Privacy policy

Last updated: November 5, 2026

Purple Mill operates this website and online store at purplemill.co.uk. This Privacy Policy explains how we collect, use and share your personal information when you browse our website, place an order or contact us.

Purple Mill is the data controller for the personal information we use to run our business. Our store is hosted by Shopify.

If you have questions or wish to exercise your data protection rights, contact info@purplemill.co.uk.

Information we collect

Depending on how you use our website, we collect:

Contact and delivery details: your name, email address, billing address, delivery address and telephone number.
Order information: products purchased, payment confirmation, delivery details, returns, refunds and correspondence about your order.
Payment information: information needed to process your payment through Shopify and the payment provider you select.
Account information: details and preferences you provide if you create or use a customer account.
Communications: information you share when you contact us or submit a review.
Device and browsing information: your IP address, browser, device information and activity on our website, collected through cookies and similar technologies.

We receive information directly from you, automatically through your use of our website, and from service providers supporting payments, fraud prevention and delivery.

How we use your information

We use personal information to:

Process payments and fulfil orders.
Arrange deliveries and manage returns or refunds.
Respond to enquiries and provide customer support.
Send essential messages about orders and accounts.
Maintain and improve our website.
Protect our business and customers against fraud and misuse.
Meet legal, tax and accounting obligations.
Send marketing or provide relevant advertising where permitted by law and subject to your choices.

If you do not provide the information needed to process and deliver an order, we may be unable to complete your purchase.

Our lawful bases

Under UK data protection law, we rely on the following lawful bases:

Contract: where information is needed to process your purchase, deliver your order or provide related support.
Legal obligation: where we must retain records or use information to comply with legal requirements.
Legitimate interests: where necessary to maintain website security, prevent fraud, respond to enquiries and improve our services, provided your rights and freedoms do not override those interests.
Consent: where required for marketing communications, optional cookies or similar technologies.

Where we rely on consent, you can withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.

Who we share information with

We share relevant information with service providers involved in operating our store, including:

Shopify, which hosts our website and checkout.
Payment providers, which process payments and support fraud prevention.
Suppliers and fulfilment partners, which prepare and dispatch orders.
Delivery companies, which transport orders and provide delivery updates.
Providers supporting our website, customer service and business administration.
Professional advisers or public authorities where necessary to meet legal obligations or protect legal rights.

Some products are dispatched directly by dropshipping suppliers, including Ancient Wisdom where applicable. We share the details needed to fulfil and deliver those orders, such as your name, delivery address, ordered products and relevant contact details.

We may also disclose relevant information as part of a business sale or restructuring, subject to applicable data protection requirements.

Shopify

Shopify collects and processes personal information to provide, secure and improve its services. Certain Shopify features may involve Shopify processing information for its own purposes, as described in its privacy policy.

You can find more information in the Shopify Consumer Privacy Policy and manage relevant rights through the Shopify Privacy Portal.

Cookies and similar technologies

Our website uses cookies and similar technologies to support functions such as your shopping basket, checkout and website security.

Optional analytics and advertising technologies, where used, help measure website activity and provide relevant advertising. Where consent is required, we ask for your permission.

You can manage your choices using the cookie preferences controls where available on our website. You can also manage or delete cookies through your browser settings. Blocking essential cookies may affect how the store or checkout works.

For more information about Shopify’s use of cookies, see Shopify’s Cookie Policy.

Marketing choices

Where we send marketing communications, we do so only where permitted by law.

You can object to direct marketing at any time, including any profiling related to that marketing. Use the unsubscribe link in a marketing email or contact info@purplemill.co.uk.

Opting out of marketing does not stop essential messages about your orders, payments, deliveries or returns.

International transfers

Shopify and other service providers may process personal information outside the United Kingdom.

Where required, transfers are protected by an applicable adequacy decision or appropriate safeguards, such as approved contractual arrangements and the relevant UK transfer provisions.

How long we keep information

We keep personal information only for as long as reasonably necessary for the purposes described in this policy.

The retention period depends on the type of information and why we need it. We consider:

Whether information is needed to fulfil an order, manage an account or resolve an enquiry.
Applicable tax, accounting and record-keeping requirements.
Returns, disputes and potential legal claims.
Your marketing preferences and any withdrawal of consent.

Some information may need to be retained after an order is completed or an account is closed to meet these requirements.

Keeping information secure

We use appropriate technical and organisational measures to protect personal information. However, no website, electronic transmission or storage system can be guaranteed completely secure.

Please avoid sending payment card details or other sensitive information by email.

Your rights

Depending on the circumstances and applicable law, you may have the right to:

Access the personal information we hold about you.
Correct inaccurate or incomplete information.
Request deletion of your information.
Restrict how we use your information.
Object to processing based on legitimate interests.
Object to direct marketing.
Receive certain information in a portable format.
Withdraw consent where processing relies on it.

These rights are subject to legal conditions and exceptions. To make a request, contact info@purplemill.co.uk. We may need to verify your identity and will respond within the applicable legal timeframe.

Children’s information

Our store is intended for adult customers. We do not knowingly collect personal information directly from children.

If you believe a child has provided personal information to us, please contact us so we can investigate and take appropriate action.

Other websites

Our website may contain links to third-party websites or social media platforms. Their privacy practices are governed by their own policies, which we encourage you to read.

Complaints

If you have concerns about how we use your personal information, contact info@purplemill.co.uk so we can investigate.

You also have the right to complain to the UK’s Information Commissioner’s Office (ICO). Visit ico.org.uk/make-a-complaint for details.

Changes to this policy

We may update this policy to reflect changes to our services, practices or legal requirements. The latest version will appear on this page with an updated date. Where required, we will also notify you of significant changes.

Contact us

For privacy questions, complaints or requests concerning your personal information, email info@purplemill.co.uk.