Privacy policy

Last updated: 2 November 2026

Stone & Ivy ("we", "us") operates this online store and website, which run on Shopify. This privacy policy explains how we collect, use and share your personal data when you visit our website, buy from us or contact us. If this policy conflicts with our Terms of Service, this policy prevails in relation to your personal data.

Personal data we collect or process

  • Contact details: name, billing and delivery address, phone number and email address.
  • Payment details: transaction and payment confirmation data. Card and account details are handled by our payment providers.
  • Account details: username, password, security questions and preferences.
  • Transaction details: products you view, add to your basket or wishlist, buy, return, exchange or cancel.
  • Communications: the content of messages you send us, such as customer service enquiries.
  • Device details: device, browser, network connection, IP address and unique identifiers.
  • Usage details: how and when you use our website.

Where we get personal data from

  • Directly from you.
  • Automatically through our website, including through cookies and similar technologies.
  • From our service providers.
  • From our partners or other third parties.

How we use your personal data

  • To provide and improve our services: processing orders, payments, delivery, returns and reviews, and showing relevant products (legal basis: performance of a contract and our legitimate interests).
  • Marketing and advertising: sending marketing by email or other channels and showing online adverts based on your purchases and activity (legal basis: your consent or our legitimate interests, as required by law).
  • Security and fraud prevention: protecting our store and verifying accounts (legal basis: our legitimate interests and legal obligations).
  • Communicating with you: customer support and service messages (legal basis: performance of a contract and our legitimate interests).
  • Legal purposes: complying with the law, responding to lawful requests and enforcing our terms (legal basis: legal obligation and our legitimate interests).

How we share personal data

  • With Shopify and with suppliers and service providers who help us run our business, such as IT, payments (e.g. card payment providers), analytics, customer support, cloud storage, order fulfilment and delivery.
  • With business and marketing partners to deliver adverts. Shopify may enable personalised adverts across other retailers and websites. You can opt out by contacting us.
  • With third parties when you ask us to or give your consent, such as social media or login integrations.
  • With our affiliates or group companies.
  • In connection with a business transaction such as a merger or insolvency, to comply with the law, or to protect our rights and the rights of others.

Our relationship with Shopify

Shopify hosts our store and processes personal data about your access to and use of it. Your data may be transferred to Shopify and to third parties in other countries. Where you use Shopify's own features (for example the Shop app or Shop Pay), Shopify acts as an independent controller. See Shopify's privacy policy for more information.

Third-party websites and links

Our website may link to websites run by third parties. We do not control them and their own privacy policies apply. We are not responsible for their accuracy or security. Information you share publicly, including on social media, may be visible to others.

Children's data

Our services are not intended for children and we do not knowingly collect personal data from anyone under the age of 16. If you are a parent or guardian and believe your child has given us personal data, please contact us and we will delete it. We have no knowledge of selling or sharing the personal data of anyone under 16.

Security and retention

We use appropriate measures to protect your personal data, but no method of transmission or storage is completely secure. Please do not send sensitive information through insecure channels. We keep personal data only for as long as needed to maintain your account, provide our services, meet legal and accounting obligations, resolve disputes and enforce our agreements.

Your rights and choices

Under UK data protection law (UK GDPR and the Data Protection Act 2018) you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data deleted;
  • receive your data in a portable format;
  • object to processing, including for direct marketing;
  • restrict processing;
  • withdraw your consent at any time, where processing is based on consent.

We honour Global Privacy Control signals as an opt-out request for that browser and device. You can unsubscribe from marketing emails at any time using the link in the email; you will still receive order-related messages. We may need to verify your identity before acting on a request. An authorised agent may make a request on your behalf with proof of authority. We will not treat you differently for exercising your rights.

Complaints

If you have a complaint, please contact us first. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

International transfers

Your personal data may be transferred to, stored and processed in countries outside the UK. Where this happens, we rely on recognised safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses, unless the country has been found to provide adequate protection.

Changes to this policy

We may update this policy from time to time. We will post the updated version on this page, change the "Last updated" date and give notice where required by law.

Contact

  • Data controller: IVY AND STONE LTD (company number 12487648), trading as Stone & Ivy
  • Email: hello@stoneandivy.co.uk
  • Phone: +44 7911 223709
  • Address: 1st And 2nd Floor, 2 West Street, Ware, Hertfordshire, England, SG12 9EE, United Kingdom