Last updated: September 7, 2026

Summary

This policy explains what personal information we collect when you use this website, buy from us, contact us or join our mailing list, and what we do with it. We have kept it short and in plain English. We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are

DragonLadyDesigns is run by Jo Constantine, who is the data controller for this website.

DragonLadyDesigns
Lower Biggings, Eastside
St Margarets Hope, South Ronaldsay
Orkney, KW17 2TJ

Telephone: 01856 831708
Email: jo@dragonladydesigns.co.uk

What we collect and why

When you contact us

If you use the contact form or email us, we receive your name, email address, your message and, if you give it, your telephone number. We use these to reply to you. The lawful basis is our legitimate interest in answering enquiries. Messages are kept in our email system for as long as needed to deal with your enquiry.

When you buy from us

Our online shop runs on WooCommerce. To fulfil an order we collect your name, email address, billing and delivery address, telephone number, and details of what you ordered. We use these to process your order, take payment, post your items and send you order updates. The lawful basis is that this information is necessary to carry out our contract with you. We keep order records for six years after the end of the tax year in which the order was placed, as required by HMRC.

Card payments are handled by Stripe. Your card details are entered on a secure form provided by Stripe and are never seen or stored by us. Stripe’s privacy policy is at https://stripe.com/gb/privacy. If you pay by cheque, we hold only the details on the cheque until it clears.

Your name and delivery address are passed to Royal Mail so we can post your order to you.

If you create an account in our shop, your details are stored so you can see past orders and check out more quickly next time. You can ask us to delete your account at any time.

When you join our mailing list

If you sign up to our mailing list, we ask for your email address and, if you wish to give it, your first name. We use these only to send you occasional news about new textile pieces and the craft fairs and exhibitions we will be attending. Signing up is a two step process: after you fill in the form you will receive an email asking you to confirm, and you are only added to the list once you click the link in that email. We keep a record of when you confirmed. The lawful basis is your consent, which you can withdraw at any time by using the unsubscribe link in any of our emails or by emailing us. When you unsubscribe, your details are removed from the list.

Our mailing list is run using MailPoet, and your details are stored securely on their systems. Their privacy notice is at https://www.mailpoet.com/privacy-notice/.

When you visit the website

The website sets a small number of cookies that are strictly necessary for it to work, such as remembering what is in your basket.

If you accept analytics cookies when you first visit, we also use Google Analytics to understand how people find and use the site: which pages are popular, roughly where visitors are from, and whether they are on a phone or a computer. This information is aggregated and does not identify you personally; Google Analytics does not record your full IP address. The lawful basis is your consent. Nothing is collected until you accept, and you can change your mind at any time using the Cookie settings link at the bottom of every page. Google’s privacy policy is at https://policies.google.com/privacy. See our Cookies Policy for the full list of cookies.

Our web host keeps standard server logs, including IP addresses, for security and to keep the site running. These are kept for a limited period and are not used to identify individual visitors.

Who we share your information with

We never sell your information or pass it to anyone for marketing. We share it only with the services we need to run the business, each of which is bound by its own data protection obligations:

• Stripe, to take card payments
• Royal Mail, to deliver your order
• MailPoet, to send our mailing list emails
• Google, for website analytics, only if you have accepted analytics cookies
• Our website hosting company and Orcadia Design, who maintain this website on our behalf
• Our accountant, where needed for our tax records

We may also disclose information if the law requires us to.

Some of these services may process data outside the UK. Where they do, they rely on safeguards recognised under UK law, such as the UK Addendum to the EU Standard Contractual Clauses or an adequacy decision.

How we keep your information safe

Access to our systems is limited to Jo Constantine and, for website maintenance, Orcadia Design. We use strong, unique passwords and two factor authentication where it is offered, and our devices are locked when not in use. The website uses HTTPS encryption throughout.

Your rights

Under UK GDPR you have the right to:

• be told what personal information we hold about you
• receive a copy of it
• have inaccurate information corrected
• have your information deleted, where we no longer have a lawful reason to keep it
• object to, or ask us to restrict, how we use your information
• withdraw consent at any time, where consent is the basis for using your information (for example, our mailing list or analytics cookies)
• receive your information in a portable format

To exercise any of these rights, email jo@dragonladydesigns.co.uk or telephone 01856 831708. We will respond within one month.

How to complain

If you are unhappy with how we have handled your information, please contact Jo Constantine first at jo@dragonladydesigns.co.uk or on 01856 831708 and we will do our best to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at https://ico.org.uk/make-a-complaint/ or on 0303 123 1113.

Changes to this policy

If we change this policy, the new version will be published on this page with a new date at the top.