Privacy & your data

Make a request or raise a concern

Email voxelvibesuk@gmail.com to ask for access, correction or deletion, or to make a privacy complaint. You do not need an account or special wording.

Please describe what you need. Do not send passwords, payment details or identity documents unless we have agreed a suitable identity-check method.

Who to contact

Casey Johnson and Nathan Cleary, trading as Voxel Vibes is responsible for the personal information described here (the data controller). For a privacy question, rights request or complaint, email voxelvibesuk@gmail.com or write to 34 Haggerston Road, Borehamwood, WD6 4BX.

What we collect and why

We receive information directly from you: your name and email; your delivery address when you order; your chosen products, quantities, personalisation and payment/order status; and enquiry details, measurements, links or optional photos you send. Messages about delivery, returns, complaints and privacy requests form part of our customer records. Our hosting and security services also handle connection information, such as IP addresses and sign-in or error records, to run and protect the service.

We use enquiry and order information to take steps you request before a contract and to perform the contract (UK GDPR Article 6(1)(b)). We use necessary transaction, tax and statutory-rights records to meet legal obligations (Article 6(1)(c)). We rely on legitimate interests (Article 6(1)(f)) for proportionate security, fraud prevention, managing non-contractual correspondence, maintaining service records and establishing or defending legal claims. These interests are running a reliable shop and protecting customers and the business; we consider your rights when using information for them.

The contact, specification and delivery fields marked as required are needed to answer your request or fulfil an order. Without them we may be unable to provide that service. Photos are optional. Do not send card details, passwords, identity documents or sensitive personal information through an enquiry. A parent or guardian should handle enquiries and purchases involving a child; avoid including a child’s photo, contact details or other unnecessary information.

We do not sell customer details or use them for advertising profiles. The shop does not make decisions with legal or similarly significant effects solely by automated means. Security checks may block a request; contact us if you need help.

Who receives information

Access within the business is limited to people who need the information to manage your request or order. Hosting and security services support the customer website and private dashboard. The current website uses OpenAI Sites and the private dashboard uses Cloudflare. If you email our Gmail address, Google processes the message as the email service provider. Necessary name and address details are shared with the delivery service used for your order.

When online payments are enabled, SumUp processes payment details and returns payment status and references to the shop; we do not receive your full card details. When automated transactional email is enabled, Resend processes the address and message needed to deliver your order or enquiry confirmation. No marketing mailing list is created by submitting a request or order.

We may disclose necessary records to professional advisers or public authorities where required by law or necessary to establish, exercise or defend legal claims. Customer enquiries and photos are not published on product pages without separate permission.

Where information is handled

Our hosting, security and email providers operate internationally, so information may be handled outside the United Kingdom. Their processing locations and transfer arrangements depend on the service used. Contact us for information about the providers, destinations and applicable transfer safeguards for your records. Provider privacy information is available at https://www.cloudflare.com/privacypolicy/, https://openai.com/policies/privacy-policy/, https://policies.google.com/privacy, https://www.sumup.com/en-gb/privacy/ and https://resend.com/legal/privacy-policy

How long we keep records

We keep information only while needed for its stated purpose, applicable legal duties or a documented dispute, safety issue or legal claim. Our retention periods are review points: an owner checks whether records can be deleted or anonymised and records any reason for keeping them longer. They are not automatic deletion promises.

Review targets are: closed enquiries after 12 months; optional request photos after 90 days from closure; abandoned unpaid checkout records after 30 days; accepted outgoing email copies after 30 days; security records after 90 days; and closed privacy cases after three years. An enquiry that becomes an order may need relevant specification details retained with that order. Records with an unknown closure date require an individual review.

Paid order, refund and contract records are reviewed against applicable tax-record obligations and legal-claim periods, rather than automatically erased. We aim to retain only the details needed for those purposes. Relevant records may be held longer for an active complaint, safety investigation, tax obligation or legal claim; we periodically review that need. Copies in business email accounts, hosting backups and other providers are also considered when handling a deletion request, and may have separate retention or backup cycles.

Your choices and rights

You can ask for access to your information, correction of inaccurate details, deletion or restriction where applicable, and a portable copy of information you provided where the legal conditions are met. You can object to processing based on legitimate interests. These rights have exceptions: for example, information needed for a legal obligation or claim may need to be retained. We explain the reason if we cannot fulfil a request. If we ever rely on your consent, you can withdraw it without affecting processing that was lawful before withdrawal.

Use the contact details above and describe the request; no special wording or paid service is required. We may need proportionate information to confirm your identity before disclosing or changing records. We normally respond without undue delay and within one calendar month. If a lawful extension or pause applies, we explain it and any next steps. We do not routinely charge for rights requests.

Privacy complaints

You can complain to us by email or post using the contact details above. Tell us what concerns you and how we can contact you; please include only relevant information. We acknowledge a data-protection complaint within 30 days, investigate without undue delay, keep you informed and explain the outcome. The acknowledgement deadline is separate from the deadline for a data-rights request.

You also have the right to complain to the Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/ or 0303 123 1113. You may contact the ICO if you are unhappy with our handling of your information or complaint.

Cookies and browser storage

The shop saves your basket, personalisation choices and recent private order links in this browser so you can use those features. Basket entries expire after 30 days without a change, and saved order links expire 30 days after first being saved. Expired entries are removed when you next visit, not while the browser is closed. An active checkout reference is held for the browser session. Use the privacy-page controls or clear the browser’s site data to remove saved information sooner. On a shared device, remove saved order links when finished; anyone with a private order link may be able to view its order details. Clearing browser storage does not cancel an order or delete business records.

Our shop code does not add advertising or analytics trackers. Hosting, payment and private sign-in services may use cookies or similar storage for their own security and requested functions. If optional tracking is introduced, this notice and the choices shown to you will be updated before it is used where consent is required.

Information saved on this device

Your basket expires after 30 days without a change. Saved order links expire after 30 days. Expired information is removed when you next use the shop; you can also remove it below.

Anyone using this browser may be able to open saved order links. Keep a copy of your private link or confirmation email before removing them.

These controls do not cancel an order, refund a payment or delete records held by the shop. Contact us to request access to, correction of or deletion of your customer information.