Privacy policy

1. Overview

Fiori's Finds Ltd ("we", "us", "our") is committed to protecting the privacy and security of our customers. This policy explains how we collect and use your personal data when you purchase from us or interact with us via our website (fiorisfinds.com), our social media profiles (Facebook, Instagram, TikTok), marketplace stores (eBay, Etsy, Vinted), or direct messaging (WhatsApp / Email).

Our website, fiorisfinds.com, is hosted on the Shopify platform.

We are the Data Controller of your personal information. Where we use the Meta Pixel to measure our advertising (see Sections 3 and 5), we and Meta act as joint controllers for that activity. Fiori's Finds Ltd is not required to appoint a Data Protection Officer; all data privacy enquiries are handled directly by our Data Privacy Lead.

2. The Data We Collect

We collect information necessary to process your orders and provide customer support, including:

• Identity Data:  Name, username, or social media handle.

• Contact Data:  Billing address, delivery address, email address, and telephone numbers.

• Financial Data:  Payment details, processed securely by third-party providers such as Shopify Payments, PayPal, eBay, Etsy, and Vinted. We do not store full card details ourselves.

• Transaction Data:  Details about payments to and from you and products you have purchased.

• Technical Data:  When you visit fiorisfinds.com, our website platform (Shopify) collects technical data such as your IP address, browser and device type, and information about how you use the site, through cookies and similar technologies — see Section 3 below.

3. Cookies

Our website uses cookies and similar technologies to operate the store, keep it secure, understand how visitors use it, and (with your consent) measure our advertising. Cookies fall into the following categories:

• Strictly necessary cookies  — required for the website, cart, and checkout to function. These do not require your consent.

• Analytics / performance cookies  — used to understand site usage on an aggregate basis. In line with the Data (Use and Access) Act 2025, these operate on an opt-out basis.

• Advertising cookies  — we use the Meta Pixel and Conversions API to measure the performance of our advertising on Facebook and Instagram. These are only activated if you give your consent through our cookie banner, and you can decline or withdraw consent at any time. Until you consent, they do not run.

Cookie consent is managed through the consent banner on fiorisfinds.com.

4. How We Use Your Data (Legal Basis)

Under UK GDPR, we only process your data when we have a valid legal basis:

• Performance of a Contract:  To deliver the items you purchased.

• Legitimate Interests:  To respond to enquiries, operate and secure our website, run interest-based advertising, and improve our services. We do not currently operate a marketing newsletter, but reserve the right to do so in future. You have the right to opt out at any time.

• Legal Obligation:  To keep records for HMRC (tax purposes) or to comply with the Hallmarking Act 1973.

• Consent:  For advertising cookies (the Meta Pixel and Conversions API) and for any future marketing communications. Consent can be withdrawn at any time.

5. Data Sharing & Social Media

We do not sell your data. We share your information with trusted third parties only to operate our website, fulfil your orders, and measure our advertising:

• Website Platform:  Shopify, which hosts fiorisfinds.com and processes orders and payments placed directly on our website.

• Payment Processors:  Shopify Payments and PayPal.

• Marketplaces:  Etsy, eBay, and Vinted.

• Delivery Services:  Royal Mail, Evri, Yodel, DPD, and InPost.

• Meta (Advertising):  Where you consent to advertising cookies, we use the Meta Pixel and Conversions API to share certain data with Meta — including your name, email address, phone number, location, and on-site activity — so we can measure our ads and reach similar audiences. We and Meta act as joint controllers for this. We do not manually upload customer lists to Meta. You can decline or withdraw consent at any time via our cookie banner.

• Social Media (Organic):  We maintain organic business profiles on Facebook, Instagram, and TikTok.

• Professional Advisers:  Accountants or legal advisers if required.

6. International Transfers

Some providers (such as Shopify, Etsy, or Meta) may be based or hold data outside the UK. We ensure they have equivalent data protection measures in place as required by UK law, including:

• Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA).

• UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge), where applicable.

7. Data Retention

We only keep your personal data for as long as necessary:

• Transaction records:  Kept for 6 years to comply with UK tax (HMRC) requirements.

• Enquiries:  Enquiries that do not lead to a sale are retained in accordance with the retention policies of the platform used. We do not actively export or separately store these communications.

• Cookie & advertising data:  Retained for the lifespan of each cookie, and by Meta per its own retention policy for advertising data you have consented to.

8. Your Legal Rights

Under the UK GDPR, you have the following eight rights:

1. The Right to be Informed:  Transparent information about data use.

2. The Right of Access:  Request a copy of the data we hold about you.

3. The Right to Rectification:  Correct inaccurate or incomplete data.

4. The Right to Erasure:  Request deletion of your data (where no legal duty to retain it exists).

5. The Right to Restrict Processing:  Block further use of your information.

6. The Right to Data Portability:  Reuse your data across different services.

7. The Right to Object:  Object to processing, including direct marketing.

8. Rights related to Automated Decision-Making:  Protection against decisions made without human intervention. Fiori's Finds does not carry out automated decision-making or profiling.

To protect your privacy, we may request specific information from you to confirm your identity before fulfilling any of these requests.

9. Complaints

If you have a concern about how we handle your data, please contact us in the first instance at marco@fiorisfinds.com.

• Our Promise:  We will acknowledge any formal data complaint within 30 days and aim to provide a substantive response within that same period.

• The Regulator:  You have the right to complain to the Information Commissioner's Office (ICO) at www.ico.org.uk if you are unhappy with our response.

This policy is reviewed quarterly. Last Updated: June 2026.