Privacy Policy

Last updated: 8 September 2026

1. Who we are

The data controller for this website is Yes Papa Ltd (company number 15879634, formerly Sun Supplement Limited), registered office 71-75 Shelton Street, London, WC2H 9JQ. You can contact us at sam@splash37.com or +44 7931420543.

2. What personal data we collect

Identity & contact: name, email, phone, billing/shipping address
Order & transaction: products ordered, order value, delivery status
Payment: processed by our payment provider (Stripe / Shopify Payments). We do not store your full card number, CVV, or expiry date.
Account: if you create an account, your email and password (hashed) plus order history
Communications: any messages you send us via contact forms, email, or chat
Technical & usage: IP address, browser, pages viewed, time on site, referrer (via cookies and server logs)

3. How we use your data & legal basis

Purpose	Data	UK GDPR basis
Taking and fulfilling your order	Identity, contact, order, payment	Contract (Art 6(1)(b))
Customer service & queries	Identity, contact, communications	Contract / Legitimate interests
Preventing fraud & abuse	Identity, technical	Legitimate interests (Art 6(1)(f))
Legal & tax compliance	Order, transaction	Legal obligation (Art 6(1)(c))
Marketing (only with consent)	Email, browsing	Consent (Art 6(1)(a))

4. Who we share data with

Payment processor: Stripe / Shopify Payments (card data)
Couriers: DPD, Yodel, Evri, Royal Mail (name + delivery address + phone for delivery)
Hosting & IT: Shopify Inc. (store platform), AWS / Google Cloud (infrastructure)
Accountants & HMRC: where required by law
Regulators & law enforcement: where legally required

We do not sell your personal data. Ever.

5. International transfers

Some of our processors (Shopify, Stripe) are based outside the UK. Where data leaves the UK we rely on adequacy decisions, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses.

6. How long we keep your data

Type	Retention
Order records	6 years (HMRC requirement)
Account data	Until you delete your account, plus 6 years for tax
Customer service correspondence	6 years
Marketing consent	Until you withdraw consent
Server logs & analytics	Up to 26 months

7. Your rights under UK data protection law

You have the right to:

Access the personal data we hold about you
Rectification of inaccurate data
Erasure ("right to be forgotten") in certain circumstances
Restriction of processing in certain circumstances
Data portability for data you provided to us
Object to processing based on legitimate interests
Withdraw consent at any time (for marketing etc.)
Complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint

8. Cookies

We use cookies for the following purposes:

Strictly necessary: cart, checkout, login session
Functional: remembering your preferences (currency, recently viewed)
Analytics: aggregated traffic measurement (Google Analytics 4, with IP anonymisation)
Marketing: only with your consent, via Shopify Email and remarketing pixels

You can control cookies via your browser settings or our cookie banner.

9. How we protect your data

We use HTTPS everywhere, PCI-DSS-compliant payment processing, least-privilege access controls for staff, and vendor due diligence. No system is 100% secure; if a breach affects your data, we will notify you and the ICO within 72 hours where required.

10. Changes to this policy

We may update this policy. Material changes will be highlighted on this page and, where appropriate, notified by email. The "Last updated" date at the top records the most recent revision.

11. How to contact us

Yes Papa Ltd
Company number: 15879634
Registered office: 71-75 Shelton Street, London, WC2H 9JQ
Email: sam@splash37.com
Phone: +44 7931420543

Important: This privacy policy is a template adapted for general merchandise e-commerce. It is not legal advice. Yes Papa Ltd should have a solicitor review this document before relying on it in any dispute.