Privacy notice

Last updated: 21 October 2026

This notice explains how we use your personal data when you visit vendsage.co.uk or buy from us, and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Who we are

Vendsage is run by Commercelia Ltd, a company registered in England and Wales (company number 13087198). Our registered office is Suite 109, 28a Church Road, Stanmore, England, HA7 4AW. Commercelia Ltd is the controller of your personal data.
For anything about your data, email support@vendsage.co.uk.

What we collect

When you place an order

• Your name, email address and delivery address.
• Your phone number, if you give it. It is optional and is passed to the courier for delivery.
• Any delivery note you type at checkout.
• What you ordered and paid, any discount code or store credit used, and how your order is progressing.
• The internet (IP) address and browser details your order was placed from, kept with the order to help us spot and investigate fraud.

When you pay

• We never see or store your full card number. Card payments are handled by Stripe, which tells us only limited details such as the card type and last four digits.

If you create an account

• Your email address, first name and a password, which we store only in a scrambled (hashed) form that cannot be read back.
• Anything you add later: surname, phone number, saved addresses (up to ten), wishlist, product reviews and return requests.
• The products you look at while signed in ("Browsing history"), kept for 90 days. You can remove items or clear it in your account. We keep no browsing history for shoppers who are not signed in.
• Your store credit balance and how it was earned and spent.

When you search, track an order or sign in

• The words you search for and how many results they returned. If you are signed in, the search is linked to your account.
• To protect accounts and the order tracker from guessing attacks, we record the email address and IP address of sign-in attempts (kept for 7 days) and of order-tracking attempts (kept for 1 day).

When you contact us

• Whatever you send us, such as your email address, message and any photos.

Basket reminders, stock and price alerts, and review requests

• Basket reminders: if you are signed in and leave items in your basket, we may send one reminder (at most two) with what is in it and a link back to it. As a guest you get one only if you tick "Email me a reminder if I don't finish" at checkout; the box starts unticked, and nothing is stored unless you tick it. We then keep your email address with that basket.
• Back-in-stock and price-drop alerts: if you ask on a product page, we keep your email address, the item and (for a price alert) its price at the time. We email you once to confirm; nothing else is sent unless you confirm. Then we email you once when the item is back or cheaper, and the alert ends.
• Review requests: about a week after your order arrives we may email you once, asking for an honest review of what you bought. The link lets you review those items without signing in. We never offer anything in return for a review, and every review is checked the same way whatever its rating.
• Photos with a review: if you add photos to a review, we keep them with the review. We remove location and camera details (EXIF data) from them, and they appear only once our staff have approved them.
• Every one of these emails has an unsubscribe link, and you can choose which you get on the email preferences page linked from each email, or in Account settings. Emails about your orders always come.

Visitor statistics

We count visits with our own software on our own server. We do not use Google Analytics or any other outside analytics service, and we set no cookie for it.

• For each page view we record the page address (without anything after a "?"), the type of device (phone, tablet or computer), the name of the website that sent you and whether the visit looks automated.
• To count visits without following you, we turn your IP address and browser details into a one-way code that changes every day, so your visits on different days cannot be linked.
• We look up the town your internet address belongs to, on our own server, using a location database file kept on that server. The address is not sent anywhere for this. We keep only the country, the town and the town's approximate position. The address itself is not kept.
• These statistics are kept for up to about 400 days and then deleted.

Why we use it, and our lawful basis

• To take payment and deliver your order, run your account, and handle returns, refunds and store credit: performing our contract with you (or taking steps at your request before one).
• To reply to your messages: our legitimate interest in helping our customers, or performing our contract where it concerns an order.
• To prevent fraud and keep the shop and accounts secure (order IP addresses, sign-in and tracking attempts): our legitimate interest in protecting our customers and our business.
• Visitor statistics and search words, to understand how the shop is used and improve it: our legitimate interest, using the minimum of data described above.
• Keeping accounting and tax records: our legal obligations.
• Publishing your product review and its photos: performing our agreement with you when you choose to submit one.
• Basket reminders: for signed-in customers, our legitimate interest and the "soft opt-in" for existing customers under the Privacy and Electronic Communications Regulations, with a free way to say no in every email and in Account settings; for guests, your consent, given by ticking the box at checkout.
• Back-in-stock and price-drop alerts: your consent, confirmed from the first email (double opt-in). You can withdraw it at any time with the link in the email.
• Review requests: our legitimate interest in hearing what customers think of what they bought, with a free way to say no in every email.

We do not send newsletters, and we do not make decisions about you by automated means that have legal or similarly significant effects.

Who we share it with

Only with those who help us run the shop, and only what each needs:

• Stripe, which processes card payments.
• Product Healer (producthealer.tech), the order-management service we use to pass orders to our suppliers. For items sent straight from a supplier, it receives the items ordered and your name, delivery address, phone number and email address, and deletes that address 30 days after the item is sent or the order is cancelled.
• Our suppliers and couriers, who receive what they need to pack and deliver your parcel.
• Our hosting and email providers, who store our data and deliver our emails.
• Professional advisers, HMRC and other authorities, where the law requires it, to establish or defend legal claims, or to prevent fraud.
• A buyer of our business, if it is ever sold, who would have to use your data in line with this notice.

We do not sell your personal data, and we do not run advertising pixels, ad networks or social media tracking on this shop.

Transfers outside the UK

Some of the companies above, such as payment providers and suppliers, may process your data outside the UK. Where they do, we rely on UK adequacy regulations, on the UK's International Data Transfer Agreement or Addendum, or, for a supplier sending your order, on the transfer being necessary to perform our contract with you. Contact us for more detail.

Links and content from other sites

Tracking links open the courier's own website or 17TRACK, a parcel-tracking service. Some product pages have a supplier's video, loaded from the supplier's server only when you press play, which (like any website) sees your IP address. These sites have their own privacy notices.

Cookies

We use only essential cookies and browser storage, for example to keep your basket and sign-in working. See our Cookie policy for the full list.

How long we keep it

• Orders: six years from the end of the financial year they belong to, for accounting and tax purposes.
• Your account: until you ask us to close it. We then delete your account details, saved addresses, wishlist and browsing history, and keep only the order records above.
• Browsing history: 90 days. Sign-in attempts: 7 days. Order-tracking attempts: 1 day. Visitor statistics: about 400 days.
• Basket reminders: your email address is kept with the basket for the basket's lifetime (30 days), then removed; only the counts (sent, used, turned into an order) are kept.
• Stock and price alerts: unconfirmed requests 7 days; other alerts until they are sent or stopped, then 90 days, then deleted.
• Your email choices: if you unsubscribe, we keep your email address on our "do not send" list so that we can honour it.
• Reviews and their photos: while the review is shown on the shop, or until you ask us to remove it.
• Messages to us: as long as needed to deal with your query and any follow-up.

How we protect it

The site is served only over an encrypted (HTTPS) connection, passwords are stored hashed, card details never reach our servers, and only staff who need it can use our admin area.

Your rights

You have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data corrected;
• have your data erased, where we no longer need it or have no lawful basis to keep it;
• restrict how we use it in certain circumstances;
• object to our use of it where we rely on legitimate interests;
• data portability: receive data you gave us, for a contract, in a machine-readable format.

To use any of these rights, email support@vendsage.co.uk. We may ask you to confirm your identity, for example by writing from the email address on your account or orders. We will reply within one month, or tell you within that month if we need longer (up to two further months, as the law allows). There is normally no charge.

Complaints

If you are unhappy with how we have used your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

Children

Our shop is not aimed at children, and we do not knowingly collect data from anyone under 13.

Changes to this notice

If we change this notice, we will publish the new version here with a new date.