We collect the least we can, keep it the shortest we can, and never sell it. This policy explains, in full and in plain English, everything we do with your personal data, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Last updated: 2026
1. Who we are
Galene Sea is the data controller for personal data processed through this website. "Data controller" is the legal term for whoever decides how and why your data is used — it means the responsibility is ours, not a platform's. Contact us about anything data-related at care@galenesea.com: the same inbox, read by the same people who read everything else.
2. What data we collect
| Category | What it includes |
|---|---|
| Identity & contact data | Name, delivery address, billing address, email address, phone number |
| Order data | What you bought, when, how much you paid, order notes, gift messages |
| Payment data | Transaction reference, amount, currency, the last digits of your card. We never see or store your full card number — that stays with the payment processor. |
| Communication data | Emails, messages and reviews you send us, and our replies |
| Technical data | IP address, browser type and version, device type, operating system, time zone |
| Usage data | Pages you view, how you move through the site, referring site |
| Marketing data | Your email address and preferences, if you join our newsletter |
We do not ask for, and do not want, more than this. We do not collect special category data (health, beliefs, biometrics and so on), and we do not buy data about you from data brokers.
3. How we collect it
- Directly from you, when you place an order, write to us, sign up to the newsletter or leave a review.
- Automatically as you browse, through cookies and similar technologies — see section 6.
- From our service providers, such as Shopify (which hosts our shop and processes orders) and our payment processors, as part of running the store.
4. How and why we use your data (lawful bases)
UK data protection law requires a "lawful basis" for everything we do with your data. Here is ours, in full:
| Purpose | Examples | Lawful basis |
|---|---|---|
| Fulfil your order | Processing payment, arranging delivery, handling returns and exchanges | Contract — we cannot deliver your order without it |
| Manage our relationship with you | Order updates, support, asking for feedback | Contract for order matters; consent where we ask your opinion |
| Keep records | Invoices, accounting records, proof of purchase | Legal obligation — UK tax and consumer law requires it |
| Send marketing | Newsletters, new collection announcements | Consent — only, and you can withdraw it with one click |
| Improve the website | Analytics, fixing what is broken, understanding what people read | Legitimate interests in running a good shop; consent for non-essential cookies |
| Keep the site safe | Fraud prevention, security monitoring | Legitimate interests and legal obligation |
| Defend legal claims | Keeping records if a dispute ever arises | Legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights and privacy — and we will tell you what those interests are if you ask.
5. Marketing
We send marketing emails only with your consent, and every email carries a one-click unsubscribe. You may also object at any time by writing to us — we will stop, and tell you if anything essential (like an order confirmation) will still come. We do not send marketing by text or phone, and we do not share your contact details with other companies for their marketing.
6. Cookies
Cookies are small files placed on your device as you browse. We use the smallest set we can:
- Essential cookies keep your basket and checkout working — without them the shop simply does not function, so they are always on and do not need consent.
- Analytics cookies tell us which pages people read and where they get stuck, so we can improve the site. Consent-only.
- Functional cookies remember preferences such as your country and currency. Consent-only.
- Marketing cookies, if we ever use them, measure whether our own advertising works. Consent-only.
You can change your choices at any time through your browser or our cookie banner, and withdrawing consent is as easy as giving it. For a detailed list of the cookies we use, ask us — we keep it current.
7. Who we share data with
Only what is necessary, only with who is necessary:
- Our website platform (Shopify) — hosts the shop, processes orders and secures checkout.
- Payment processors — take payment and handle refunds securely.
- Delivery carriers — receive the name, address and phone number needed to deliver your parcel, and nothing more.
- Email providers — so our replies and your order confirmations reach you.
- Professional advisers — accountants and lawyers, where needed to run the business lawfully.
We never sell, rent or trade your data. We may disclose data where the law requires it — for example, to comply with a court order, a tax audit or a lawful request from a regulator — and only to the extent required. If anyone asks us for your data, we check who they are and what legal right they have before anything is shared.
8. International transfers
Some of the providers above operate outside the UK. Where they do, transfers are protected by UK adequacy regulations or by the UK International Data Transfer Addendum, so your data keeps the same protection it has at home, wherever it travels. We keep a record of these safeguards and review them when our providers change.
9. How long we keep it
| Data | How long | Why |
|---|---|---|
| Order records | 6 years after the last order | UK tax and consumer law |
| Newsletter data | Until you unsubscribe, then removed promptly | Consent lasts only as long as you say |
| Support messages | Up to 2 years after the matter is closed | To help you if the issue returns |
| Technical & usage data | Up to 26 months | Analytics and site security |
| Legal claim records | Until the claim is resolved, plus any limitation period | To defend or exercise legal rights |
When data reaches the end of its retention period, it is deleted or anonymised — not archived indefinitely "just in case".
10. How we protect it
Your data is encrypted in transit and at rest, access is limited to those who need it, payment is handled entirely by certified processors, and we review our safeguards regularly. If a breach ever affects your rights and freedoms, we will notify you and the ICO as the law requires — promptly, honestly, and in plain language.
11. Your rights
UK data protection law gives you rights over your data. All of them are real, all of them are free, and none of them require a reason:
- To be informed — this policy is that right in action.
- Of access — to receive a copy of the personal data we hold about you, and to know how it is used.
- To rectification — to have inaccurate data corrected, or incomplete data completed.
- To erasure — to have your data deleted ("the right to be forgotten"), except where the law requires us to keep it, such as tax records. We will always explain what we kept and why.
- To restrict processing — to pause our use of your data while a disagreement is sorted out.
- To data portability — to receive your data in a structured, commonly used format, or have it sent to another provider.
- To object — to processing based on legitimate interests, and absolutely to direct marketing (which we will then stop).
- To withdraw consent — at any time, for anything you consented to, with no effect on the lawfulness of what came before.
- To complain to the ICO — at any time, without asking us first (see section 12).
To use any of them, email care@galenesea.com and say what you would like — "please send me everything you hold about me" is a complete and valid request. We respond within one month, and usually much sooner. We may ask for proof of identity where it is needed to protect your data from someone else pretending to be you; we will never ask for more than that.
12. Complaints
If you are unhappy with how we handle your data, tell us first — we would rather fix it than defend it. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113, at any time, without asking us first.
13. Children
This website is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child's data has reached us — perhaps through an order placed by a parent on their behalf — email us and we will delete it promptly.
14. Automated decisions and profiling
We do not carry out profiling or make automated decisions that have a legal effect on you. Decisions about your order — whether to accept it, how to resolve a problem — are made by people.
15. Links to other websites
Our site and emails may link to other websites. This policy covers only this website; please read the privacy policy of any site you visit from here. We choose our links with care, but we cannot control how others handle your data.
16. Changes to this policy
If we change this policy, the updated version appears here with a new date. If a change is significant — a new purpose, a new category of data — we will tell you directly rather than quietly updating the page.