Privacy policy
PRIVACY POLICY
Last updated: 10 August 2026
Sussex Sea & Sky ("we", "us" or "our") respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains how we collect, use, store and share personal information when you visit our website, place an order, contact us or otherwise use our services.
For the purposes of UK data protection law, including the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, Sussex Sea & Sky is the data controller for the personal information described in this policy, except where another organisation acts as a separate controller for its own processing.
Our online store is powered by Shopify and our print-on-demand production and fulfilment services are provided by Prodigi.
1. PERSONAL INFORMATION WE COLLECT
Depending on how you interact with our store, we may collect the following information:
Identity and contact information, including your name, email address, telephone number, billing address and delivery address.
Order and transaction information, including products ordered, product specifications, order value, delivery information, payment status, cancellations, refunds and previous transactions.
Payment information. Payments are processed using the payment services made available through our ecommerce platform and payment providers. We do not need to store complete payment-card details ourselves in order to fulfil your order.
Communications, including information you provide when contacting us about an order, delivery, damaged product, refund, complaint or other enquiry.
Technical and usage information, which may include your IP address, browser type, device information, cookie identifiers and information about how you interact with our website.
Marketing preferences, including whether you have agreed to receive marketing communications and your subsequent choices.
2. HOW WE COLLECT YOUR INFORMATION
We may obtain personal information:
- directly from you when you place an order, contact us, create an account or provide information through our website;
- automatically when you use our website, including through cookies and similar technologies;
- from Shopify and payment providers in connection with your transactions;
- from Prodigi and delivery providers in connection with production, fulfilment, tracking, delivery and problems with an order; and
- from other service providers where reasonably necessary to operate our business.
3. WHY WE USE YOUR INFORMATION AND OUR LAWFUL BASES
Under UK data protection law, we must have a lawful basis for processing personal information.
Fulfilling your order
We use personal information to:
- process and administer orders;
- take or facilitate payment;
- send order confirmations;
- arrange manufacture of your print;
- arrange delivery;
- provide delivery and tracking information;
- deal with cancellations, refunds, damaged goods and customer-service enquiries.
Our primary lawful basis for this processing is that it is necessary to perform our contract with you or to take steps at your request before entering into a contract.
Legal and regulatory obligations
We may process and retain information where necessary to comply with legal obligations, including tax, accounting, consumer-protection and regulatory requirements.
Our lawful basis is compliance with a legal obligation.
Fraud prevention, security and protection of our business
We may use information where reasonably necessary to detect or prevent fraud, protect our website and systems, establish or defend legal claims, resolve disputes and protect our legitimate business interests.
Our lawful basis is our legitimate interests in operating a secure business, preventing fraud, protecting our legal rights and resolving disputes, provided those interests are not overridden by your rights and freedoms.
Customer service and business administration
We use information to respond to enquiries, administer our relationship with customers, maintain appropriate business records and improve the operation of our store.
Where this is necessary for an existing order or contract, we rely on performance of the contract.
Where appropriate, we may rely on our legitimate interests in operating and improving our business and providing effective customer service.
Marketing
Where required by law, we will obtain your consent before sending electronic direct marketing.
You can unsubscribe from marketing emails at any time by using the unsubscribe facility provided in the communication or by contacting us.
Withdrawing consent does not affect the lawfulness of processing that occurred before consent was withdrawn.
4. SHOPIFY
Our online store is hosted and powered by Shopify.
Shopify processes information necessary to provide the ecommerce platform, including information associated with website visits, customer accounts, shopping activity, orders, payments and transactions.
In some circumstances Shopify processes personal information on our behalf in connection with operating our store. Shopify may also process certain information for its own purposes in accordance with its applicable privacy documentation.
You can obtain further information about Shopify's processing from Shopify's Consumer Privacy Policy and privacy resources.
5. PRODIGI — PRINTING AND FULFILMENT
We use Prodigi to manufacture and fulfil our print-on-demand products.
When you place an order, we provide Prodigi with information reasonably necessary to manufacture and deliver your order. This can include:
- recipient name;
- delivery address;
- relevant contact information;
- order details;
- product configuration;
- artwork required for production; and
- information necessary to investigate a production or fulfilment problem.
For customer orders fulfilled on our behalf, we act as the controller of this customer information and Prodigi acts as our processor in accordance with its applicable data-processing arrangements.
Prodigi operates a fulfilment network that can include production facilities, fulfilment partners and delivery providers. Information necessary to manufacture and deliver your order may therefore be supplied to the appropriate participants in that fulfilment network.
We provide this information because it is necessary to perform our contract with you and fulfil your order.
6. OTHER ORGANISATIONS WE MAY SHARE INFORMATION WITH
Where necessary, we may share appropriate personal information with:
- Shopify;
- Prodigi and its authorised production and fulfilment network;
- payment processors;
- banks and payment services;
- delivery and postal companies;
- website, hosting, security and technology providers;
- professional advisers where necessary;
- regulators, law-enforcement bodies, courts or other authorities where required or permitted by law; and
- another organisation in connection with a legitimate sale, transfer or restructuring of our business, where applicable.
We only disclose information where there is an appropriate reason for doing so.
We do not sell customer personal information.
7. INTERNATIONAL TRANSFERS
Some of our service providers, including ecommerce, technology and fulfilment providers, operate internationally.
As a result, personal information may be processed outside the United Kingdom.
Where UK personal information is transferred to a country that is not covered by an applicable UK adequacy regulation, appropriate safeguards will be used where required by law. These may include recognised contractual safeguards or other lawful international-transfer mechanisms.
8. COOKIES AND SIMILAR TECHNOLOGIES
Our website may use cookies and similar technologies to operate the store, maintain security, remember preferences, understand website usage and, where enabled, support analytics or advertising.
Some cookies are necessary for the operation of the website.
Where UK law requires consent for non-essential cookies or similar technologies, they will be used in accordance with the consent choices made available through our website.
You can also control certain cookies through your browser settings.
Further information may be provided through our website's cookie preferences or cookie notice.
9. HOW LONG WE KEEP PERSONAL INFORMATION
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including fulfilling orders, providing customer service, maintaining appropriate business and transaction records, complying with tax, accounting and other legal obligations, resolving disputes and establishing or defending legal claims.
Different categories of information may therefore be retained for different periods.
When determining an appropriate retention period, we consider:
- the purpose for which the information was collected;
- the nature and sensitivity of the information;
- whether we continue to have a legitimate business need for it;
- applicable legal, tax and accounting requirements;
- fraud-prevention requirements; and
- applicable limitation periods and the possibility of legal claims.
When information is no longer required, we will delete or anonymise it where appropriate, subject to information retained within legitimate backup systems and information that another controller is independently required or entitled to retain.
10. YOUR UK DATA-PROTECTION RIGHTS
Subject to applicable conditions and exceptions, you may have the right to:
- request access to personal information we hold about you;
- request correction of inaccurate or incomplete personal information;
- request deletion of your personal information;
- request restriction of processing;
- object to certain processing, including processing based on legitimate interests;
- object to direct marketing;
- receive certain personal information in a portable format where the right to data portability applies; and
- withdraw consent at any time where processing is based on consent.
These rights are not absolute and their application depends on the circumstances and applicable law.
We may need to verify your identity before responding to a request.
To exercise your rights, contact us using the details at the end of this policy.
11. SECURITY
We take reasonable organisational and technical measures to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.
Our ecommerce, payment and fulfilment providers also maintain their own security measures.
However, no internet transmission or electronic storage system can be guaranteed to be completely secure.
12. CHILDREN
Our store is intended for general retail customers and is not specifically directed at children.
We do not knowingly seek to collect personal information from children who are not legally able to enter into the relevant transaction.
If you believe that a child has provided personal information to us inappropriately, please contact us.
13. THIRD-PARTY WEBSITES
Our website may contain links to websites operated by other organisations.
We are not responsible for the privacy practices of websites we do not operate. If you follow an external link, you should review that organisation's privacy information.
14. COMPLAINTS
If you have concerns about how we use your personal information, please contact us first so that we can investigate your concern.
You also have the right to complain to the UK's data-protection regulator, the Information Commissioner's Office (ICO).
Information about making a complaint and the ICO's current contact details can be found on the ICO website.
You are not required to contact us before exercising your right to complain to the ICO.
15. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy where necessary to reflect changes to our business, service providers, technology, legal requirements or processing activities.
When we make changes, we will publish the revised policy on our website and update the "Last updated" date.
16. CONTACT US
If you have questions about this Privacy Policy, wish to exercise a data-protection right or want to make a privacy complaint, please contact:
Sussex Sea & Sky
Email: info@sussexseaandsky.co.uk
Postal address:56 summerheath road Hailsham BN273DR
For the purposes of applicable UK data-protection law, Sussex Sea & Sky is the controller of the personal information described in this policy except where another organisation acts as an independent controller for its own processing.