Skip to main content
Fern Dale Rituals

Free UK delivery on orders over £50

Privacy Policy

Last updated: 7 October 2026

1. Introduction

This privacy notice explains how we collect and process your personal data when you use the Fern Dale Rituals and Fern Dale Keepsakes websites (ferndalerituals.co.uk and its Keepsakes pages), buy from us online, at markets or at events, book a keepsake event, send us photos, or join our mailing list.

By providing us with your data, you confirm that you are over 13 years of age. Our websites are not aimed at children.

Kathryn Barnes, trading as Fern Dale Handcrafted is the data controller and is responsible for your personal data (referred to as “we”, “us” or “our” in this notice). We are a sole trader and have not appointed a Data Protection Officer, as we are not required to.

Contact details

  • Full name of legal entity: Kathryn Barnes, trading as Fern Dale Handcrafted
  • Email address: contact@ferndale-handcrafted.co.uk
  • Postal address: 288 Ferndale Road, Swindon, Wiltshire SN2 1HL

It is very important that the information we hold about you is accurate and up to date. Please let us know if your personal information changes by emailing contact@ferndale-handcrafted.co.uk.

2. What data we collect, why, and on what lawful ground

Personal data means any information capable of identifying an individual. It does not include anonymised data. We may process the following categories of personal data about you:

Communication Data

Any communication you send us, through the contact form on our website, email, text, social media messaging or any other means. We process this to communicate with you, for record keeping and for the establishment, pursuance or defence of legal claims. Our lawful ground is our legitimate interests, which are to reply to communications, keep records and establish, pursue or defend legal claims.

Customer Data

Data relating to purchases of goods and services: your name, billing and delivery address, email address, phone number, what you bought and payment details. Card payments are taken by Stripe; we receive confirmation of payment, the card type and last four digits only, and never see or store your full card number. We process this data to supply the goods and services you have bought and to keep records of those transactions. Our lawful ground is the performance of a contract between you and us, or taking steps at your request to enter into one.

Keepsake Photo and Personalisation Data

Photos, names, dates and wording you upload or send for keepsake and personalised orders, and the crop and layout you choose. We process this solely to make the item you have ordered. Our lawful ground is the performance of our contract with you. How we handle and delete photos is set out in section 3.

Booking Data

For keepsake events and workshops: your name, contact details, event type and date, venue name and postcode, package and guest numbers. We process this to provide the booking, work out travel, take payment and keep records. Our lawful ground is the performance of a contract, and legal obligation for tax records.

User Data

Data you post for publication on our website, such as reviews (your name, rating, review text, and the email address you give so we can check it matches an order). We process this to publish and administer reviews and to keep our website secure. Our lawful ground is our legitimate interests in properly administering our website and business.

Technical Data

Basic information your browser sends to our website, such as your IP address, browser and device type, needed to deliver web pages securely and protect against misuse. We do not use analytics tracking or advertising tracking. Our lawful ground is our legitimate interests in properly administering and protecting our website. See our Cookie policy.

Marketing Data

Your email address and preferences if you join our mailing list, and, if you sign up at a market, the name of that market. We process this to send you news, offers and order-related follow-up emails and to run any promotions or prize draws you choose to enter. Our lawful ground is your consent.

We may also use any of the data above for the establishment, pursuance or defence of legal claims, on the ground of our legitimate interests in doing so.

Recognised legitimate interests

Under the Data (Use and Access) Act 2025, we may also process personal data where strictly necessary for recognised legitimate interests, specifically: safeguarding vulnerable individuals (including children); responding to emergencies (threats to life, health or safety); crime prevention, detection or investigation; and responding to a request from a person or body carrying out a task in the public interest or exercising official authority, such as the police. See section 4 (Safeguarding).

Required processing

Where we need personal data by law, or under the terms of our contract with you, and you do not provide it when asked, we may not be able to perform the contract (for example, to deliver goods or make a keepsake). In that case we may have to cancel the order, and we will tell you at the time. We may process your personal data without your knowledge or consent where this is required or permitted by law.

Purposes of processing

We will only use your personal data for the purpose it was collected for, or a reasonably compatible purpose if necessary. For more information, email contact@ferndale-handcrafted.co.uk. If we need to use your details for an unrelated new purpose, we will tell you and explain the legal grounds.

Sensitive data, criminal conviction data and automated decisions

We do not collect any Sensitive Data about you (details of race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health, genetic or biometric data). We do not knowingly collect information about criminal convictions and offences. We do not carry out automated decision-making or profiling. Our postcode check for local delivery and event travel simply calculates driving distance; it does not make decisions about you.

3. How we use your photos

Your photos matter to us and we treat them with care. We use photos you send only to make the item you ordered. Specifically:

  • Photos are uploaded to secure, private storage. They are not public and can only be opened by Kathryn.
  • We look at, crop and print your photo onto your item. We may contact you if a photo is unsuitable or too low in quality.
  • We never use your photos, or the finished item showing them, on our website, social media, adverts or anywhere else without your separate, written permission. You can withdraw that permission at any time.
  • We never sell, share or give your photos to anyone else, and they are not used to train AI or any other technology.
  • Photos collected at an event or market are deleted 48 hours after the order is collected, or 14 days after upload if not collected.
  • Photos for posted orders are deleted 14 days after your order is marked as posted, or 14 days after upload if no order is placed, whichever comes first.
  • Printed proofs and offcuts are shredded. You can ask us to delete your photos sooner by emailing us.

Please only send photos you have the right to use. If a photo shows another person, you confirm they (or their parent or guardian) are happy for us to use it to make your item. Children may appear in photos sent by a parent or guardian; these are handled exactly as above.

4. Safeguarding

We look at every photo you send us only to make your order. If a photo, message or piece of wording suggests that a child or vulnerable adult is being harmed, or is at risk of harm, we will not make the item. Where we believe someone may be at risk, we may share the relevant photo and your details with the police and the relevant local authority safeguarding team (for example children's social care), without telling you first if telling you could put someone at greater risk. If anyone is in immediate danger we will call 999.

We will also refuse, and may report to the police, any content that appears illegal, including indecent images, threats, or material that harasses or targets another person.

5. How we collect your personal data

We collect data directly from you, for example when you place an order, fill in forms on our site, upload photos, book an event, sign up at a market or send us emails. We automatically collect limited technical data as you use our website using strictly necessary cookies and similar technologies; please see our Cookie policy.

We may receive data from providers of payment and delivery services (Stripe, Royal Mail or our courier), for example to confirm a payment or delivery.

6. Marketing communications

Our lawful ground for sending you marketing communications is your consent.

Under the Privacy and Electronic Communications Regulations (PECR), we may send you marketing communications if (i) you made a purchase or asked for information from us about our goods or services, or (ii) you agreed to receive marketing communications, and in each case you have not opted out since.

Before we share your personal data with any third party for their own marketing purposes we will get your express consent. We have never done this and have no plans to.

You can ask us to stop sending you marketing messages at any time by following the unsubscribe link in any marketing email or by emailing contact@ferndale-handcrafted.co.uk.

If you opt out of marketing, this does not apply to personal data provided as a result of other transactions, such as purchases.

7. Disclosures of your personal data

We may have to share your personal data with the parties set out below:

  • Stripe — card payments and fraud prevention.
  • Klaviyo — our mailing list and order emails, run under the Fern Dale Handcrafted account.
  • Our website host and secure database providers — IT and system administration, storing order records and photos.
  • Google Maps — only the postcode you enter, to calculate driving distance for local delivery and event travel.
  • Royal Mail or our chosen courier — your name, delivery address and sometimes phone or email, to deliver your parcel.
  • Professional advisers, including lawyers, accountants, bankers and insurers.
  • HMRC and other government bodies that require us to report processing activities.
  • The police, local authority or other public bodies where the law requires it or for safeguarding (section 4).
  • Third parties to whom we may sell, transfer or merge parts of our business or assets.

We require all third parties to whom we transfer your data to respect the security of your personal data and to treat it in accordance with the law. We only allow them to process your personal data for specified purposes and in accordance with our instructions. We do not sell your personal data.

8. International transfers

We are subject to the UK General Data Protection Regulation (UK GDPR). Some of our service providers (such as Stripe and Klaviyo) are based in, or process data in, the United States. Where we transfer your data outside the UK, we ensure one of these safeguards is in place:

  • transfer to countries the UK has approved as providing an adequate level of protection; or
  • transfer to US-based providers that are part of the UK-US Data Bridge (the UK Extension to the EU-US Data Privacy Framework); or
  • use of contracts approved by the ICO (the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses).

If none of these safeguards is available, we may ask for your explicit consent to the specific transfer, which you may withdraw at any time.

9. Data security

We have put in place security measures to prevent your personal data from being accidentally lost, used, altered, disclosed, or accessed without authorisation, including secure access-controlled systems, encrypted connections and private photo storage. Only Kathryn has access to your order details and photos. Anyone else acting for us may only process your personal data on our instructions and must keep it confidential.

We have procedures to deal with any suspected personal data breach and will notify you and the ICO where we are legally required to.

10. Data retention

We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for, including any legal, accounting or reporting requirements. In deciding how long, we consider the amount, nature and sensitivity of the data, the risk of harm from unauthorised use or disclosure, the purposes and legal requirements.

  • Order, payment and booking records: six years, as the law requires for tax purposes.
  • Keepsake photos: as set out in section 3.
  • Messages: up to two years after our last contact, unless linked to an order.
  • Mailing list: until you unsubscribe.
  • Reviews: while they are shown on our website, or until you ask us to remove them.

In some circumstances we may anonymise your personal data for statistical purposes, in which case we may use it indefinitely without further notice to you.

11. Your legal rights

Under data protection law you have the right to request access to, correction of, erasure of, or restriction of your personal data, to object to processing, to data portability and, where we rely on consent, to withdraw consent at any time. You can read more about these rights at ico.org.uk.

To exercise any of these rights, email contact@ferndale-handcrafted.co.uk.

You will not have to pay a fee, but we may charge a reasonable fee, or refuse, if a request is clearly unfounded, repetitive or excessive.

We may need specific information from you to confirm your identity before we act on a request. This is a security measure to make sure personal data is not disclosed to anyone with no right to receive it.

When responding to a request to access your personal data, we are only required to carry out searches that are reasonable and proportionate in the circumstances, as recognised in the Data (Use and Access) Act 2025.

We try to respond to all legitimate requests within one month of receiving them (or of receiving any identity information or clarification we have asked for; the time limit is paused while we wait). If a request is particularly complex, or you have made several, we may extend this by up to two further months, and we will tell you within one month and explain why.

12. How to complain

If you have a complaint about how we handle your personal data, please contact us first so we can try to resolve it. You can complain to us by:

We will acknowledge your complaint within 30 days of receiving it, investigate it without undue delay, keep you informed of our progress, and explain the outcome clearly.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection, at www.ico.org.uk or on 0303 123 1113.

13. Third-party links

Our website may include links to third-party websites, plug-ins and applications, such as social media. Clicking on them may allow third parties to collect or share data about you. We do not control these websites and are not responsible for their privacy statements. When you leave our website, please read the privacy notice of every website you visit.

14. Changes to this notice

We keep this notice under regular review. The latest version will always be on this page with the date it was last updated.