What I know about you.

Who is responsible

The data controller is Urban Light Company, 4 Shephards Place, Reading, RG8 7GB. Questions, requests and complaints all go to info@urbanlightcompany.co.uk, where they reach a person rather than a queue.

ICO registration: [registration number to be confirmed]

What I collect, and why

When you buy something

Your name, email address, delivery address and phone number. I need these to make the light, post it to the right house, and tell you where it is.

Lawful basis: performance of a contract. There is no way to send you a parcel without knowing where you live.

I never see your card details. Payment happens on Stripe’s own checkout pages. Your card number is entered on Stripe’s systems and never touches mine — all I get back is the last four digits and confirmation that it worked.

When you email me

Whatever is in the email, for as long as the conversation is useful.
Lawful basis: legitimate interests — answering someone who has asked me a question.

When you visit the site

Nothing identifying, unless you agree to it. The site loads Google Analytics only after you accept analytics cookies on the banner. Decline, or ignore the banner, and no analytics scripts load at all — this is not the common arrangement where the tracker fires anyway and the banner is decoration.

Lawful basis: consent, which you can withdraw at any time by clearing this site’s data in your browser.

Separately, the hosting platform keeps ordinary server logs — IP address, page requested, timestamp — for a short period, for security and to work out why something broke. That is legitimate interests, and it happens on every website you have ever visited.

Cookies and similar

• ulc-cookie-consent — stored in your browser to remember what you chose on the banner, so you are not asked twice. It contains your answer and nothing else. Strictly necessary, so it does not itself need consent.
• Google Analytics cookies (_ga and similar) — only set if you accepted. They measure how many people visit and which pages they read. Typically expire after two years.
• Stripe cookies — set on Stripe’s checkout pages, not mine, and used to process your payment and prevent fraud.

There are no advertising cookies, no Meta pixel, and no third-party trackers beyond the two above.

Who else touches your data

These are processors: they handle data on my instructions, for the purposes below, and nothing else.

• Stripe — takes the payment and handles refunds. They are the ones holding your card details, under their own privacy policy and PCI obligations.
• Supabase — the database your order is stored in.
• Vercel — hosts the website and serves these pages.
• Resend — sends the order emails.
• Google Analytics — only if you consented.
• Google Customer Reviews — when you place an order, your email address and the expected delivery date are sent to Google so it can ask you to rate the purchase after it arrives. You are shown a box on the confirmation page asking whether you want this, and declining changes nothing about your order. If you accept, Google emails you once. Your review is published as a star rating without your name attached.
• The delivery carrier — gets your name and address, because otherwise the light stays in my workshop.

Some of these are American companies and your data may be processed outside the UK. Where that happens it is covered by the UK International Data Transfer Agreement or equivalent safeguards.

Nobody else gets it. I do not sell customer lists, share them with advertisers, or pass them to anyone for marketing.

How long I keep it

• Orders and invoices — six years. Not my choice: HMRC requires business records to be kept for six years, and the limitation period for a contract claim is the same.
• Emails — as long as the conversation is live, then cleared out periodically.
• Analytics — up to fourteen months, and aggregated rather than tied to a name.

Marketing

I do not currently send a newsletter. If that changes, I will ask you to opt in — buying a light will not sign you up to anything.

What you can ask for

Under the UK GDPR you have the right to:

• see a copy of everything I hold about you;
• have anything wrong corrected;
• have it deleted, so long as I am not legally required to keep it — the six-year record-keeping rule above does override this for order records;
• object to, or ask me to restrict, how it is used;
• get your data in a portable format;
• withdraw consent for analytics at any time.

Email info@urbanlightcompany.co.uk and I will deal with it within a month. It is free, and you do not have to explain why.

If I get it wrong

Tell me first and I will try to put it right. If you are still not happy you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. Complaining to them does not cost you anything and does not require you to have complained to me first.

Children

This shop is not aimed at children and I do not knowingly collect data about anyone under 16.

Changes

If this policy changes materially I will update the date at the bottom of this page. It is worth a look before you order if it has been a while.