The very short version: we use your address to post your orders, your email to confirm orders, and a small set of essential cookies to make the site work. With your consent, we also use analytics and advertising cookies to understand and improve our small shop over time. You can change your choice at any time. We don't sell or rent your data.
i. Overview
Tiny Patio LTD is fully compliant with the UK GDPR and the Data Protection Act. We act as the data controller for any personal information you provide through our store.
This policy explains what we collect, why, how long we keep it, and what rights you have. If you'd rather just talk to a human about your data, email privacy@tinypatio.com.
ii. Data we collect
When you place an order
- Name & shipping address: to post your order
- Email: to send order confirmation & tracking
- Phone (optional): only if you provide it, used by the carrier on delivery day
- Order history: what you bought and when
Your payment card details are never seen by us. They go directly to our secure payment processor (Shopify Payments or PayPal), who handle the transaction and pass us only a confirmation.
When you create an account
- Your name, email, and (encrypted) password
- Saved addresses, order history
- Newsletter preference
When you join a waiting list
Some pieces aren't in the shop yet; others have sold out. Either way, you can ask us to email you the moment that piece is back and ready to order. That is all a waiting list is.
- Email: so we can send you that one message when the piece can be ordered
- Which piece you asked about: so we write to you about the right one, and only that one
What it isn't: joining a waiting list is not an order. It doesn't reserve anything for you, it doesn't hold a price, and you pay nothing now. You're simply asking to be told when you can buy it — and you're free to do nothing when that email arrives.
It's also separate from the newsletter. A waiting list signs you up for that one email and nothing else. If you'd also like our occasional letter there's a tickbox on the same form — it starts unticked, and we won't tick it for you.
When you browse
Strictly-necessary cookies always. Then, only if you say yes on the cookie banner, analytics and advertising cookies. These analytics cookies show us what people find useful and what isn't working, so we can improve the shop over time. All sensitive inputs (such as passwords) are automatically masked and never visible to us. The advertising ones let us understand whether our ads are reaching the right people, and may be used to show you our items on other websites. Say no and they never load. See section v.
iii. Why we use it
| Use | Legal basis |
|---|---|
| Posting your order, processing payment, customer support | Contract (Art. 6(1)(b) UK GDPR) |
| Sending order confirmations and shipping updates | Contract |
| Tiny Patio's occasional newsletter | Consent (Art. 6(1)(a)) |
| Telling you a waiting-list piece has arrived | Consent (Art. 6(1)(a)) |
| Fraud prevention & site security | Legitimate interest (Art. 6(1)(f)) |
| Tax records (HMRC requires 6 years) | Legal obligation (Art. 6(1)(c)) |
| Anonymous traffic analytics | Consent |
| Advertising & measuring our Facebook / Instagram ads (Meta Pixel & Conversions API) | Consent (Art. 6(1)(a)) |
| Advertising & measuring Google Ads (including Enhanced Conversions) | Consent (Art. 6(1)(a)) |
| Anonymous interaction analytics (Microsoft Clarity) | Consent (Art. 6(1)(a)) |
v. Cookies
A cookie is a small text file stored by your browser. We use as few as possible.
| Cookie | Type | Purpose | Expires |
|---|---|---|---|
cart |
Essential | Stores your basket | Until you clear it |
_shopify_* |
Essential | Keeps the checkout working | Session / 30 days |
secure_customer_sig |
Essential | Keeps you signed in | 30 days |
_y / _shopify_y |
Analytics | Anonymous visitor counts | 1 year |
_clck |
Analytics | Persists the Clarity User ID and settings unique to that store | 1 year |
_clsk |
Analytics | Connects multiple page views by a user into a single anonymous browsing session | 1 day |
CLID |
Analytics | Identifies the first time Clarity saw this user on any site using Clarity | 1 year |
_fbp |
Marketing | Meta (Facebook / Instagram) ad measurement | 3 months |
_fbc |
Marketing | Remembers which ad you clicked - set only if you arrive from a Meta ad | 3 months |
_gcl_au |
Marketing | Google Ads conversion tracking and ad performance measurement | 3 months |
_gac_* |
Marketing | Stores ad campaign information to accurately measure conversion actions | 3 months |
The analytics and marketing cookies load only if you accept on the cookie banner. Decline and they are never set - nothing on the site breaks. You can change your mind at any time (see below).
vi. Cookie settings
You can change your cookie preferences through the consent banner shown on your first visit, or at any time afterwards using your browser's cookie controls. Essential cookies cannot be turned off - without them the site can't keep your basket or sign you in. Analytics and marketing cookies stay off until you opt in, and you can withdraw your consent just as easily as you gave it.
If you'd like us to delete any analytics or advertising data associated with your visit, email privacy@tinypatio.com.
vii. Retention
We keep your data only as long as needed for the purpose we collected it:
- Order & tax records: 6 years (HMRC requirement)
- Account data: until you close your account, then 30 days
- Newsletter subscription: until you unsubscribe
- Waiting lists: until the piece arrives and we've written to you, then 6 months — or straight away if you ask us
- Analytics (Google Analytics): user and event data kept by Google for up to 14 months
- Advertising data (Meta): held by Meta under their own retention policy, typically up to 2 years; we keep no advertising identifiers ourselves
- Advertising data (Google): performance and conversion measurement data held by Google under the Google Ads Data Retention Policy (granular reporting for 37 months and aggregated data for up to 11 years); we store no raw advertising identifiers ourselves
- Anonymous site interaction data (Microsoft Clarity): aggregated usage maps and anonymized session replays are retained for up to 13 months, after which they are automatically deleted.
viii. Your rights
Under the UK GDPR, you have the right to:
- Access: ask for a copy of your data
- Rectification: correct anything inaccurate
- Erasure: ask us to delete your data ("right to be forgotten")
- Restriction: limit how we use it
- Portability: receive your data in a portable format
- Objection: object to certain uses, e.g. legitimate interest
- Withdraw consent: at any time, without affecting prior lawful use
To exercise any of these, email privacy@tinypatio.com. We'll respond within one month, usually much sooner.
ix. Contact & complaints
Privacy questions: privacy@tinypatio.com
You also have the right to complain to the UK Information Commissioner's Office if you're unhappy with how we've handled your data: ico.org.uk · 0303 123 1113
