Privacy policy
Last Updated: 12.05.2026
Introduction
Caboodle it Ltd ("we," "us," "our") is committed to protecting your privacy and ensuring your personal information is handled safely and responsibly.
This Privacy Policy (the “policy”) explains how we collect, use, store, and protect your personal data when you visit our website, place an order, or interact with our services. It also outlines your rights regarding your personal information.
By using our website or services, you agree to the collection and use of information in accordance with this policy.
Data Controller:
Caboodle it Ltd
Company No: 16435338
Registered office:
Cotton Court
Church Street
Preston
PR1 3BY
Email-info@caboodle.it.com
As data controller, we decide how and why your personal data is used. We take our responsibilities under UK data protection law seriously.
1. Information We Collect
We collect and process the following types of personal data:
1.1 Information You Provide Directly
When you place an order or contact us, you may provide:
• Contact Information: Full name, email address, phone number
• Delivery Information: Shipping address, postcode
• Billing Information: Billing address (if different from shipping address)
• Order Details: Product selections, customisation preferences (names, ages, dates, themes)
• Communication Records: Any correspondence with us via email, phone, or contact forms
1.2 Information We Collect Automatically
When you visit our website, we may automatically collect:
• Technical Information: IP address, browser type and version, device type, operating system
• Usage Data: Pages visited, time spent on pages, links clicked, referring website
• Cookies and Similar Technologies: See Section 8 for details
1.3 Information from Third Parties
We may receive information about you from:
• Payment Processors: Transaction confirmation (but not full card details- see Section 5)
• Courier Services: Delivery status updates
• Marketing Platforms: If you interact with our social media or email campaigns (only if you've opted in)
1.4 Children's Privacy
Our products include items designed for children's celebrations. However, we do not knowingly collect personal data directly from children under 13. All orders must be placed by adults aged 18 or over.
If you believe we have inadvertently collected information from a child under 13, please contact us immediately, and we will delete it.
2. How We Use Your Information
We only use your personal data where we have a lawful basis to do so. We collect and use your personal data for the following purposes:
2.1 Order Processing and Fulfilment
Legal Basis: Contract performance
• Processing and fulfilling your order (including made-to-order personalised products)
• Customising products according to your specifications
• Arranging delivery through our courier partners
• Sending order confirmations and updates
• Handling returns, refunds, or replacements (where applicable)
2.2 Customer Service
Legal Basis: Contract performance and legitimate interests
• Responding to your enquiries and support requests
• Resolving complaints or issues
• Providing information about our products and services
2.3 Legal and Compliance Obligations
Legal Basis: Legal obligation
• Maintaining records for accounting and tax purposes
• Complying with legal requirements (e.g., consumer protection laws)
• Detecting and preventing fraud
2.4 Marketing Communications (With Your Consent)
Legal Basis: Consent
If you have opted in to receive marketing communications, we may use your email address to send you:
• Information about new products and collections
• Special offers and promotions
• Celebration inspiration and styling tips
• Updates about Caboodle it
We record your consent at the point of subscription. You can opt out at any time by clicking "unsubscribe" in any marketing email or contacting us directly.
2.5 Website Improvement and Analytics
Legal Basis: Legitimate interests
• Understanding how visitors use our website
• Improving website functionality and user experience
• Analysing trends and customer preferences
• Testing new features
3. Legal Basis for Processing
Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following:
• Contract Performance: Processing necessary to fulfil our contract with you (your order)
• Legal Obligation: Processing required to comply with legal requirements
• Consent: You have given clear permission (e.g., for marketing emails)
• Legitimate Interests: Processing necessary for our business operations, provided it doesn't override your rights. We ensure that our interests are balanced against your rights and freedoms
4. How We Share Your Information
We do not sell, rent, or trade your personal information to third parties. We share data only where necessary and for specific purposes with:
4.1 Essential Service Providers
Courier/Delivery Services: We share your name, delivery address, and phone number with our courier partners to deliver your order.
Payment Processors: We use secure third-party payment processors to handle transactions. We do not store your full payment card details (see Section 5 for further information).
Manufacturing Partners: We share customisation details (names, ages, themes) with our UK-based FSC-approved manufacturers to produce your order.
Email Service Providers: If you have opted in to marketing, we use email platforms to send communications.
Website Hosting and IT Services: Our website is hosted by third-party providers who may process technical data, as well as all order and customer data, for order management and to keep our site running securely.
All providers are used solely for the purposes described above. They are not permitted to use your data for their own purposes.
4.2 Legal Requirements
We may disclose your information if required by law, court order, or regulatory authority, or to:
• Protect our legal rights
• Prevent fraud or illegal activity
• Comply with legal obligations
4.3 Business Transfers
If Caboodle it is involved in a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you of any such change.
5. Payment Security
We do not store or have access to your full payment card details.
All payments are processed securely through our third-party payment provider, which is PCI DSS (Payment Card Industry Data Security Standard) compliant. This means your payment information is encrypted and handled according to industry-standard security measures.
We may receive confirmation of successful transactions and the last four digits of your card for reference purposes, but we never see your full card number, CVV, or expiry date.
6. How Long We Keep Your Data
We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy:
Order and Customer Data:
• Retained for 7 years from the date of your last order to comply with accounting, tax, and legal requirements
Marketing Communications:
• Retained until you unsubscribe or withdraw consent
• We will periodically review our marketing lists and remove inactive contacts
Website Analytics Data:
• Typically retained for 26 months (depending on the analytics platform used)
Correspondence and Complaints:
• Retained for 3 years after the issue is resolved for record-keeping and service improvement
After these periods, your data will be securely deleted or anonymized so it can no longer identify you, unless we are legally required or otherwise permitted to retain it for longer.
7. Your Rights Under UK GDPR
You have the following rights regarding your personal data:
7.1 Right to Access
You can request a copy of the personal data we hold about you.
7.2 Right to Rectification
If your information is inaccurate or incomplete, you can ask us to correct or update it.
7.3 Right to Erasure ("Right to be Forgotten")
You can request that we delete your personal data in certain circumstances, such as:
• When it's no longer necessary for the purposes we collected it
• You withdraw consent (for marketing)
• You object to processing, and we have no legitimate reason to continue
Note: We may be required to retain some information for legal or accounting purposes.
7.4 Right to Restrict Processing
You can ask us to limit how we use your data in certain situations.
7.5 Right to Data Portability
You can request a copy of your data in a structured, commonly used format to transfer to another service.
7.6 Right to Object
You can object to processing based on legitimate interests (e.g., for marketing purposes).
7.7 Right to Withdraw Consent
If we're processing your data based on consent (e.g., marketing emails), you can withdraw consent at any time.
How to Exercise Your Rights
To exercise any of these rights, please contact us:
Email: [your email address] Subject: Data Protection Request Phone: [your phone number]
We will respond to your request within one month. In some cases, we may need to verify your identity before fulfilling your request.
8. Cookies and Tracking Technologies
Our website uses cookies and similar tracking technologies.
What Are Cookies?
Cookies are small text files stored on your device when you visit our website. They help us provide our services and improve your experience and understand how our site is used.
Types of Cookies We Use
Strictly Necessary Cookies: These are essential for the website to function (e.g., remembering items in your shopping cart, enabling secure checkout). You cannot opt out of these cookies.
Performance and Analytics Cookies: These help us understand how visitors interact with our website (e.g., which pages are most popular). We use this information to improve our site. Example: Google Analytics.
Functionality Cookies: These remember your preferences (e.g., language settings, customisation choices) to provide a more personalized experience.
Marketing Cookies: These are used to show you relevant advertisements based on your interests. These are only deployed with your explicit consent via our cookie banner.
Managing Cookies
You can control or delete cookies through your browser settings. Most browsers allow you to view, block, or delete cookies from specific sites. Please note that disabling strictly necessary cookies may prevent you from completing a purchase. For more information,visit: www.aboutcookies.org or www.allaboutcookies.org
9. Data Security
We take appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or disclosure. Our security framework includes:
Platform Security: All data is hosted on the Shopify platform, which employs industry-standard encryption and maintains a secure environment for e-commerce.
Encrypted Transmission: We use Secure Sockets Layer (SSL) and Transport Layer Security (TLS) technology to encrypt all sensitive data transmitted through our website.
Secure Payment Processing: We use PCI DSS-compliant payment processors to ensure your financial details are handled according to the highest industry security standards.
Access Controls: We strictly limit internal access to personal data to only those employees or contractors who require it to fulfil your order.
Third-Party Compliance: We ensure that data processing agreements are in place with third-party service providers to maintain consistent protection levels.
Please note that while we strive to use commercially acceptable means to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
10. Third-Party Links
Our website may contain links to third-party websites (e.g., social media, partners, suppliers). We are not responsible for the privacy practices of these external sites.
We encourage you to review the privacy policies of any third-party sites you visit. This Privacy Policy applies only to information collected by Caboodle it.
11. International Data Transfers
Your personal data is primarily processed and stored within the United Kingdom.
If we need to transfer data outside the UK (for example, to a service provider based abroad), we will ensure:
• The destination country has adequate data protection laws, OR
• Appropriate safeguards are in place (e.g., Standard Contractual Clauses or other lawful transfer mechanisms approved under UK data protection law.)
12. Changes to this Privacy Policy
We may update this policy from time to time to reflect changes in our practices, legal requirements, or services.
When we make material changes, we will:
• Update the "Last Updated" date at the top of this policy
• Notify you via email (if you have provided your email address) or prominently on our website
Continued use of our website or services after changes are posted constitutes your acceptance of the updated policy.
We encourage you to review this policy periodically.
13. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:
Email - info@caboodle.it.com
Address
Caboodle it Ltd
Cotton Court
Church Street
Preston
PR1 3BY
Email - info@caboodle.it.com
Data Protection Enquiries: If your enquiry is specifically about data protection, please use the subject line "Data Protection Enquiry" so we can prioritise your request
14. Complaints
If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the UK's supervisory authority:
Information Commissioner's Office (ICO) Website: www.ico.org.uk
Helpline: 0303 123 1113 Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would appreciate the opportunity to address your concerns directly before you contact the ICO. Please reach out to us first so we can attempt to resolve the issue. We will investigate your concern and respond as quickly as possible.