Privacy & cookies

Who is responsible for your information

Rammani Mandal, trading as Heritage in Hues, is the controller of customer information. The UK and Indian operations are part of the same sole-trader business.

See our business information for legal names and addresses. Contact support@heritageinhues.com [Pending: mailbox activation] or use Privacy requests.

What we collect and why

We use your name, email, delivery and billing addresses and phone numbers, ordered items, amounts, delivery details and payment references to take payment, fulfil orders, provide support and manage returns. Account information includes your email, profile name, saved addresses and sign-in records. We receive payment status and transaction references from payment providers, rather than full card numbers or card security codes. Required checkout fields are needed to process the order; optional fields are labelled.

Under UK/EU data-protection law, our bases include taking steps at your request and performing the purchase/account contract; legal obligations for tax and accounting records; and legitimate interests in proportionate security, fraud prevention, service administration and handling legal claims. For legitimate interests, we consider your rights and reasonable expectations. We use consent for optional analytics and subscribed marketing. Other applicable laws may use different grounds; we obtain consent where required. Reading or accepting the terms does not provide marketing or analytics consent.

Accounts and sign-in

Firebase Authentication manages email-link and Google sign-in. Email sign-in links are delivered through Resend, are single-use and expire after 30 minutes. We do not store account passwords. For passkeys we store a public key, credential identifier, account association and usage dates. The private key, biometric verification and device PIN stay with your device or passkey provider. You can remove passkeys from your account. Temporary passkey challenges expire after five minutes and are cleaned up along with expired email-link verification records. Administrative access requires stronger verification.

Marketing emails and saved-bag reminders

One marketing mailing list

Marketing is optional. Every marketing signup, including Notify Me for a product launch, joins the same list for occasional newsletters, offers, product launch announcements and other Heritage in Hues marketing emails. You join only after requesting and confirming your subscription. We do not sell your personal information. We record the email address, source, consent wording/version and request/confirmation dates. We do not subscribe customers automatically. Authorised owners can export confirmed subscribers to send the marketing you requested. Each marketing email must offer a direct unsubscribe link, usable without signing in. Unsubscribing stops all marketing emails, including launch announcements, newsletters and offers. It does not stop essential order or account messages.

If you have an active confirmed subscription and provide your email at checkout, we may send a saved-bag reminder after an hour of inactivity, subject to suppression and frequency checks. The recovery link lasts seven days and restores items and currency, not account, address or payment details. Withdraw consent using the unsubscribe link or by contacting us. Withdrawal does not affect earlier lawful processing.

Suggestions and costume enquiries

Our message box records your name, email, selected topic, message and our reply history so we can respond to suggestions, questions, costume enquiries and consultation requests. Authorised owners manage these messages and send replies by email. The dedicated consultation form also requires your phone number so we can contact you for the call. A consultation request does not book a time automatically; we arrange it with you by email. Message details are not used to subscribe you to marketing.

Cookies and optional analytics

Essential storage supports your bag, authentication, security and preferences. With your separate analytics permission, Google Analytics through Firebase receives sanitised page information and shopping events such as product identifiers, quantities, currency, amounts and purchase transaction identifiers, plus technical/device information. We do not send your email, addresses, credentials, full payment details or private-link tokens to Analytics. Advertising signals and personalisation are disabled. With analytics permission, our first-party shopping monitor also records a pseudonymous session label, public pages, shopping stages, item counts and a short event history for authorised staff. It does not store account, cart or order identifiers, email addresses, IP addresses or browser user agents in that visitor history. The hih_activity session cookie expires after 30 minutes of inactivity, and visitor history is removed after 24 hours of inactivity. Withdrawing analytics permission removes the session cookie and visitor history, apart from a temporary deletion marker to prevent in-flight events from recreating it. See our cookie policy and Cookie settings to change your choice. Withdrawing permission stops future collection; contact us about information already collected.

Complaints and privacy requests

We record your name, email, country, request type, order reference if provided, message, correspondence, verification notes and our response history. We use this to handle the request, meet applicable legal duties and establish or defend legal claims. Access to the request queue is restricted to authorised owners. We do not use request details for marketing.

Who receives information

Google Firebase/Google Cloud provides hosting, database, storage and authentication. Google provides Google sign-in, verification services and consented analytics. Resend sends transactional and requested marketing-related emails and supports our incoming email service. Stripe handles checkout and tax calculation; where Razorpay is selected, Razorpay processes the payment and Stripe still calculates applicable tax. Delivery carriers and fulfilment providers receive the details needed to deliver your purchase. Professional advisers and authorities receive information where necessary and lawful. Service providers may act as our processors or as independent controllers for some activities under their own notices. We do not sell your personal information.

Reviews

If you choose to submit a review, we collect your feedback, selected product and public display name, plus any optional title or role and profile photo you provide. We ask your permission before publishing your feedback, display name, title or role and profile photo on our website. Your email and order details are not displayed with the review. Reviews are checked before publication. You can contact us to request correction or removal.

International processing

[Pending: actual processing locations, UK/India access and applicable international-transfer safeguards]

How long we keep information

Order, payment-reference and accounting information: For the period required by the tax and accounting law applicable to the transaction. UK self-assessment records are normally retained for at least five years after the 31 January submission deadline for the relevant tax year; longer periods can apply to late returns, investigations or other legal duties. We review the applicable Indian record-keeping requirements and retain records for the longer period where both regimes apply. We retain information for ongoing claims or investigations where necessary, then erase or minimise it when no longer needed.

Account and security information: While your account remains open, or until you request deletion subject to lawful retention exceptions. We review accounts with no activity for 24 months and remove information no longer needed. Security and audit records are reviewed for continuing necessity; records needed for an investigation or legal claim are retained until that purpose ends.

Analytics data: [Pending: configured analytics retention period]

Customer-request records are scheduled for deletion 24 months after resolution unless a documented legal hold requires longer retention. Reopened cases remain while they are being handled. Request-email contents in our outbox are removed after 30 days; minimal delivery metadata may remain for operational records. Our email provider has its own retention arrangements.

Older release-only consent records are retained as evidence of the original choice; they are not added to the shared marketing list without a fresh signup. Old launch confirmation links are retired and expired pending records and messages are cleaned up. Resolved visitor messages and their reply history are removed after the customer-request retention period stated above.

Pending newsletter confirmations expire after 48 hours and expired requests are cleaned up. Welcome-message contents are removed from the outbox after 30 days. Active marketing subscriptions remain while you subscribe. Following unsubscribe, we retain a minimal suppression and consent record to honour your choice and demonstrate its history. Saved-bag contact/reminder records are removed after 30 days of inactivity; reminder email and recovery records are removed after 30 days. Sign-in email content is removed from our outbox after 24 hours while delivery metadata remains. Review invitation links expire after 30 days, and their private token records and invitation email contents are then scheduled for removal. We retain an order-level request marker to avoid repeated invitations. Submitted reviews remain until removed by an admin or in response to an applicable correction or removal request. Cookie durations are listed in our cookie policy.

Your choices and rights

Depending on the law and processing involved, you can request access, correction, erasure, restriction, portability, object to processing including direct marketing, or withdraw consent. Use Privacy requests or email support@heritageinhues.com [Pending: mailbox activation]. We explain the identity checks, deadlines, exceptions and complaint routes in our complaints policy. You may complain to the ICO or another competent data-protection authority and seek judicial remedies where available.

Children

Our purchasing and account services are intended for adults. An adult may purchase books for children. We do not ask for a child’s name, date of birth or profile to sell a book. Contact us if you believe a child has submitted personal information so we can assess and address it.

Changes

The version and update date are shown on this page. We update this notice when our practices change and provide additional notice where required. A change to this notice does not by itself authorise a new use requiring consent.