Privacy Policy
Last updated: 30 September 2026
Under the UK GDPR we need a lawful basis for everything we do with your data. There are six in the legislation; we rely on four.
So this policy is organised by those four. Under each one: what we hold on that basis, why, how long, and — where the basis is one you can push back on — how to do that.
It's an unusual way to set out a privacy notice, and it has one advantage. A policy arranged by data type can list everything it collects and still never say what entitles it to. This one can't dodge that question, because the answer is the heading.
Snugleigh LTD is the data controller. We process personal data under the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.
We do not sell personal data, and we do not rent, swap or supply our customer list to anyone for their own marketing.
| Controller | Snugleigh LTD |
| Address | King Street, Huddersfield HD1 2QB, United Kingdom |
| support@snugleigh.com | |
| Phone | +44 1484 542777 |
| Customer service | Monday to Friday, 9:00 am–5:00 pm UK time. Saturday and Sunday closed. |
| Privacy enquiries | support@snugleigh.com, subject line "Privacy request" |
Our shop runs on a third-party e-commerce platform that processes certain data on our instructions. The responsibility to you sits with us.
Basis one — Performance of a contract
Article 6(1)(b). Data we cannot complete your order without.
| What | Why | How long |
|---|---|---|
| Name, delivery address, billing address, email, phone number | To take payment, pack the right thing and get it to the right door | 6 years — see basis two |
| Items ordered, order number, order value, delivery, return and refund history | To fulfil the order and deal with anything that follows from it | 6 years — see basis two |
| Your emails and calls to us about an order | To answer you, and to run a carrier or warranty claim on your behalf | 2 years after the matter closes; 6 years for fault and complaint files, because a Consumer Rights Act claim can be brought that long after delivery |
| Your account, if you create one | To show you your order history and save you retyping your address | Until you ask us to close it |
If you don't give us this, we can't sell you anything. There's no consent to withdraw here and no balancing test to run — without a delivery address there is no delivery.
You don't need an account. Guest checkout works, and we don't hold anything extra from people who use it.
Basis two — Legal obligation
Article 6(1)(c). Data we keep because we'd be breaking the law if we didn't.
| What | Why | How long |
|---|---|---|
| Order and transaction records — what was sold, for how much, to whom, and what VAT was charged | HMRC record-keeping for VAT and company accounts | 6 years from the end of the accounting period |
| Your cookie choices | So we can show we honoured what you chose | 12 months, then we ask again |
Six years is not our choice, and an erasure request cannot shorten it. If you ask us to delete your data we will delete everything we're not required to keep — but the accounting record stays for its six years. That's the one part of this policy where "no" is the honest answer.
Basis three — Consent
Article 6(1)(a). Things that only happen because you actively said yes.
| What | Why | How long |
|---|---|---|
| Your email address on our marketing list | To send you what you asked for | Until you unsubscribe |
| Analytics cookies and the browsing data they collect | To see what works on the site and what doesn't | 26 months |
| Marketing cookies and the advertising identifiers they set | Advertising measurement and remarketing | 26 months |
| A review you post, with the display name you chose and any photographs | To publish it on the product page | Until you ask us to remove it |
Consent must be a real choice, and you can withdraw it at any time. Withdrawing has no effect on anything already done lawfully before you withdrew, and it doesn't affect your order — none of the above is a condition of buying from us.
When you unsubscribe we keep your email address on a suppression list. That isn't defiance; it's the only reliable way to make sure you aren't added back by accident.
Basis four — Legitimate interests
Article 6(1)(f). The basis that requires us to weigh our interest against yours — so here is the weighing, not just the assertion.
| What | Our interest | Why it doesn't override yours | How long |
|---|---|---|---|
| Server logs and IP addresses tied to security events | Keeping the shop from being attacked or defrauded | Minimal data, never used to market to you, never shared for anyone else's purposes | 90 days |
| Fraud screening at checkout | Not shipping goods bought with a stolen card | Runs on the transaction only; a person makes every decision to cancel an order | With the order record |
| Basic, non-identifying measurement of whether pages load and work | Knowing the checkout is broken before you tell us | No profiling, no advertising use, and it's the minimum needed to run a shop | 26 months |
| Post-purchase marketing to existing customers about similar products | Telling people who bought a blanket that we sell more blankets | Permitted by the PECR soft opt-in, and every message carries a one-click unsubscribe | Until you opt out |
You have the right to object to any of these, and to direct marketing you can object absolutely — there is nothing for us to weigh, we simply stop. Email us with "Privacy request" in the subject line.
Who else sees your data
The e-commerce platform — effectively everything above; it is the shop. Processes on our instructions.
The payment processor — your card details, entered directly into their form, plus the amount and order reference. They are a controller in their own right for their regulatory obligations. What comes back to us is a confirmation, the card type and the last four digits. The card number never enters our systems, so our customer service team cannot see it, retrieve it, or ask you for it.
Whoever packs and dispatches your order — recipient name, address, phone where the carrier needs it, and the items. For part of our range that is a fulfilment partner rather than a warehouse of our own.
The carrier — name, delivery address, and your email or mobile if you want delivery notifications. Controllers of their own tracking and notification services.
Our email provider — your address and the content of what we send each other.
Analytics and advertising providers — pages viewed, products looked at, whether you bought. Only if you accepted the relevant cookies. Advertising platforms are controllers for their own use of it.
Our accountant — the transaction records, under professional confidentiality.
HMRC, the ICO, courts and law enforcement — what we are legally obliged to provide and no more. We check that a request is lawfully made before disclosing anything.
A buyer of the business — if we are sold or merge, customer records move with the obligations attached to them. We would tell you before your data had a new controller, and your marketing preferences would travel unchanged.
Cookies
| Category | What it does | Set before you choose? |
|---|---|---|
| Strictly necessary | Basket, checkout, login, security | Yes — the shop can't run without them, and PECR exempts them |
| Preference | Remembers settings you've chosen | No |
| Analytics | Measures visits and performance | No |
| Marketing | Advertising measurement and remarketing | No |
Nothing in the bottom three rows is set until you accept it in the banner. A browser configured to accept cookies is not consent, a pre-ticked box is not consent, and continuing to browse is not consent. That's what PECR regulation 6 requires.
Change your mind at any time by reopening the banner from the footer link. Withdrawing consent stops new cookies being set; it doesn't remove ones already on your device, which you clear in your browser settings.
Remarketing is what makes our ads follow you around other sites after a visit. It runs on marketing cookies and stops when you withdraw that consent.
We don't put directly identifying information inside a cookie.
Marketing email
Two rules exist in the UK and it matters which one applies to you.
If you ticked a box — at signup or checkout — that's consent under PECR regulation 22, and you can withdraw it at any moment.
If you've bought from us and we got your address in the course of that sale, we may email you about similar products, provided you were given the chance to refuse at the time and are given it in every message. That's the soft opt-in at PECR regulation 22(3).
Either way:
- Every marketing email has a one-click unsubscribe that works immediately. No login, no explanation.
- The right to object to direct marketing is absolute.
- Order confirmations, dispatch notices and delivery updates are not marketing. They're part of the contract and go out regardless — you can't unsubscribe from being told your parcel is on its way.
- Buying from us does not put you on the newsletter by default.
Sending data outside the UK
Some of the organisations named above are outside the United Kingdom — in the EEA, the United States, and for certain fulfilment partners, in Asia.
Where a transfer goes to a country covered by UK adequacy regulations, that covers it. Everywhere else we rely on one of:
- the International Data Transfer Agreement (IDTA), or the UK Addendum to the European Commission's standard contractual clauses; or
- for a US recipient self-certified under it, the UK Extension to the EU–US Data Privacy Framework.
In each case we carry out a transfer risk assessment and apply additional safeguards where it calls for them.
Ask which mechanism covers a particular recipient and we'll tell you. Email with "Privacy request" in the subject.
Your rights
- Be informed — which is what this document is for
- Access the personal data we hold about you, and receive a copy
- Rectify anything inaccurate or incomplete
- Erase your data, except where we're legally required to keep it
- Restrict processing while an objection or correction is resolved
- Object to processing based on legitimate interests, and absolutely to direct marketing
- Portability — the data you gave us, in a structured, machine-readable format
- Withdraw consent at any time, without affecting the lawfulness of what came before
- Not be subject to a solely automated decision with legal or similarly significant effects
How to use them
Email support@snugleigh.com with "Privacy request" in the subject line.
We verify who you are, usually by matching the email address against a previous order. We will never ask you to send us a copy of your passport or driving licence to see your own shopping history.
We respond within one month. Complex or repeated requests can be extended by a further two months, and we'll tell you inside the first month if that's happening.
It's free. We can charge a fee or refuse only where a request is manifestly unfounded or excessive, and we'd explain why in writing.
Automated decisions
We do not carry out profiling or automated decision-making that produces legal effects or similarly significant effects for you.
The checkout's fraud screening can flag an order for manual review. The decision to cancel an order is always taken by a person, and you can ask us why.
Security
The site runs over TLS throughout. Access to the order database is limited to people who need it for their job. Payments are handled by a PCI-DSS compliant processor, which is why card numbers never reach us in the first place.
No transmission over the internet is perfectly secure, and any business claiming otherwise is overselling. If a breach occurs that is likely to result in a risk to your rights and freedoms, we report it to the Information Commissioner's Office within 72 hours, and tell you directly where the risk to you is high.
Children
Our shop isn't aimed at children and we don't market to them.
Where we rely on consent to offer an online service, we do not knowingly process the data of a child under 13 without the authorisation of someone with parental responsibility — the age set by section 9 of the Data Protection Act 2018.
You must be 18 to place an order. That's a contractual requirement and a separate thing from the age above.
If you believe a child's data has reached us, tell us and we'll delete it.
Other websites
This policy covers snugleigh.com and nothing else. Follow a link away — to a carrier's tracking page, a manufacturer, a social platform — and that organisation's policy applies. We don't control their content or how they handle your data.
The same goes for third-party content embedded in our pages.
Complaints
Come to us first. Most privacy questions are something we can resolve the same week, and we'd rather fix it than read about it from a regulator.
If you're not satisfied with how we've handled it, you have the right to complain to the supervisory authority:
Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline 0303 123 1113 — ico.org.uk
Complaining to the ICO costs nothing and doesn't affect any other legal remedy available to you.
Changes to this policy
We may update this policy. The version in force is always on this page with the date at the top.
Where a change materially affects how we use your data, we tell you before it takes effect — by email if you're on our list, and on the site either way.
Continuing to use the website is not consent to anything. Consent, where we need it, is given separately and actively: in the cookie banner, or when you sign up for email. Nothing on this page asks you to agree to it.
Contact
Snugleigh LTD
Address: King Street, Huddersfield HD1 2QB, United Kingdom
Email: support@snugleigh.com
Phone: +44 1484 542777
Customer service:
Monday to Friday, 9:00 am–5:00 pm UK time.
Saturday and Sunday closed.
We reply within one working day and resolve within one month.