Privacy policy
Last updated 19 August 2026
This notice explains what we do with your personal information when you use runestone-vault.co.uk or buy from us. We have tried to write it in plain English rather than in the language these documents are usually written in.
Who we are
Jack Mackay, trading as The Runestone Vault, is the data controller for the information described here.
- Address: 7 Myrtle Close, Gloucester, GL4 6YP, United Kingdom
- Email: hello@runestone-vault.co.uk
- ICO registration: ZC224386
There is no data protection officer, because a business this size is not required to appoint one. Everything comes to Jack directly.
What we collect
When you buy something: your name, delivery address, billing address, email address, phone number if you give one, what you ordered, and the amount you paid.
We never see your card number. Payments are processed by Shopify Payments, which handles the card details itself. We only ever see the last four digits and the card type.
When you create an account: your email address, and your order history.
When you sign up for emails: your email address, and whether you have opted in.
When you contact us: whatever you put in the message, and your email address.
When you browse the site: technical information collected automatically — IP address, browser and device type, pages viewed, and the site you arrived from. Some of this comes from cookies. See our cookie policy.
When you leave a review: your name as you give it, and what you write.
Why we use it, and our lawful basis
| What we use it for | Lawful basis |
|---|---|
| Taking payment and sending you your order | Contract — we cannot sell you anything without it |
| Emailing you about your order: confirmations, dispatch, tracking, problems | Contract |
| Handling returns, cancellations and complaints | Contract, and legal obligation |
| Keeping records of sales for tax | Legal obligation — HMRC requires it |
| Preventing and investigating fraud | Legitimate interests — protecting the business from theft |
| Asking you to review a purchase you made | Legitimate interests, and the soft opt-in rules in PECR |
| Marketing emails about new stock and offers | Consent, or the soft opt-in if you have bought from us |
| Understanding how the site is used so we can improve it | Consent, through the cookie banner |
We do not sell your data to anyone, ever. We do not share it with advertisers or data brokers, and we do not build profiles of you to target advertising.
Marketing emails
If you buy from us, we may email you about similar products under the "soft opt-in" — but every email has a working unsubscribe link, and unsubscribing takes effect immediately and permanently.
If you have not bought from us, we only email you if you ticked the box.
Review requests are one email per order, sent about a week after your parcel is dispatched. One email, one ask, no chasing. If you have opted out of marketing you will not get it.
Who we share it with
We use a small number of service providers who process data on our behalf. Each of them is contractually bound to protect it and to use it only for what we ask.
| Who | What for |
|---|---|
| Shopify | The shop itself — hosting, orders, customer accounts, email |
| Shopify Payments / Stripe | Taking card payments and preventing fraud |
| Royal Mail | Delivering your parcel — name, address, and email or phone for tracking updates |
| Judge.me | Collecting and displaying reviews |
| Cloudflare | DNS for the website |
| Namesco | Our email hosting, so anything you email us sits there |
We will also disclose information if we are legally required to — for example to HMRC, or in response to a lawful request from the police.
Where your data is held
Our providers, particularly Shopify, may process data outside the UK, including in the United States. Where that happens it is covered by the safeguards UK data protection law requires, such as the UK International Data Transfer Addendum or an adequacy decision.
How long we keep it
- Order records and invoices: six years after the end of the tax year they fall in, because HMRC requires it.
- Customer accounts: until you ask us to delete the account. If it is unused for three years we will delete it anyway.
- Marketing consent and email lists: until you unsubscribe, and then we keep a minimal record that you unsubscribed so we do not email you again by accident.
- Emails you send us: two years after the conversation ends, unless it relates to an order or a complaint, in which case it goes with the order record.
- Reviews: for as long as they are displayed, unless you ask us to remove yours.
Your rights
Under UK data protection law you have the right to:
- be told what we hold about you and why — this notice;
- get a copy of it (a subject access request), free, within one month;
- have it corrected if it is wrong;
- have it deleted, where we do not need to keep it for tax or legal reasons;
- restrict or object to how we use it, including objecting to direct marketing at any time — and we must stop;
- take it elsewhere in a portable format;
- withdraw consent at any time, where consent is what we relied on.
To use any of these, email hello@runestone-vault.co.uk. We will not charge you and we will not make it difficult. We aim to respond well within the one-month legal deadline.
If you are unhappy with how we have handled your data, please tell us first and give us a chance to fix it. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Children
The Runestone Vault sells Pokémon and other products that appeal to children, so this matters here more than it does on most shops.
- We do not knowingly sell to, or collect data from, anyone under 18. Orders should be placed by a parent or guardian.
- We do not profile children, and we do not use behavioural or interest-based advertising at all — not on children, and not on anyone.
- If you believe a child has given us personal information, email us and we will delete it.
Security
The site runs over HTTPS. Card details never reach us. Access to the shop's admin is protected and limited to Jack and, during the build, the developer working on the site.
No system is perfectly secure, but if a breach ever happened that put your rights at risk, we would tell you and the ICO within the timescales the law sets.
Changes to this notice
If we change how we use your information we will update this page and change the date at the top. If the change is significant, we will email you about it rather than hoping you notice.