Privacy Policy
We keep this short because we collect very little. No advertising trackers, no data sold, no profile built behind your back.
Last updated 2026-10-16
Who is responsible for your data
[Registered company name], [Registered business address], United Kingdom (registration number [VAT Registration Number]) is the data controller for CutitiUU. Write to hello@cutitiuu.com for anything to do with this policy or your personal data.
What we collect, and why
- An order — name, email address, delivery address, the lines ordered and the amount paid. We need these to take payment, deliver the parcel and satisfy our tax and accounting obligations. The lawful bases are performance of a contract and legal obligation.
- An enquiry — whatever you write in the contact form, plus your name and email address, so we can answer you. The lawful basis is our legitimate interest in responding to customers, or your consent where the form asks for it.
- The newsletter — your email address and the fact that you opted in. The lawful basis is consent, and every email carries an unsubscribe link.
- Technical basics — the request logs our hosting provider keeps (IP address, user agent, requested URL, timestamp) for security and to keep the site online. The lawful basis is our legitimate interest in operating a safe service.
Card data
We never see or store card numbers. Payments are processed by our payment provider, which is certified to PCI DSS and receives the card details directly. We only receive the outcome: paid, declined, or awaiting payment.
What we do not do
No advertising or cross-site tracking cookies, no selling or renting personal data, no automated profiling, and no marketing email to anyone who has not asked for it.
Cookies and local storage
The site sets no tracking cookies. Your basket, the orders you can see on this device and the "got it" flag for the notice you are reading are kept in your browser's local storage, under a key unique to this shop (cutitiuu). Clearing your browser data removes all of it. Cloudflare, our hosting provider, may set a strictly necessary security cookie to tell humans and bots apart.
Who else sees your data
Only the processors needed to run the shop, and only what each of them needs: our hosting provider (Cloudflare), our payment provider, our email provider for order notifications and newsletters, and the carrier that delivers the parcel. They act on our instructions under contract. Where a processor is outside the UK or the EEA we rely on an adequacy decision or the UK/EU standard contractual clauses.
How long we keep it
Order records are kept for [6 years] to meet UK tax and accounting rules. Enquiries are deleted [24 months] after the last reply. Newsletter addresses are kept until you unsubscribe. Server logs are rotated within [30 days].
Your rights
You can ask for a copy of the personal data we hold about you, ask us to correct or delete it, object to processing based on legitimate interests, ask us to restrict processing, or receive your data in a portable format. Where we rely on consent you can withdraw it at any time. Write to hello@cutitiuu.com and we will answer within one month. If you are unhappy with our answer you can complain to your national data protection authority — the ICO in the United Kingdom, or the supervisory authority in your German federal state.
Security
The site is served over HTTPS with HSTS enforced and the checkout runs on the payment provider's own systems. Access to the order records we hold is limited to the people who need it to answer you.
Changes to this policy
If this policy changes materially we update the date at the top and, where the change matters to you, say so on the site.