Privacy Policy

Two kinds of information are collected. The first is technical: the device and browser in use, an approximate location derived from the IP address, and the pages visited. That information does not identify an individual by name.

The second is supplied by the customer: the name, email address, delivery and billing addresses, a contact number where the carrier requires one, the items purchased, and the result of the payment returned by the processor.

Correspondence sent to Party Table is filed against the relevant order so that a later question can be answered without the customer repeating the history.

A question that comes up regularly: is a full card number ever received? It is not. The card number is entered on the processor's page and never reaches Party Table systems.

No special category information, such as health data or biometric data, is collected, and no information is gathered about ethnicity, religion or political opinions.

Optional fields at checkout may be left blank without affecting the order. Fields that are required are marked as such, and no information is requested that has no bearing on fulfilling or supporting the order.

Order information is used to take payment, dispatch the order, send delivery updates, handle returns and meet accounting obligations.

Technical information is used to run the site, spot unusual activity that may indicate fraud, and understand in aggregate which pages are read.

Correspondence is used to answer the enquiry and, where it concerns an order, to keep a record of what was agreed.

A question that comes up regularly: is information sold? It is not. No payment is received for customer data, and it is not passed to unrelated marketing lists. Each category is held against one of the purposes above rather than retained on the chance it becomes useful.

Where information is used on the basis of consent rather than to perform a contract, that consent may be withdrawn at any time. Withdrawal applies to future use and does not affect anything already done lawfully.

A written record is kept of the purpose for which each category of information is held, so that a specific answer can be given if a customer asks why a particular detail is needed.

The site sets a small number of cookies and equivalent browser storage entries, in two categories.

Essential entries hold the contents of the basket and keep the checkout session alive. Without them the basket empties whenever a page changes, which is why they cannot be switched off from within the site.

Analytics entries record page views in aggregate. They use a random identifier rather than a name or email address and cannot be joined to an order.

A question that comes up regularly: does the site use advertising cookies? It does not. No third-party advertising or retargeting cookies are present, and blocking cookies in the browser will disable the basket rather than the site itself.

The analytics identifier is a random value. It is not joined to an order record, and campaign visits are recorded in aggregate without building a profile that follows a customer to other websites.

Blocking cookies in the browser is possible. The site remains readable, but the basket will not survive navigation between pages and the checkout cannot be completed without essential storage.

Information is disclosed only to the parties needed to complete a transaction, and only to the extent required.

Those parties are the payment processor, the delivery carrier, the hosting provider and the service that sends confirmation emails. The carrier receives the delivery address and a contact number, not payment details; the processor receives payment information, not the order history beyond the amount.

Before appointing any supplier that receives order data, Party Table establishes what it does with the data and how long it retains it, and records the answer. A supplier that cannot meet the required standard is not appointed.

A question that comes up regularly: is information given to authorities? Only where legally compelled, and the customer is told unless the law prohibits that disclosure.

Suppliers are bound by contract to process information only on instruction and to apply appropriate security measures, and the arrangement is reviewed when a supplier changes.

Where a supplier is replaced, the replacement inherits exactly the same restriction and receives order data only for the purpose of fulfilling and supporting orders.

Order records, including the delivery address and the items purchased, are kept for seven years to satisfy tax and accounting requirements.

Support correspondence is kept for two years, which allows a repeated question to be answered without retaining every message indefinitely.

Analytics data remains in aggregate form with no route back to an individual, and a basket that is never ordered is cleared automatically after a short period.

A question that comes up regularly: what happens when an account is closed? Everything that is not legally required to be retained is deleted, and the customer is told in writing what was removed and what had to be kept.

Retention periods are reviewed periodically to confirm that the periods stated here remain accurate and that nothing is being kept beyond its purpose.

Where a legal claim is ongoing, the records relevant to that claim are retained until it concludes, and the customer is told if that affects a deletion they have requested.

Traffic to the site is encrypted in transit, so information typed by the customer cannot be read on the network between the browser and the server.

Card details are entered on the processor's hosted page and never reach Party Table systems or logs.

Access to order data is limited to the small team that packs and supports orders, each using an individual account rather than a shared credential, and access is removed on the day a person stops working with Party Table.

A question that comes up regularly: what happens if something goes wrong? Any breach affecting customer information would be investigated, and the individuals concerned would be told what happened and what is being done about it.

Patterns that look out of the ordinary, such as a run of failed payments from one address, are reviewed, since they generally point to card testing rather than a genuine attempt to buy.

Security measures are reviewed periodically, and access rights are reassessed whenever someone joins or leaves the small team that handles orders.

The following rights may be exercised free of charge: to obtain a copy of the information held; to have inaccurate information corrected; to request deletion of information not legally required to be retained; to object to a particular use; and to receive information in a structured format.

Marketing email can be stopped at any time using the unsubscribe link at the foot of every message. Order and dispatch emails are not marketing and continue to be sent.

No reason needs to be given, and a request will not be treated as a complaint or lead to any reduction in service.

A question that comes up regularly: how long does a request take? It is answered within 30 days, and if it is complex the customer is told why it is taking longer rather than the deadline passing in silence.

Requests are handled by the same team that answers order enquiries, so a question about data is dealt with by someone who can already see the relevant order record rather than being passed between departments.

Where a request cannot be granted in full, the rule that prevents it is identified and the options available are explained, rather than a bare refusal being issued.

This site is built for adult shoppers. Party Table does not knowingly gather details from anyone under 13, and no advertising is aimed at children.

When something is bought for a child, the purchaser is an adult and the contact details on file belong to that adult rather than to the child.

A parent or guardian may exercise any of the rights above on a child's behalf, and information found to have been supplied by a child is deleted on request.

A question that comes up regularly: are photographs of pets or children used? Photographs sent in connection with an enquiry are used only to answer that enquiry and are never published or passed on.

No account, mailing list or prize draw aimed at children is operated, and the checkout does not ask the customer to state an age.

Where a product page states an age range, that guidance concerns the safe use of the item rather than who may purchase it from Party Table.

Where a customer believes a child has sent information to Party Table, a short email is enough and it will be removed.

Requests and questions about this policy should be sent to [email protected] with the word privacy in the subject line, together with a statement of what is being requested.

A reply is provided within one working day, and formal requests are answered within 30 days. Identity may be verified before information is released or deleted, so that it cannot be obtained by someone impersonating the customer.

Where a request cannot be granted in full, the rule that prevents it is identified and the available options are explained.

A question that comes up regularly: is a specific form needed? No particular wording is required. A short email stating what is wanted is sufficient, and any further detail needed will be requested in reply.

No set form of words is required. An email setting out what the customer wants done is enough, and anything further that is needed will be asked for in the reply.

Where a customer is dissatisfied with the response, they may ask for the matter to be reviewed and will be told who considered the original decision.