Privacy policy

Who we are

londonpostcards.co.uk is run by Kirk Bennett, a sole trader trading as KB Photography, based in Balls Pond Road, London, N1, UK. We are the "controller" of the personal data described here. That means we decide how and why it is used.

What personal data we collect

When	What we collect
You place an order	Name, email address, delivery and billing address, phone number if you give it, and what you ordered. Payments are handled by Shopify; we never see your full card details.
You join the London Postcard Club	Your email address, the date you signed up, and which form you used (website footer, pop-up, signup page or checkout).
You contact us	Your name, email address and whatever you tell us.
You buy wholesale (trade)	Business contact name, business name, email, address and order details.
You are a shop or business we contact about wholesale	Business name, contact name, work email, phone and shop address, taken from your website, public sources such as Companies House, or from you directly.
You browse the site	Technical data Shopify needs to run the shop, such as your basket and currency (see Cookies).

We do not collect sensitive information, and we do not knowingly collect data from children.

Why we use it and our lawful basis

Purpose	Lawful basis (UK GDPR)
Process, deliver and support your order	Contract: we need it to fulfil your order
Keep tax and accounting records	Legal obligation: HMRC record-keeping rules
Send the London Postcard Club email	Consent: only if you opt in. You can withdraw at any time
Reply to your messages	Legitimate interests: answering customers
Manage trade (wholesale) orders and accounts	Contract, and legitimate interests in running our trade business
Tell shops and organisations about our range	Legitimate interests: supplying businesses that may want our products. Limited companies, LLPs, charities and public bodies only. Sole traders and ordinary partnerships only with their consent.
Keep the shop secure and prevent fraud	Legitimate interests: protecting customers and the business
Improve and personalise the shop through Shopify Network Intelligence	Legitimate interests: running an effective shop. You can object at any time

We never sell your personal data. We email individuals only if they opted in. The exception is business emails to limited companies, LLPs, charities and public bodies, which always include an opt-out. If you sign up on our website, we send one email asking you to confirm before you are added.

Trade customers and prospective trade customers

We hold business contact details (business name, contact name, work email, phone and shop address) for shops and businesses that buy, or may buy, our postcards wholesale. We get them from you directly, from public sources such as business websites and Companies House, and from Faire when you order there.

We use them to answer enquiries, take and fulfil orders, keep accounts and, for limited companies, LLPs, charities and public bodies, to tell you about our range by email. Our lawful bases are contract, legal obligation, and legitimate interests (supplying businesses that may want our products). We email sole traders and ordinary partnerships only with their consent.

Every marketing email has an opt-out, and we keep a do-not-contact list. We keep prospect details for up to 12 months after last contact and order records for 6 years. We share them only with the services we use to run the business (Faire, Shopify, email and shipping providers). You can ask to see, correct or delete your details, or object to marketing, at trade@londonpostcards.co.uk.

Who we share it with

Who	Why	Role
Shopify	Runs our website, checkout, payments and email	Processor: acts only on our instructions
Shopify Network Intelligence	Shopify combines our customer data with other Shopify data to improve its products, ad targeting and personalisation for our shop. Other merchants cannot see your data.	Covered by Shopify's Additional Services Terms. You can object by emailing us
Shop (Shopify's shopping app)	If you use the Shop app, Shopify may send you reminders about items you viewed or left in your basket here, such as back-in-stock or price-drop alerts	Shopify's Shop privacy policy applies. You can turn these off in the Shop app
Google (Gmail)	Sends and receives our business emails, including trade emails	Processor: acts only on our instructions
Royal Mail	Delivers your order	Receives your name and delivery address only
Etsy	Orders placed in our Etsy shop	Independent controller: Etsy's privacy policy applies
Faire	Trade orders placed through Faire	Independent controller: Faire's privacy policy applies
HMRC, accountants or legal advisers	Only where the law requires it	As required by law

We do not share your data with anyone else, and we do not sell it.

International transfers. Shopify may process data outside the UK, including in Canada and the United States. These transfers are protected by adequacy rules (for Canada) and by standard contractual clauses with the UK Addendum, as set out in Shopify's Data Processing Addendum.

How long we keep it

Data	How long
Orders, including customer details	6 years after the order, for HMRC records. After that we delete or anonymise your personal details and keep only sales totals.
London Postcard Club email	Until you unsubscribe. After that we keep only your email address on a "do not email" list, so we never contact you by mistake.
Messages and enquiries	Up to 2 years after we close the enquiry
Trade (wholesale) accounts	While the trading relationship lasts, then 6 years for HMRC records
Trade prospects (shops we may contact)	Up to 12 months after last contact, then deleted. We keep a do-not-contact list so we never email you after you ask us to stop.

Cookies and similar technologies

We use a small number of cookies and browser storage items to make the shop work.

Name	What it does	How long
Shopify basket, checkout and security cookies	Keep your basket, run checkout and protect the shop. Needed for the site to work.	Up to 1 year
localization, cart_currency	Remember your country and currency	Up to 1 year
beyond_popup (browser storage)	Remembers that you closed our email sign-up pop-up, so it doesn't show again for 14 days. It holds no personal details.	Until you clear your browser storage

You can delete these at any time in your browser settings. If you block them, the basket and checkout may not work.

Your rights and how to complain

Under UK GDPR, and EU GDPR if you live in the EU, you have the right to:

Access a copy of the data we hold about you
Correct data that is wrong or incomplete
Delete your data, unless we must keep it by law
Restrict how we use it, or object to us using it
Stop marketing at any time. Click "unsubscribe" in any email, or email us.
Withdraw consent at any time, without affecting what we did before
Receive your data in a portable format

To use any of these rights, email Londonpostcards.london@gmail.com. It's free, and we reply within one month.

If you're unhappy with how we handle your data, please tell us first. You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live in the EU, you can complain to the data protection authority in your country.

Changes to this policy

Last updated: 28th Oct 2026. If we make significant changes, we'll update this page. If the change affects how we use your data, we'll also email London Postcard Club subscribers.