Last updated: 15 September 2026

This Privacy Notice explains how I collect, use, store and share personal information when you visit, contact or purchase from:

• 80s Kids UK at 80skids.uk; and
• Rachel’s Vintage & Retro at rachelsvintageretro.co.uk.

For the purposes of UK data-protection law, the data controller is Rachel Toy, trading as 80s Kids UK and Rachel’s Vintage & Retro.

Contact Details

Rachel Toy
Herne Cottage
Marsworth Road
Pitstone
Leighton Buzzard
Bedfordshire
LU7 9AP
United Kingdom

Email:

• rachel@80skids.uk
• rachel@rachelsvintageretro.co.uk

Personal Information I Collect

Depending on how you use the websites, I may collect:

Identity and contact information

• your name;
• billing and delivery address;
• email address;
• telephone number; and
• account username, if you create an account.

Order and transaction information

• products ordered;
• order value and delivery method;
• payment status and transaction reference;
• order history;
• returns, refunds and customer-service records; and
• correspondence concerning your order.

Payments are processed securely by WooPayments or PayPal. I do not normally receive or store your complete card or bank-account details, although I may receive limited payment information such as a transaction reference, payment status, payment method or the final digits of a payment card.

Account information

If you create a customer account, the website stores information needed to operate that account. Passwords are protected by the website system and are not visible to me in plain text.

Communications

I may collect information that you provide when you:

• send an email;
• use a contact form;
• ask a question;
• request customer support;
• submit a return or complaint; or
• leave a comment or review, where these features are available.

Marketing information

If you join a mailing list, I may collect:

• your name and email address;
• the date, time and method of sign-up;
• confirmation of double opt-in;
• your consent and marketing preferences;
• whether emails are delivered, opened or clicked; and
• unsubscribe or objection records.

Technical and usage information

When you visit either website, technical information may be collected automatically, including:

• IP address;
• browser and device type;
• operating system;
• pages visited and actions taken;
• referring website;
• approximate location derived from an IP address;
• cookie and advertising identifiers;
• shopping-basket and login information;
• cookie-consent choices; and
• security and firewall logs.

How I Collect Personal Information

I collect information:

• directly from you when you place an order, create an account, subscribe, contact me or use the website;
• automatically through website functions, cookies, security tools, analytics and similar technologies; and
• from service providers such as WooPayments, PayPal, Mailchimp, Google and Meta when they provide payment status, mailing-list activity, analytics or advertising information.

How and Why I Use Personal Information

Under UK data-protection law, I must have a lawful basis for using personal information.

Processing orders and providing customer service

I use identity, contact, order and transaction information to:

• process and deliver orders;
• take payment;
• provide order confirmations and updates;
• manage cancellations, returns and refunds;
• answer questions; and
• resolve problems or disputes.

The lawful basis is normally that the processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.

Meeting legal and regulatory obligations

I may use and retain information to:

• maintain tax and accounting records;
• comply with consumer-protection obligations;
• respond to lawful requests from public authorities;
• manage product-safety issues or recalls; and
• establish, exercise or defend legal claims.

The lawful basis is compliance with a legal obligation or, where appropriate, my legitimate interests in protecting the business and its legal rights.

Website operation, security and fraud prevention

I use technical, account and transaction information to:

• operate and maintain the websites;
• protect customer accounts and transactions;
• detect malicious activity, spam, fraud or attempted unauthorised access;
• investigate technical problems; and
• maintain the security and availability of the websites.

The lawful basis is my legitimate interest in operating secure, reliable websites and protecting customers and the business.

Analytics and website improvement

With the appropriate cookie or similar-technology consent, I use Google Analytics and related tools to understand how visitors find and use the websites and to improve their content, design and performance.

The lawful basis for storing or accessing non-essential information on your device and processing the resulting personal information is normally your consent.

Advertising

With the appropriate consent, Google AdSense and Meta Pixel may collect or receive information about visits, devices and interactions for purposes including:

• displaying and measuring advertising;
• limiting how often advertisements are shown;
• understanding advertising performance;
• identifying how visitors reached the websites; and
• personalising advertising where the visitor has agreed to this.

Google and Meta may combine this information with information they already hold, subject to their own privacy notices and the visitor’s settings.

The lawful basis for non-essential advertising cookies, pixels and the associated processing is normally consent.

Email marketing

I use Mailchimp to send email newsletters and marketing to people who have actively subscribed and completed the double-opt-in process.

Consent applies only to the brand or mailing list identified on the subscription form. Subscribing to 80s Kids UK does not automatically subscribe you to Rachel’s Vintage & Retro communications, and subscribing to Rachel’s Vintage & Retro does not automatically subscribe you to 80s Kids UK communications.

Customers are not automatically added to a marketing list merely because they place an order.

You may withdraw your consent at any time by clicking the unsubscribe link in an email or contacting me. Withdrawing consent does not affect the lawfulness of processing that occurred before it was withdrawn.

Sharing Personal Information

I do not sell customer mailing lists or contact details.

I share personal information only where reasonably necessary to operate the websites, fulfil orders, provide services or comply with the law. Recipients may include:

Website hosting and ecommerce

Hostinger provides website hosting and related infrastructure.

WooCommerce provides the ecommerce software used to manage products, accounts, baskets, checkout and orders. WooPayments and its payment partners process payments and associated fraud-prevention information.

Payment providers

WooPayments and PayPal process payments. Payment providers may act as independent data controllers for some of their activities and apply their own privacy notices.

Delivery providers

Royal Mail and any alternative carrier agreed with the customer receive the information needed to deliver an order, such as the recipient’s name and delivery address.

Email marketing

Mailchimp, operated by Intuit, stores subscriber information, consent records and email-interaction information and provides the mailing-list service.

Analytics and advertising

Google processes information through services including Google Analytics, Google AdSense and Google’s consent-management tools.

Meta may process information collected through Meta Pixel and related business tools.

The Google consent message may also identify additional advertising-technology providers used to deliver or measure advertising.

Website security

Wordfence, operated by Defiant Inc., helps protect the websites against malicious traffic, fraud and unauthorised access. This may involve processing IP addresses and other technical or security information.

Professional and legal recipients

Information may be shared with accountants, insurers, legal advisers, technical-support providers, regulators, HM Revenue & Customs, law-enforcement bodies or courts where reasonably necessary or legally required.

Relevant provider privacy information is available from:

• Hostinger: https://www.hostinger.com/legal/privacy-policy
• Automattic and WooCommerce: https://automattic.com/privacy/
• PayPal: https://www.paypal.com/uk/legalhub/paypal/privacy-full
• Mailchimp and Intuit: https://www.intuit.com/privacy/statement/
• Google: https://policies.google.com/privacy
• Google services on partner websites: https://policies.google.com/technologies/partner-sites
• Meta: https://www.facebook.com/privacy/policy/
• Wordfence and Defiant: https://www.wordfence.com/privacy-policy/

Cookies and Similar Technologies

The websites use cookies and similar technologies such as pixels, tags and local storage.

Strictly necessary technologies

These are required for functions such as:

• website security;
• remembering cookie choices;
• shopping baskets and checkout;
• customer accounts and login;
• payment processing; and
• maintaining website sessions.

Strictly necessary technologies do not normally require consent, but information about them must still be provided.

Analytics and advertising technologies

Google Analytics, Google AdSense, Meta Pixel and other non-essential technologies may collect information about browsing, devices and interactions.

These technologies are activated only where the required consent has been obtained. Visitors can accept, reject or manage their options through the consent message displayed on the websites.

Cookie choices can be changed or withdrawn at any time using the privacy or cookie-settings link displayed on the relevant website. Withdrawal does not affect processing that took place before consent was withdrawn.

Further information about individual advertising providers and purposes is available through the consent-management screen.

Browser settings can also be used to block or delete cookies, although blocking strictly necessary cookies may prevent parts of the shop from working correctly.

International Transfers

Some service providers, including Mailchimp, Google, Meta, PayPal, Automattic and Wordfence, operate internationally and may process personal information outside the United Kingdom.

Where UK personal information is transferred internationally, the provider and I must use an appropriate legal safeguard where required. Depending on the destination and provider, this may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to the European Commission’s Standard Contractual Clauses; or
• another legally recognised transfer safeguard.

Further information about international transfers and safeguards is available in the providers’ privacy notices listed above. You may contact me if you require more information about the safeguards relevant to your personal information.

How Long I Keep Personal Information

I retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute-resolution requirements.

The usual retention periods or criteria are:

• Order, payment and tax records: normally retained for up to six years after the end of the relevant tax or accounting period.
• Customer accounts: retained while the account remains active. An account may be deleted upon request, although transaction records may still be retained where legally necessary.
• Customer enquiries and correspondence: normally retained for up to two years after the matter is resolved, unless connected with an order, dispute or legal requirement requiring longer retention.
• Marketing subscriptions: retained while you remain subscribed. Consent records may be retained for as long as necessary to demonstrate how and when consent was obtained.
• Unsubscribe and objection records: a minimal suppression record may be retained so that I can honour your request not to receive further marketing.
• Security and technical logs: retained for a limited period based on security needs, provider settings and the need to investigate malicious activity.
• Cookie and analytics information: retained for the period stated in the cookie-consent tool or by the relevant provider.
• Comments or reviews: may remain while published unless removed or anonymised following a valid request.
• Website backups: information may remain temporarily in secure backups until those backups are overwritten under the normal backup cycle.

Information may be retained for longer where required by law or where reasonably necessary for an active dispute, investigation or legal claim.

Security

I take reasonable technical and organisational steps to protect personal information against accidental loss, unauthorised access, misuse, alteration or disclosure.

These measures include secure website hosting, access controls, software updates, payment providers and Wordfence security tools. However, no internet service can guarantee complete security.

Your Data-Protection Rights

Depending on the circumstances, UK data-protection law may give you the right to:

• ask for access to the personal information I hold about you;
• ask for inaccurate information to be corrected;
• ask for information to be deleted;
• ask for processing to be restricted;
• object to processing based on legitimate interests;
• object at any time to the use of your information for direct marketing;
• receive certain information in a portable format;
• withdraw consent at any time where processing relies on consent; and
• complain to the Information Commissioner’s Office.

Some rights are subject to legal limitations. For example, I may need to retain transaction information to comply with tax or legal obligations even if you ask for it to be deleted.

To exercise a right, contact me using either email address shown above. I may need to request enough information to confirm your identity. I will normally respond within one month.

Automated Decision-Making and Profiling

I do not use personal information to make solely automated decisions that produce legal or similarly significant effects upon customers.

Google, Meta and advertising partners may use information for advertising profiles and personalisation where consent has been provided. Their activities and controls are described in their privacy information and in the website’s consent-management screen.

Children’s Information

The websites are intended primarily for adults interested in nostalgia, collecting and shopping. They are not intended for children to make purchases or submit personal information independently.

I do not knowingly collect personal information directly from children. If you believe a child has provided personal information without appropriate parental or guardian involvement, please contact me.

Complaints

If you have concerns about how I use your personal information, please contact me first so that I can try to resolve the matter.

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/data-protection-complaints/

Changes to This Notice

I may update this Privacy Notice when services, legal requirements or data-processing practices change. The latest version will be published on both websites with its revision date.