Our Privacy Policy

Introduction

Welcome to The Midnight Sun Apothecary.

We are a UK-based business offering wax melts and related products through our online store. We are committed to protecting your personal information and respecting your privacy.

This Privacy Policy explains what information we collect, how we use it, how it is stored, and the rights you have under UK data protection laws (UK GDPR and the Data Protection Act 2018).

If you have questions, you can contact us at: admin@themidnightsunapothecary.co.uk

Personal Data We Collect

We may collect and process the following personal data when you visit or make a purchase on our website:

INFORMATION YOU PROVIDE DIRECTLY

• Name
• Email address
• Billing and shipping address
• Order details (products purchased, order notes, etc.)
• Payment information (processed securely by third parties — see below)
• Marketing preferences (if you sign up for email updates)

INFORMATION COLLECTED AUTOMATICALLY

• IP address
• Browser type and device information
• Website usage data via cookies and analytics tools (if enabled)

We do not intentionally collect data from children under 13.

How We Collect Your Information

We collect information:

• When you place an order on our website
• When you contact us via email or forms
• Through cookies and tracking technologies
• Through secure third-party services that support store operations (e.g., GoDaddy, PayPal)
  
  

How We Use Your Information

We use your personal data to:

• Process, fulfil, and deliver your orders
• Manage payments and prevent fraud
• Communicate with you regarding orders or support enquiries
• Maintain records for tax and accounting purposes
• Improve our website and customer experience
• Send marketing emails only if you have opted in
  

We do not sell personal data or use it for automated decision-making.

Legal Bases for Processing (UK GDPR)

We process your personal information under the following legal bases:

• Contract – to process and deliver your orders
• Legal obligation – keeping financial and tax records
• Consent – for email marketing or non-essential cookies
• Legitimate interest – improving website performance and preventing fraud

Sharing of Personal Data

We only share your data when necessary to run our business and fulfil your orders. These third parties include:

• GoDaddy – website hosting, online store platform and security
• PayPal – secure payment processing
• Delivery carriers (e.g., Royal Mail) – to deliver your purchases

We do not share personal data with other organisations for their marketing or independent purposes. We will only share information if legally required (e.g., tax authorities, fraud prevention).

Data Storage, Security & Retention

• Your data is stored securely through GoDaddy’s hosting environment and our protected business records.
• Payment details are not stored by us — they are processed directly by PayPal.
• Order and contact data are kept for as long as necessary for operational, tax, and accounting requirements (typically 6 years, per UK HMRC guidance).
• We implement appropriate security measures to protect your data from unauthorised access, loss, or misuse.
  
  

International Transfers

Some service providers (such as GoDaddy or PayPal) may store or process data outside the UK. When this occurs, appropriate safeguards are in place to ensure your data remains protected, in accordance with UK GDPR requirements.

Your Data Protection Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Request correction of inaccurate information
• Request deletion of your data (when legally permissible)
• Withdraw consent (e.g., unsubscribe from marketing)
• Object to certain uses of your data
• Request data portability
• Make a complaint to the Information Commissioner’s Office (ICO)

You can exercise your rights by contacting us at: admin@themidnightsunapothecary.com

Third-Party Links

Our website may contain links to third-party websites. We are not responsible for their content or privacy practices. We encourage you to read their privacy policies.

Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be reflected with a new “Last Updated” date at the bottom of this page.

LAST UPDATED: 27/11/2025