Privacy at a glance
- We use personal information to fulfil orders, provide repairs, operate accounts, manage returns and provide support.
- We do not sell personal information.
- Marketing emails are sent only where an appropriate marketing permission applies, and every campaign includes an unsubscribe option.
- Payment card information is handled by payment providers rather than stored in full on our website.
- You can contact us to exercise your data protection rights.
1. Who we are and how to contact us
Sunny's Workshop is an independent UK business and is the data controller for the personal information described in this policy, except where another organisation acts as an independent controller for its own service.
Data controller: Sunny's Workshop
Email: support@sunnysworkshop.co.uk
Website: sunnysworkshop.co.uk
Correspondence address: shown on order or repair documentation and available by contacting us.
2. Personal information we collect
Depending on how you use our website and services, we may collect:
- Identity information, such as your name, username and customer reference.
- Contact information, such as your email address, telephone number, billing address and delivery address.
- Account information, including password hashes, account status and login/session information.
- Order and transaction information, including products, prices, discounts, delivery details, payment status, refunds and order history.
- Repair information, including device details, reported faults, diagnostic notes, approval decisions, photographs, repair history, tracking and return information.
- Returns information, including the reason for return, selected items, supporting photographs, sender address, tracking and outcome.
- Custom-order content, such as names, photographs, artwork, wording and instructions supplied for 3D printed or sublimation products.
- Communications, including contact-form messages, emails and customer-service records.
- Marketing information, including subscriber name and email, confirmation status, consent or sign-up date, unsubscribe status, campaign delivery status and suppression records.
- Technical information, such as IP address, browser/device information, server logs and security events.
Payment providers may collect payment-card, bank or digital-wallet information. We do not store full payment-card details on our own website.
3. Where we obtain personal information
Most information is provided directly by you when you register, place an order, submit a repair or return, subscribe to email updates, contact us or provide custom content.
We may also receive information from:
- Payment providers when they confirm a payment, refund or failed transaction.
- Royal Mail and other delivery providers in connection with labels, tracking and delivery events.
- Website hosting, security and email systems through technical logs and delivery reports.
- Marketplaces or sales channels where you buy from us through that service.
4. Why we use personal information and our lawful bases
Contract
We use information where necessary to take steps at your request or perform a contract, including creating accounts, processing orders, taking payment, delivering goods, providing repairs, handling returns and communicating service updates.
Legal obligation
We use and retain information where necessary to meet tax, accounting, consumer-protection, fraud-prevention and other legal obligations.
Legitimate interests
We may use information where necessary for our legitimate interests, provided those interests are not overridden by your rights. These interests include securing our website, preventing fraud, maintaining business records, improving services, handling disputes and responding to enquiries.
Consent
We rely on consent where you actively subscribe to optional marketing communications or where consent is otherwise the appropriate lawful basis. You can withdraw consent at any time, although this does not affect processing that took place before withdrawal.
Legal claims and vital interests
Where necessary, information may be used to establish, exercise or defend legal claims, or to protect someone's vital interests in an emergency.
6. International transfers
Some service providers may process or store information outside the United Kingdom. Where UK data protection law requires safeguards, we use providers or transfer mechanisms designed to protect the information, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard.
You may contact us for more information about the safeguards relevant to your information.
7. How long we retain information
We retain information only for as long as reasonably necessary for the purpose collected, including legal, accounting, warranty, security and dispute-resolution requirements. Our usual approach is:
- Orders, invoices, payments and refunds: normally up to six years after the end of the relevant accounting period, or longer where legally required.
- Customer accounts: while the account is active and afterwards where records remain necessary for orders, legal obligations or disputes.
- Repair and warranty records: for the warranty period and normally up to six years where needed to manage service history or legal claims.
- Return requests and supporting evidence: while the case is active and normally up to 12 months after closure, unless required for a dispute, chargeback, fraud review or legal claim.
- General enquiries: normally up to two years after the last meaningful contact, unless linked to a transaction or dispute.
- Active marketing subscribers: until they unsubscribe or the record is no longer needed.
- Unsubscribed addresses: limited information may be kept on a suppression list for as long as necessary to ensure that the person is not contacted again.
- Pending newsletter confirmations: removed or anonymised when no longer reasonably required.
- Technical and security logs: retained for a limited period appropriate to security, troubleshooting and fraud prevention.
We may retain information longer where there is an active complaint, dispute, legal claim, regulatory requirement or law-enforcement request.
8. How we protect information
We use reasonable technical and organisational safeguards, including encrypted website connections, password hashing, access controls, restricted administrative permissions, private storage for supporting return files, security logging and reputable payment providers.
No internet or storage system is completely secure. If a personal-data breach creates a legal reporting or notification duty, we will take the steps required by applicable law.
9. Your data protection rights
Depending on the circumstances and lawful basis, you may have the right to:
- Request access to your personal information.
- Ask us to correct inaccurate or incomplete information.
- Ask us to erase information where the right applies.
- Ask us to restrict processing.
- Receive certain information in a portable format.
- Withdraw consent at any time where processing is based on consent.
- Complain to the Information Commissioner's Office.
Your right to object
You have the right to object at any time to processing of your personal information for direct marketing. You may also object to processing based on legitimate interests, although we may continue where we have compelling legitimate grounds or need the information for legal claims.
To exercise a right, contact support@sunnysworkshop.co.uk. We may need to verify your identity. Rights are not absolute, and we will explain if an exemption or limitation applies.
11. Email marketing and newsletter subscriptions
Marketing communications are separate from service messages about orders, accounts, payments, repairs, returns and security.
- Newsletter sign-ups require confirmation before becoming active.
- Registration or checkout marketing choices are optional and should not be pre-selected.
- Campaign records may show whether an email is pending, sent, failed or suppressed.
- Every marketing email includes an unsubscribe route.
- When you unsubscribe, we stop future marketing and may retain limited suppression information to respect that choice.
12. Children's information
Our website and services are not directed at children under 13. If you believe a child has provided personal information without appropriate authority, contact us so that we can investigate and take suitable action.
13. Automated decision-making
We do not currently use personal information to make decisions that produce legal or similarly significant effects solely by automated means. We may use automated checks to support fraud prevention, security and email delivery, but significant decisions are reviewed where appropriate.
14. Questions and complaints
Please contact us first if you have a privacy concern so that we can try to resolve it.
- Email: support@sunnysworkshop.co.uk
- Contact form: sunnysworkshop.co.uk/contact
You may also complain to the Information Commissioner's Office at ico.org.uk.
15. Changes to this policy
We may update this policy when our services, suppliers, systems or legal obligations change. The latest version will be published here with a revised effective date.