Privacy policy

Privacy Policy

Last updated: 2 August 2026

1. Who we are

This Privacy Policy explains how we collect, use, store and share personal information when you visit thefossilshop.co.uk, place an order, create an account, subscribe to marketing or otherwise communicate with us.

The controller responsible for your personal information is:

Michael Janicki, trading as The Fossil Shop

Business address:

27 Pinfold Road
Cayton
Scarborough
YO11 3BH
United Kingdom

Email: info@thefossilshop.co.uk

In this policy, “we”, “us” and “our” refer to the legal person or business operating as The Fossil Shop.

Our online shop is hosted by Shopify, which provides the ecommerce platform used to operate the website and process transactions.

2. The information we collect

Depending on how you interact with us, we may collect the following categories of personal information.

Contact and identity information

This may include:

  • your name;

  • billing and delivery addresses;

  • email address;

  • telephone number; and

  • account username or identifier.

Order and transaction information

This may include:

  • products you purchase;

  • your order number;

  • transaction dates and values;

  • delivery method;

  • payment status;

  • returns, refunds and cancellations;

  • gift-card use; and

  • previous orders associated with your customer account.

Payment information

Payments are processed by Shopify Payments and other payment providers made available during checkout.

We do not ordinarily receive or store your complete payment-card number. Payment providers may give us limited information such as:

  • payment status;

  • payment method;

  • card type;

  • the last digits of a payment card; and

  • transaction or fraud-prevention information.

Payment providers process payment information under their own terms and privacy notices.

Communications

We collect information you provide when you:

  • contact us by email;

  • use our contact form;

  • ask us to identify a fossil;

  • arrange a viewing;

  • submit a complaint;

  • request a return or refund; or

  • otherwise communicate with us.

Please do not send sensitive or confidential information unless it is necessary for us to deal with your enquiry.

Account information

If you create a customer account, we may process:

  • your account contact details;

  • saved addresses;

  • account preferences;

  • order history; and

  • account-security information.

Passwords and authentication credentials are handled through Shopify’s systems. We do not have access to your password in readable form.

Device and usage information

When you use the website, we or our service providers may collect:

  • IP address;

  • browser and device type;

  • operating system;

  • pages viewed;

  • referring website;

  • approximate geographic location;

  • interactions with products, the basket and checkout;

  • cookie identifiers; and

  • website diagnostic and security information.

Non-essential analytics information is collected only where the required consent has been provided.

Marketing information

If you subscribe to our newsletter, we may collect:

  • your email address;

  • the date and method of subscription;

  • your consent record;

  • whether emails are delivered or opened, where the email service provides this information;

  • links selected within our emails; and

  • your unsubscribe status.

3. How we obtain personal information

We collect personal information:

  • directly from you when you place an order, create an account, subscribe or contact us;

  • automatically through the website and cookies;

  • from Shopify and payment providers;

  • from delivery companies in connection with an order;

  • from analytics providers where you have consented;

  • from fraud-prevention and website-security services; and

  • from social-media platforms when you communicate with us through those platforms.

4. How and why we use personal information

We must have a lawful basis for each use of personal information.

Processing and fulfilling orders

We use your information to:

  • accept and process orders;

  • take or confirm payment;

  • deliver products;

  • send order and dispatch updates;

  • manage customer accounts;

  • provide customer service; and

  • process returns, refunds and cancellations.

Lawful basis: performance of a contract with you or taking steps at your request before entering into a contract.

Responding to enquiries

We use your information to answer questions, provide product information, help identify specimens and arrange viewings.

Lawful basis: taking steps at your request before entering into a contract, performance of a contract or our legitimate interest in responding to enquiries and providing customer service.

Accounting, taxation and legal compliance

We use and retain relevant information to:

  • maintain accounting and tax records;

  • comply with legal and regulatory obligations;

  • respond to lawful requests from courts, regulators or public authorities; and

  • establish, exercise or defend legal claims.

Lawful basis: legal obligation and, where applicable, our legitimate interest in protecting our legal rights.

Website operation and security

We use information to:

  • operate the website and checkout;

  • maintain shopping-basket functions;

  • authenticate accounts;

  • prevent fraud;

  • detect malicious activity;

  • troubleshoot errors; and

  • protect customers, our business and Shopify’s platform.

Lawful basis: our legitimate interest in operating a secure and functional ecommerce business. Where processing is necessary to complete an order, the lawful basis may also be performance of a contract.

Analytics

Where you consent, we use analytics information to understand:

  • how visitors find the website;

  • which pages and products are viewed;

  • how visitors navigate the website;

  • how the website performs across different devices; and

  • where the shopping experience might be improved.

Lawful basis: consent.

You may withdraw or change your consent through the Cookie Preferences link in the website footer.

Email marketing

Where you subscribe to our newsletter, we use your email address to send news, offers, product updates and related marketing.

Lawful basis: consent, unless another lawful basis for electronic marketing expressly permitted by law applies.

You may withdraw your consent at any time by:

Withdrawing consent does not affect order confirmations, dispatch updates or other non-marketing communications necessary to fulfil an order or provide customer service.

Legitimate interests

Where we rely on legitimate interests, those interests may include:

  • operating and securing our business;

  • preventing fraud and misuse;

  • responding to customer enquiries;

  • improving our services without using non-essential cookies;

  • protecting our legal rights; and

  • maintaining appropriate business records.

We consider whether the processing is necessary and balance our interests against your rights and reasonable expectations.

You may object to processing based on legitimate interests. We will consider your objection and stop the processing unless we have compelling lawful grounds to continue or the processing is needed for legal claims.

5. Cookies and analytics

Cookies are small text files stored on a device when a website is visited.

Essential cookies

Essential cookies support functions such as:

  • secure checkout;

  • shopping baskets;

  • account login;

  • payment processing;

  • fraud prevention;

  • website security; and

  • remembering privacy choices.

These cookies are necessary for the website to function and do not require consent where the applicable legal exemption applies.

Non-essential cookies

Non-essential cookies may include analytics or advertising cookies. These cookies are used only after you provide the required consent through our cookie banner.

You can accept, decline or manage non-essential cookies. You may change your decision at any time using the Cookie Preferences link in the footer.

Google Analytics 4

Where consent has been provided, we use Google Analytics 4, a service supplied by Google, to understand use of the website.

Google Analytics may process information such as:

  • pages visited;

  • approximate location;

  • browser and device information;

  • referral source;

  • interactions with the website; and

  • cookie or device identifiers.

We do not use Google Analytics to directly identify visitors by name. However, analytics information and identifiers may constitute personal or pseudonymous information under data-protection law.

Google Analytics event data associated with cookies and identifiers is retained for 2 months. User data is retained for 14 months. The user-data retention period resets when new user activity is recorded.

Google may process information outside the United Kingdom. Further information is available in Google’s Privacy Policy.

Cookie details

The cookie-preferences tool provides further information about the cookies currently used by the website, their providers, purposes and durations.

Because website services may change, we periodically review our cookie settings and this policy to keep them accurate.

6. Who we share personal information with

We share personal information only where necessary and where we have a lawful basis.

Recipients may include:

Shopify

Shopify hosts the website and provides ecommerce, account, checkout, order-management and related services.

Shopify may also process certain information for its own purposes, as described in the Shopify Consumer Privacy Policy.

Payment providers

Payment providers process payments, refunds, security checks and fraud-prevention information.

The payment providers available to you are displayed during checkout and may include Shopify Payments, PayPal, Klarna and digital-wallet providers.

Delivery providers

We share delivery information with Royal Mail or another courier used to fulfil an order.

The information normally includes the recipient’s name, delivery address and, where needed, contact details.

Technology and security providers

We may use providers that supply:

  • website hosting;

  • cloud storage;

  • customer-account functions;

  • email delivery;

  • fraud prevention;

  • technical support;

  • security monitoring; and

  • data backup.

Analytics providers

Where you have consented, relevant information may be shared with Google Analytics or another analytics provider disclosed through our cookie controls.

Marketing providers

If you subscribe to marketing, we may use Shopify or another email-service provider (Klayvio) to manage subscriptions and deliver emails.

Professional advisers and authorities

Where necessary, we may disclose information to:

  • accountants;

  • legal advisers;

  • insurers;

  • banks and payment providers;

  • law-enforcement bodies;

  • tax authorities;

  • courts;

  • regulators; and

  • other public authorities acting lawfully.

Business transfers

If the business or its assets are sold or transferred, relevant personal information may be disclosed to advisers and a prospective purchaser where lawful and appropriately protected.

We do not sell customer contact information to third parties.

7. International transfers

Some providers, including Shopify and Google, may process personal information outside the United Kingdom.

Where personal information is transferred to a country that is not covered by UK adequacy regulations, we require or rely on an appropriate safeguard where the law requires one. This may include:

  • the UK International Data Transfer Agreement;

  • the UK Addendum to the European Commission’s Standard Contractual Clauses;

  • another approved contractual safeguard; or

  • a legally recognised exception for a particular transfer.

Details of the transfer protections used by Shopify, Google and payment providers are available through their respective privacy information.

You may contact us if you would like more information about the safeguards relevant to your personal information.

8. How long we retain personal information

We keep personal information only for as long as reasonably necessary for the relevant purpose, including legal, tax, accounting and dispute-resolution requirements.

Our normal retention approach is:

Orders and financial records

Order, payment, refund, delivery and accounting records are normally retained for up to six years after the end of the relevant financial year or transaction, unless a longer period is legally required.

Customer accounts

Account information is normally retained while the account remains active. If an account is closed, relevant information may continue to be retained where needed for order records, legal compliance, fraud prevention or disputes.

Customer enquiries

General enquiries are normally retained for up to two years after the enquiry is resolved.

Enquiries connected to an order, complaint, legal claim or important provenance information may be retained with the relevant records for longer.

Marketing records

Active marketing-subscription information is retained until you unsubscribe or we cease the relevant marketing activity.

After you unsubscribe, we may retain a minimal suppression record so that we can respect your request and avoid sending further marketing.

Cookie-consent records

Cookie choices and related consent records are retained for as long as reasonably necessary to demonstrate and respect your choice.

Analytics information

Analytics information is retained according to the period stated in the Google Analytics section above.

Security records

Security, fraud-prevention and diagnostic records are retained for a period proportionate to the relevant risk, unless a longer period is required to investigate suspected fraud, misuse or a security incident.

When information is no longer needed, it is deleted, anonymised or securely disposed of.

9. Marketing choices

You have the right to object to direct marketing at any time.

You may unsubscribe from email marketing by using the unsubscribe link provided in every promotional email.

You can also contact info@thefossilshop.co.uk.

We may retain limited information on a suppression list to ensure that your marketing preference continues to be respected.

Opting out of marketing will not stop essential messages relating to an order, account, return, complaint or customer-service enquiry.

10. Your data-protection rights

Depending on the circumstances, UK data-protection law gives you rights including:

  • Access: to ask for a copy of personal information we hold about you.

  • Correction: to ask us to correct inaccurate or incomplete information.

  • Erasure: to ask us to delete information where there is no lawful reason to retain it.

  • Restriction: to ask us to restrict how information is used in certain circumstances.

  • Objection: to object to processing based on legitimate interests.

  • Direct marketing objection: to require us to stop using your information for direct marketing.

  • Portability: to receive certain information in a structured, commonly used and machine-readable format where the right applies.

  • Withdrawal of consent: to withdraw consent where we rely on consent.

  • Complaint: to make a complaint to us or the Information Commissioner’s Office.

These rights are not absolute. We may need to retain or continue processing information where the law permits or requires us to do so.

To exercise a right, email info@thefossilshop.co.uk.

Please provide enough information for us to identify you and understand your request. We may request reasonable proof of identity before disclosing or changing personal information.

We will normally respond within one month. The law permits an extension in certain circumstances, in which case we will explain the reason and expected timeframe.

You will not normally be charged for exercising your rights. A reasonable fee may apply where the law permits it, such as for a request that is manifestly unfounded or excessive.

11. Data-protection complaints

You may submit a data-protection complaint by:

  • emailing info@thefossilshop.co.uk with the subject “Data protection complaint”; or

  • writing to our business address.

Please explain:

  • what you believe happened;

  • when it happened;

  • which information is involved; and

  • what outcome you are seeking.

We will acknowledge your complaint within 30 days, investigate it appropriately and communicate the outcome without undue delay.

If we need further information, we will explain what is required.

If you remain dissatisfied, you may complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint

12. Children

Our website is intended for a general audience, but purchases must be made by a person legally capable of entering into a contract.

We do not knowingly use children’s personal information for marketing or profiling.

If you believe that a child has provided personal information without appropriate authority, contact us so that we can investigate and take appropriate action.

13. Security

We and our service providers use appropriate technical and organisational measures intended to protect personal information.

However, no internet transmission or storage system can be guaranteed to be completely secure.

You are responsible for keeping your account credentials confidential. Please contact us if you believe that an account or transaction has been accessed without authorisation.

14. Automated processing

Shopify, payment providers and fraud-prevention services may use automated systems to identify suspicious activity or assess transaction risk.

We do not ordinarily make decisions based solely on automated processing that produce legal or similarly significant effects without appropriate safeguards.

If an order is declined or delayed because of an automated security check, you may contact us for further information or request that the circumstances be reviewed where applicable.

15. Third-party websites

The website may link to services operated by other organisations, including social-media platforms.

Those organisations control their own websites and personal-information practices. We recommend reviewing their privacy notices before providing information to them.

We are not responsible for the independent privacy practices of third-party websites.

16. Changes to this policy

We may update this policy to reflect changes in our services, providers, legal obligations or personal-information practices.

The latest version will be published on this page with an updated date.

Where a change is significant, we will provide additional notice where required and reasonably practicable.

17. Contact us

For privacy questions, rights requests or complaints, contact:

Michael Janicki, trading as The Fossil Shop

27 Pinfold Road
Cayton
Scarborough
YO11 3BH
United Kingdom

Email: info@thefossilshop.co.uk