October 7, 2026

Privacy Policy

Introduction

This Privacy Policy explains how Haunts (“Haunts”, “we”, “us” or “our”) collects, uses, stores and protects your personal information when you visit hauntme.co.uk, place an order, create an account, contact us or otherwise interact with our website.

We are committed to protecting your privacy and handling your personal information in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

Who We Are and Data Controller

For the purposes of UK data protection law, the data controller is:

Haunts

10 Old Mill Lane
New Mill
Holmfirth
HD9 7LS
United Kingdom

Email: info@hauntme.co.uk

Website: hauntme.co.uk

Information We Collect

The personal information we collect depends on how you use our website.

Information You Provide to Us

When you place an order, create an account, contact us or otherwise use our website, we may collect information including:

Your first and last name
Email address
Billing address
Delivery address
Order and purchase information
Account username and account information, where you choose to create an account
Communications you send to us
Your marketing preferences
Information you provide when requesting a return, refund or other customer support

We only ask for information that is reasonably necessary for the relevant purpose.

Orders and Transactions

When you place an order, we collect and retain information necessary to process and fulfil your purchase. This may include your contact details, billing and delivery information, products ordered, order value, delivery method, payment status and information relating to returns or refunds.

We do not need to receive or store your full payment card details ourselves. Payments are processed through the payment services made available on our website.

Gift Orders

If you choose to send a Haunt as a gift, you may provide personal information relating to another person, such as their name, delivery address and a gift message.

Please only provide another person’s information where you are entitled to do so and where it is appropriate for us to use that information to fulfil your order.

We use gift recipient information only as necessary to prepare and deliver the gift and administer the order.

Customer Accounts

If you choose to create a customer account, we process the information required to create and maintain that account and provide account functionality, such as access to relevant order information.

You are responsible for keeping your account credentials confidential.

Information Collected Automatically

When you use our website, limited technical information may be collected automatically. Depending on your cookie choices and the services enabled on the website, this may include:

IP address
Browser and device information
Operating system
Pages visited
Referring website or source
Approximate/general location derived from technical information
Date and time of visits
Website interactions and performance information
Cookie and similar technology identifiers

Non-essential analytics or tracking technologies are only used where the required consent has been obtained.

How We Collect Your Information

We may collect personal information:

When you place an order
When you create or use a customer account
When you provide billing or delivery information
When you purchase a Haunt as a gift
When you contact us by email
When you request customer support, a return or a refund
When you choose to receive marketing emails
Automatically through essential website technologies
Through analytics and other non-essential cookies where you have given the required consent

How We Use Your Information

We may use your personal information to:

Process and fulfil your orders
Take and administer payments
Arrange delivery of your purchases
Send order confirmations, dispatch information and other transactional communications
Manage customer accounts
Process gift orders and gift messages
Respond to questions and customer-service requests
Administer returns, refunds, faulty or damaged goods and other after-sales support
Maintain appropriate financial, tax and business records
Prevent fraud and protect our website, customers and business
Maintain, troubleshoot and improve the website
Understand website usage and performance where analytics consent has been provided
Send marketing emails where you have chosen to receive them
Comply with our legal and regulatory obligations
Establish, exercise or defend legal claims where necessary

Our Lawful Bases for Processing

Under UK data protection law, we must have a lawful basis for processing personal information.

Depending on the circumstances, we rely on:

Contract – where processing is necessary to take steps at your request before a purchase or to fulfil our contract with you. This includes processing orders, taking payment, arranging delivery and dealing with returns or refunds.

Legal obligation – where we need to process or retain information to comply with legal requirements, including tax, accounting, consumer protection and other applicable obligations.

Legitimate interests – where necessary for our legitimate business interests and those interests are not overridden by your rights. This may include operating and securing the website, preventing fraud, providing customer service, maintaining appropriate business records and protecting or defending legal rights.

Consent – where you have made a genuine choice to permit particular processing, including optional email marketing and non-essential cookies or analytics where consent is required.

Where we rely on consent, you can withdraw that consent at any time.

Payments

Payments made through our website are processed using WooPayments and its underlying payment-processing infrastructure.

Payment providers process information necessary to authorise and complete transactions, prevent fraud and comply with applicable financial and legal requirements.

Haunts does not use your payment information for marketing purposes.

The payment provider’s own privacy terms may also apply to information it processes as part of providing its services.

Delivery and Fulfilment

We use the personal information necessary to deliver your order, including your name, delivery address and relevant order information.

Where necessary, this information may be shared with postal, courier or delivery providers solely for purposes such as fulfilling, tracking and resolving issues with your delivery.

If you provide a different delivery address or purchase an item as a gift, we will use the recipient information you provide for these purposes.

Email Marketing

You may choose to receive occasional emails from Haunts about news, new Haunt releases and other updates.

Marketing is optional and is separate from communications necessary to process and administer your orders.

Where we ask for consent to email marketing, the marketing option is not selected automatically. If you opt in, we keep a record of your marketing preference.

You can withdraw your consent and unsubscribe from marketing at any time. Once our email marketing service is active, marketing emails will include an unsubscribe option. You may also contact us at info@hauntme.co.uk.

Withdrawing from marketing will not affect transactional communications that are necessary to administer an order, account, return, refund or other customer-service matter.

We intend to use Mailchimp to manage email marketing. When active, relevant information such as your email address and marketing preferences may be processed through Mailchimp for this purpose.

We do not sell your information or provide it to unrelated organisations for their own direct marketing.

This approach reflects the ICO’s guidance that marketing to individuals generally requires specific consent unless the requirements of a relevant exception are satisfied, and that consent can be demonstrated through a clear positive action such as an opt-in box.

Cookies and Analytics

Our website uses cookies and similar technologies for purposes including operating the website, maintaining shopping basket and checkout functionality, security, remembering appropriate preferences and, where permitted, understanding how the website is used.

We use Complianz to manage cookie information and consent choices.

We may use Google Analytics 4 (GA4), including through MonsterInsights and/or Google Tag Manager, to help us understand website traffic, usage and performance. These services may process technical information such as device and browser information, pages visited, interactions and related analytics data.

Non-essential analytics and tracking technologies will only be activated where the required consent has been obtained through our cookie consent system.

You can change or withdraw your cookie choices using the cookie settings available on our website.

Further information about the cookies and similar technologies used on the website is provided in our Cookie Policy.

Current ICO guidance says non-exempt storage/access technologies should not be pre-enabled and users should receive clear information about their use, which is what the Complianz setup should be configured to achieve.

Search and Website Performance Services

We may use services including Google Search Console to understand how our website appears and performs in search results and to identify technical website issues.

These services are primarily used to manage and improve the website rather than to send marketing communications to individual customers.

Website Hosting, Security and Backups

We use third-party infrastructure and services to operate, secure and maintain the website.

These may include:

Website hosting providers
WordPress and WooCommerce
Wordfence for website security
UpdraftPlus for website backups
Website email-delivery services
Technical, maintenance and performance services

As a result, personal information may be stored in website databases, server logs, security records or backups where necessary for those services to function.

Backups are retained and deleted according to our backup and security arrangements and are used for purposes such as restoring the website following data loss, corruption, security incidents or technical failures.

Who We Share Your Information With

We do not sell or rent your personal information.

Where necessary, we may share information with trusted service providers and other recipients, including:

Payment processors
Postal and delivery providers
Website hosting and infrastructure providers
WooCommerce and ecommerce technology providers
Security, backup and technical service providers
Analytics providers, where appropriate consent has been obtained
Email marketing providers where you have opted into marketing
Professional advisers such as accountants or legal advisers where necessary
Government bodies, regulators, law enforcement or other parties where disclosure is required or permitted by law

We only share personal information where there is an appropriate reason to do so and limit the information shared to what is reasonably necessary for the relevant purpose.

Third-Party Services

Services used in connection with the Haunts website may include:

WooCommerce
WooPayments
Google Analytics 4
Google Tag Manager
Google Search Console
MonsterInsights
Complianz
Wordfence
UpdraftPlus
Mailchimp, for email marketing once implemented
Website hosting and email infrastructure providers
Delivery providers

Some providers act as processors on our behalf, while others may act as independent controllers for particular processing activities.

Their handling of information may also be governed by their own privacy policies.

International Data Transfers

Some of the technology and service providers we use are based outside the United Kingdom or may process or store information in other countries.

Where personal information is transferred outside the UK, we take steps to ensure that an appropriate mechanism or safeguard recognised under UK data protection law is used where required. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism.

You can contact us if you would like further information about the safeguards relevant to your personal information.

How Long We Keep Your Information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet our legal, accounting, tax and regulatory obligations.

Order and transaction records may therefore be retained after an order has been completed where they form part of the records Haunts is required to maintain.

As a sole trader, relevant business records generally need to be retained for at least five years after the 31 January Self Assessment submission deadline for the relevant tax year, although circumstances can require records to be retained for longer.

Other retention periods depend on the information concerned. For example:

Customer account information may be retained while the account remains active and for an appropriate period afterwards.
Customer-service and correspondence records may be retained for as long as reasonably necessary to deal with the matter and maintain appropriate business records.
Marketing information is retained while you remain subscribed or for as long as reasonably necessary to maintain a record of your marketing preference.
Security logs and technical information are retained according to operational and security requirements.
Information contained in backups may remain until the relevant backup is securely overwritten or deleted according to the applicable backup schedule.

Where information is no longer required, it will be deleted, anonymised or otherwise securely disposed of as appropriate.

Data Security

We take appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, destruction, alteration, unauthorised disclosure or access.

These measures may include access controls, website and server security, malware and firewall protection, software updates, secure payment processing, backups and procedures for responding to information-security incidents.

However, no website, internet transmission or electronic storage system can be guaranteed to be completely secure.

Your Data Protection Rights

Depending on the circumstances and the lawful basis on which we process your information, UK data protection law may give you rights including the right to:

Request access to your personal information
Ask us to correct inaccurate or incomplete information
Ask us to erase your personal information in certain circumstances
Ask us to restrict processing in certain circumstances
Object to certain processing
Receive certain personal information in a portable format where applicable
Withdraw consent at any time where processing is based on consent

These rights are not absolute and may not apply in every circumstance. For example, we may need to retain certain order information even following a deletion request where we have a legal obligation to keep it.

You have the right to object at any time to the use of your personal information for direct marketing.

The ICO specifically requires the right to object to be brought to people’s attention clearly and separately, so I would keep that final sentence visually prominent on the finished page rather than burying it in the list.

To exercise your rights, contact:

info@hauntme.co.uk

We may need to verify your identity before fulfilling certain requests.

Complaints

If you have concerns about how we use your personal information, please contact us first so that we have an opportunity to address them.

You also have the right to complain to the UK data protection regulator, the Information Commissioner’s Office (ICO).

Information Commissioner’s Office

Children’s Privacy

Haunts products are sold as decorative ornaments and are not children’s toys.

Our website and online store are not intended to collect personal information directly from children. If we become aware that personal information relating to a child has been provided in circumstances where it should not have been, we will take appropriate steps to address this.

Third-Party Links

Our website may contain links to websites operated by other organisations.

We are not responsible for the privacy practices, content or security of third-party websites. If you follow a link to another website, we recommend reviewing its privacy information separately.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our website, services, technology, legal requirements or the way we process personal information.

Any updated version will be published on this page and the “Last updated” date will be changed accordingly.

Contact Us

If you have questions about this Privacy Policy, how we use your personal information, or would like to exercise your data protection rights, please contact: