLS throughout. Access to the order database is limited to people who need it to do their job. Payments are handled by a PCI-DSS compliant processor, which is why card numbers never reach us in the first place.
No transmission over the internet is perfectly secure, and any business that tells you otherwise is overselling. If a breach occurs that is likely to result in a risk to your rights and freedoms, we report it to the Information Commissioner's Office within 72 hours, and we tell you directly where the risk to you is high.
Children
Our shop is not aimed at children and we don't market to them.
Where we rely on consent to offer an online service, we do not knowingly process the data of a child under 13 without the authorisation of a person with parental responsibility — the age set by section 9 of the Data Protection Act 2018.
You must be 18 to place an order. If you believe a child's data has reached us, tell us and we'll delete it.
Other websites
This policy covers warmfell.com and nothing else. Follow a link away from our site — to a carrier's tracking page, a manufacturer, a social platform — and that organisation's policy applies. We don't control their content or how they handle your data, and we're not responsible for either.
The same goes for third-party content embedded in our pages.
Complaints
Come to us first. Most privacy questions turn out to be something we can resolve the same week, and we'd rather fix it than read about it from a regulator.
If you're not satisfied with how we've handled it, you have the right to complain to the supervisory authority:
Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline 0303 123 1113 — ico.org.uk
Complaining to the ICO doesn't cost anything and doesn't affect any other legal remedy available to you.
Changes to this policy
We may update this policy. The version in force is always on this page, with the last-updated date at the top.
Where a change materially affects how we use your data, we tell you before it takes effect — by email if you're on our list, and on the site either way.
Continuing to use the website is not consent to anything. Consent, where we need it, is given separately and explicitly: in the cookie banner, or when you sign up for email. Nothing on this page asks you to agree to it, and nothing about browsing the shop signs you up to it.
Contact
Warmfell LTD
Address: Merrion Way, Leeds LS2 8NG, United Kingdom
Email: support@warmfell.com
Phone Number: +44 113 222 1283
Customer service: Monday to Friday, 9:00 am–5:00 pm UK time.
Saturday and Sunday closed.
Response time: We reply within 2 working days.