FOR THE LOVE OF NORFOLK LTD / Customer information
Privacy Policy
Reviewed 22 October 2026 · GBP / United Kingdom
Controller and scope
FOR THE LOVE OF NORFOLK LTD is the trader and data controller, company number 15262431. Write to [email protected] or 46 Vanguard Chase, Norwich, England NR5 0UH. This is a correspondence address, not a shop or an unsolicited returns destination. Telephone: +447903 249557. This notice covers browsing, saved shopping sessions, non-binding requests and subsequent correspondence. It does not describe a customer account, because this shop has none.
Data needed for a request
For a request we ask for your name, email and eligible delivery address, together with the products, selected variant and quantities. A telephone number and message are optional. Do not include card numbers, identity documents or sensitive information. A gift request does not need a recipient birthday, relationship history or celebration profile. Browser session identifiers and the request reference help us keep your own draft and receipt separate from other shoppers.
Purposes and legal grounds
We use the details you provide to take pre-contract steps at your request: answering an enquiry, checking the proposed goods and preparing an offer. If you later accept, contract administration supports fulfilment and remedies. Minimal accounting information is processed to meet legal obligations. Security checks serve our legitimate interest in preventing forged requests and protecting shopping sessions; access is restricted, inputs are bounded and unnecessary details are not requested. No marketing permission is attached to checkout.
Request and contract lifecycle
Sending the form records a request and gives a reference. It does not create an account, reserve verified stock or make a sale. The merchant reviews availability, specifications and delivery before providing an offer that you can save and explicitly accept or decline. Quote your reference to correct the record. Optional enquiry messages are not automatically financial records, and the fact that you asked a question does not put you on a mailing list.
Recipients and controlled access
Access is limited to authorised staff and hosting or technical-support providers acting on our instructions. When an accepted order requires delivery or collection, we share only the name, address, contact details and parcel information needed by the delivery provider. We do not sell your details, share them for advertising or send card information to a payment processor through this website. Ask us which recipient categories apply to your enquiry or order, and we will explain the relevant access and purpose.
International transfers
Our business is registered in the United Kingdom. Technical hosting or support can involve processing outside the UK; we do not promise that every service is located in the UK. Where a restricted international transfer is involved, our policy is to use an applicable adequacy decision or the contractual safeguards required by UK data-protection law, together with any necessary additional measures. Contact our privacy email to ask about destinations relevant to your information and how to obtain details of the applicable safeguard. We do not rely on your acceptance of general shop terms as blanket consent to an overseas transfer.
Retention schedule
Unaccepted requests are scheduled for deletion 90 calendar days after the last substantive contact. Operational details of accepted orders are kept for 730 days after fulfilment. Access to shopping sessions and their cart/draft data expires after seven days of inactivity; expired session files are removed during subsequent website activity. Consent preferences expire after 180 days. Security logs, if retained, have a 30-day limit; this application does not create a separate security-log or backup system. Where operational backups are used, our retention policy limits their cycle to 30 days. Minimal company accounting records are separate: retain them for six years from the end of the last company financial year they relate to, with documented lawful exceptions. An unaccepted request is not an accounting record. A targeted dispute hold is reviewed every 90 days.
Deletion and security
The request files and native session files sit outside the public document root with restricted permissions. These measures reduce risk but are not an absolute security guarantee or a claim of encryption at rest. Ask the contact above for deletion, quoting your reference where available. We use proportionate checks, not a routine demand for an identity-document scan. If a narrow legal duty or dispute prevents immediate erasure, we explain the scope and reason. Deletions must be reapplied after any operator backup restoration; a hidden page is not deletion.
Your rights
You may request access, correction, erasure or restriction, and object to processing based on legitimate interests. Portability applies where its legal conditions are met, including relevant automated processing on consent or contract grounds. These rights are not absolute: for example, a necessary accounting record may need to remain. We normally respond within one month. A lawful extension of up to two further months for a complex or numerous request will be explained within the first month. Withdrawing consent does not make earlier lawful processing unlawful.
Children, marketing and automated decisions
There is no mailing list, targeted advertising, profiling or automated decision producing legal or similarly significant effects. Product choices are not used to infer a personal profile. The shop is intended for adults arranging purchases; please do not provide children’s personal details. If unnecessary child data reaches us, contact us so it can be removed appropriately. Any future optional marketing requires a separately explained purpose and lawful basis, not reuse of an old enquiry as permission.
Complaints and changes
Please raise privacy concerns with the controller using the contact above. You can also complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/; you do not have to complete a product-return complaint first. Consumer delivery and quality disputes follow the Service and Returns policies instead. This notice is reviewed on 22 October 2026. Material new purposes or recipients must be explained before the new processing starts; we will not silently reinterpret an earlier request as marketing consent.