Privacy policy
Last updated August 2026
Who is responsible for your data
PoppersRush is the data controller. If you want to ask anything about your data, or want it deleted, email [email protected].
What we collect
- Your name, email address, delivery address and phone number, so we can send your order.
- What you ordered and when, so we can support you and keep our accounts straight.
- Messages you send us through the contact form or live chat.
- Basic technical information such as your IP address, for security and fraud prevention.
We never see your card details. They go straight to our payment provider and never touch our servers.
Why we are allowed to hold it
To perform our contract with you (your order), to meet our legal obligations (tax and accounting records, kept for six years), and for our legitimate interests in preventing fraud and running the shop. Marketing emails only ever go out with your consent, and every one has an unsubscribe link.
Who we share it with
Only the companies that make the order happen: our payment provider, our delivery carrier, our email provider and our hosting provider. They act on our instructions and cannot use your data for their own purposes. We never sell your data to anybody.
How long we keep it
Order records for six years, because HMRC requires it. Marketing consent until you withdraw it. Contact messages for two years. Account details until you ask us to close the account.
Your rights
You can ask for a copy of what we hold, ask us to correct it, ask us to delete it where we are not legally required to keep it, and object to marketing at any time. Email us and we will deal with it within one month. If you are not happy with how we handle it you can complain to the Information Commissioner's Office at ico.org.uk.
Discretion
We know why discretion matters here. Packaging carries no branding, our emails have neutral subject lines where we can, and our staff will never discuss an order with anyone but the person who placed it.
