Policy / Privacy
What we hold about you, and what you can make us do with it.
Last updated 12 August 2026 · Governing law: England and Wales
Who is the controller
P .A. JEWELLERY LIMITED, 23 Commonside, Walkley, Sheffield, South Yorkshire, S10 1GD, is the data controller for the personal data described here.
For any data protection question, write to support@pajewelleryuk.shop with “Data protection” in the subject line, or post to the address above marked for the attention of the data protection contact.
What we collect, why, and on what basisLawful basis for each category
| Data | Purpose | Lawful basis | Retention |
|---|---|---|---|
| Name, delivery address, email address, telephone number | To take, fulfil and deliver your order and to contact you about it | Performance of a contract | 6 years from the end of the tax year of the order |
| Order contents, ring sizes, engraving text | To make and dispatch the correct articles | Performance of a contract | Order record 6 years; engraving text deleted 90 days after dispatch |
| Payment confirmation reference and the last four digits of the card | To reconcile payments, process refunds and investigate disputes | Performance of a contract; legal obligation | 6 years from the end of the tax year of the order |
| Contact form and group order enquiry content | To answer your enquiry | Legitimate interests — responding to someone who has written to us | 24 months from last contact |
| Email address for occasion notes | To send you the emails you asked for | Consent | Until you unsubscribe, then 12 months on a suppression list |
| Optional analytics — pages viewed, approximate region, device type | To see which guidance pages are read and where the shop confuses people | Consent, given through the cookie bar | 14 months |
We do not collect special category data, we do not profile you, and we do not take automated decisions that produce legal or similarly significant effects.
Engraving text is personal data
Initials, a name or a date that you ask us to cut into an article is personal data — sometimes about you, sometimes about someone else. We treat it accordingly.
- It is used to produce your article and for nothing else.
- It is read by a member of staff for the screening described in our engraving rules, and by the engraver.
- It is deleted 90 days after dispatch. After that the order record shows that an engraving was supplied, but not what it said.
- It is never used for marketing and never shared outside the workshop.
How long we keep it
Retention periods are in the table above. Order and payment records are kept for six years from the end of the relevant tax year because HMRC requires it. Everything else is kept for the period stated and then deleted or anonymised.
Who we share it with
We share the minimum necessary with the following categories of recipient, each acting as our processor under a written contract, or as an independent controller where indicated:
- Our payment provider. Card details are entered directly into the provider’s hosted, PCI DSS compliant form and are never received by, transmitted through, or stored on our systems. The provider is an independent controller for its own fraud prevention purposes. See payments and security.
- Delivery carriers. Your name, address, email and phone number, so the parcel can be delivered and tracked.
- Our email provider, to send order confirmations and, if you asked for them, occasion notes.
- Our hosting and database providers, who store the data on our behalf.
- Our accountants, and HMRC, where required by law.
- Law enforcement or a court, where we are legally obliged to disclose.
We do not sell personal data. We do not share it with advertising networks or data brokers.
International transfers
Some of our providers process data outside the United Kingdom. Where they do, the transfer is covered by UK adequacy regulations or by the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. You may ask us for details of the safeguards in place for any specific provider.
Your rights
Under the UK GDPR you have the right to:
- Be informed — this notice.
- Access a copy of the personal data we hold about you.
- Rectification of data that is inaccurate or incomplete.
- Erasure, where we no longer need the data and no legal obligation requires us to keep it.
- Restrict processing while a dispute about accuracy or legitimate interests is resolved.
- Data portability for data you gave us that we process by automated means on the basis of consent or contract.
- Object to processing based on legitimate interests, and to direct marketing at any time and absolutely.
- Withdraw consent at any time where consent is the basis — including by unsubscribing from any email or changing your cookie choice.
Write to support@pajewelleryuk.shop. We respond within one month and we do not charge. We may ask you to confirm your identity before we release data.
Complaining to the ICO
If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You also have the right to complain to the UK supervisory authority at any time:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline 0303 123 1113 · ico.org.uk/make-a-complaint
Security
- This site is served over HTTPS with HTTP Strict Transport Security.
- Card details are never handled by us. They go directly to a PCI DSS compliant payment provider from your browser.
- Access to the order database is restricted to named staff accounts with individual credentials and multi-factor authentication.
- Data is encrypted at rest and in transit.
- If a personal data breach is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours and tell you without undue delay where the risk is high.
See also our cookie notice for what is stored in your browser and how to change it.