Privacy Policy
In force from 20 October 2026
Controller: Harwelton LTD, St Ann's Road, Harrow, Middlesex HA1 1HS, United Kingdom. We decide what happens to the personal data described here, which means we are the one you hold responsible for it.
Data protection pages normally start with a list of what is collected. This one starts somewhere more useful: personal data moves because somebody asks for it. Your address goes to a courier because the courier asks. A cookie lands on your device because an analytics script asks. An invoice survives six years because HMRC asks. And you can ask too — that is what a data subject request is.
So this page is a list of the parties who ask us for your data, what each one gets, and what we refuse them. The last section is the one nobody asks for: the data we never collected at all.
1. YOU, ASKING ABOUT YOURSELF
You have the strongest claim of anyone on this page, and it costs you nothing to use.
| Right | What it means | Where it comes from |
|---|---|---|
| Access | A copy of what we hold, and the reasons we hold it | Art. 15 UK GDPR |
| Rectification | Correct anything wrong | Art. 16 |
| Erasure | Delete it, where no obligation requires us to keep it | Art. 17 |
| Restriction | Freeze processing while something is disputed | Art. 18 |
| Portability | Receive it in a machine-readable form, or have it sent on | Art. 20 |
| Objection | Object to processing based on legitimate interests — and to direct marketing at any time, with no grounds required | Art. 21 |
| Withdraw consent | For anything we do on the basis of consent, including cookies and marketing | Art. 7(3) |
| Human review | Not to be subject to a purely automated decision with legal or similarly significant effect | Art. 22 |
How: email support@harwelton.com. You do not need to mention a regulation or use the word "request".
We answer within one month (Art. 12(3)). If a request is genuinely complex we may extend by up to two further months, and we tell you inside the first month if we are doing so, with the reason.
It is free. We may charge only where a request is manifestly unfounded or excessive, which in a shop selling blankets we do not expect to happen.
We may ask you to confirm your identity — enough to be sure we are not handing your order history to a stranger, and no more than that.
If you are unhappy with how we handle it
Complain to us first. From 19 June 2026 we are required to operate a formal complaints procedure under the Data (Use and Access) Act 2025, and ours works as follows:
- an electronic route — email the address above, marked for the attention of data protection
- we acknowledge within 30 days
- we investigate and give you an outcome without undue delay, with the reasoning
Then, or instead, complain to the regulator. You never have to come to us first.
Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF 0303 123 1113 · ico.org.uk (The ICO is being reconstituted as the Information Commission under the 2025 Act; the complaint route is unaffected.)
2. OUR SHOP PLATFORM, ASKING TO RUN THE SHOP
Who: Shopify, which hosts the store.
What it holds: your name, email address, billing and delivery addresses, phone number, order contents and order history, and the technical records a web server keeps — IP address, browser, device type, pages viewed.
On what basis: performance of our contract with you (Art. 6(1)(b)) for everything tied to an order, and our legitimate interests (Art. 6(1)(f)) in a functioning, secure website.
What it is: a processor, acting on our instructions under a written contract. It does not get to decide what to do with your data, and it may not use it for its own purposes.
Where it sits: Shopify's infrastructure is international. Where data leaves the UK it is transferred under the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, or to a country covered by UK adequacy regulations. We can tell you which applies to a particular flow if you ask.
3. THE PAYMENT PROVIDER, ASKING FOR ENOUGH TO TAKE THE MONEY
What they get: your card or account details, the amount, and the information needed to authorise the transaction and to meet anti-fraud and anti-money-laundering obligations.
What we get: not your card number. The previous version of this page said we collect "payment information including credit card numbers". We do not. Card details are entered into the payment provider's own hosted fields and never reach our systems. What comes back to us is the last four digits, the card type, and whether the payment succeeded.
This is not modesty — it is the single most important sentence on this page. A shop that cannot see your card number cannot leak it.
On what basis: performance of the contract, and the provider's own legal obligations as a regulated payment business.
4. THE COURIER, ASKING FOR A NAME AND AN ADDRESS
What they get: the recipient's name, delivery address, postcode, and an email address or phone number for delivery notifications.
What they do not get: your payment details, your order history, what else you have bought, or anything you have said to us.
On what basis: performance of the contract — delivery is the contract.
5. HMRC AND THE STATUTE BOOK, ASKING FOR RECORDS
This is the section the old policy got wrong, and it matters because it is the one that limits your right to erasure.
The old wording: "we will maintain your Order Information for our records unless and until you ask us to delete this information."
That is indefinite retention by default, and it is incompatible with the storage limitation principle at Art. 5(1)(e) UK GDPR — personal data must be kept no longer than is necessary. "Until someone complains" is not a period.
What applies instead:
| What | How long | Why |
|---|---|---|
| Order and invoice records, including name, address and amounts | 6 years from the end of the relevant accounting year | VAT Act 1994; Limitation Act 1980 s.5, which is also how long a contract claim can be brought |
| Correspondence with you about an order | 6 years, with the order | Same |
| Correspondence with no order attached | 2 years | Our legitimate interest in continuity of service |
| Marketing consent records | until you withdraw, then the record of withdrawal is kept so we do not contact you again by mistake | PECR reg. 22; Art. 7(1) |
| Analytics and cookie data | as stated in our cookie information, and no longer | Consent, or the statistical-purposes exemption |
So an erasure request has one boundary, and only one. We delete marketing data, browsing data, correspondence and account data on request. We cannot delete a tax record inside its six years — not because we want it, but because keeping it is a legal obligation under Art. 6(1)(c). When we refuse a deletion for that reason, we say which record, and the date it goes.
6. ANALYTICS, ASKING TO WATCH YOU BROWSE
Who: Google Analytics, which tells us which pages people read and which ones they leave.
What it gets: pages viewed, time on page, approximate location derived from IP address, device and browser, and how you arrived at the site.
On what basis, and the thing that changed in February 2026. Cookies and similar technologies are governed by regulation 6 of PECR 2003, which has historically required consent for everything beyond what is strictly necessary. The Data (Use and Access) Act 2025 amended that with effect from 5 February 2026: cookies used solely for statistical purposes — understanding how the service is used, in order to improve it — or for the appearance and functioning of the site, or for emergency assistance, no longer require consent, provided you are given clear information about them and a free and simple way to opt out.
So, concretely:
- Strictly necessary cookies — basket, checkout, session, security. No consent needed; the shop cannot work without them.
- Statistical cookies — our own measurement of how pages perform. Relied on under the new exemption, which means you are told about them here and you can switch them off at any time from our cookie settings, free and in one step.
- Advertising, profiling and anything shared with a third party for its own purposes — consent, every time. The exemption does not reach these, and we do not pretend it does.
Browser settings are not consent. The old policy pointed readers at an external website to "disable cookies" and treated that as the mechanism. It is not. Consent is given or withheld in our cookie banner, and withdrawing it must be as easy as giving it (Art. 7(3)).
The penalties behind this are no longer nominal. The 2025 Act raised PECR fines to UK GDPR levels — up to £17.5 million or 4% of global turnover. We mention it because it explains why this section is specific rather than decorative.
7. ADVERTISING NETWORKS, ASKING FOR AN AUDIENCE
What they get: nothing without your consent. If you decline advertising cookies, no advertising or profiling identifier is set, and no audience list is built from your visit.
We do not sell personal data, and we do not share it for anyone else's independent purposes.
Two paragraphs have been removed from this policy outright:
The "Do Not Track" paragraph, which announced that we ignore Do Not Track signals. That text exists because of a Californian disclosure requirement. In a UK policy it was a statement that we disregard a privacy preference — for no reason, since the UK mechanism is consent, which we honour.
The Network Advertising Initiative link. The NAI is a United States self-regulatory body, and it is not where a UK resident goes. Your controls are our cookie settings, your browser's own privacy controls, and the ad-settings pages of the platforms themselves.
8. US, ASKING FOR YOUR PHONE NUMBER OR EMAIL ADDRESS
Marketing by email or text requires your prior consent under regulation 22 of PECR, with one narrow exception: if you have bought from us, we may email you about similar products, and you can stop it in any message. That exception covers email. It does not cover anything you did not ask for.
Text messages: if you opt in, reply STOP to any message to end it, or HELP for assistance. We act on a STOP immediately and keep only the record that you opted out.
One correction. The old policy said "standard message and data rates may apply, and you are responsible for any such charges." In the United Kingdom you do not pay to receive a text message. That sentence is imported from a US template, and it was telling you to expect a charge that does not exist.
Every marketing message we send identifies us and carries a working unsubscribe. A message that does neither is not from us.
9. THE POLICE OR A COURT, ASKING FOR RECORDS
The old policy described responding to "a subpoena, search warrant, or other lawful request". Those are American instruments. In the UK:
We disclose where we are legally required to — a court order, a statutory information notice, or a police request that cites a lawful basis, most often under the Data Protection Act 2018, Schedule 2, Part 1.
We require it in writing, and we check it. An informal request by phone or email, without a stated legal basis, gets a refusal and a note of who asked.
We tell you, unless telling you would itself be unlawful.
We do not volunteer data. There is no standing arrangement with anyone.
10. OUR FRAUD CHECKS, ASKING WHETHER TO LET AN ORDER THROUGH
Orders are screened for fraud risk — a legitimate interest under Art. 6(1)(f), and one you benefit from as much as we do, since the card being misused may be yours. The signals are things like IP address, address mismatches and order patterns.
A screening score never decides anything on its own. If an order is flagged, a person looks at it. That is deliberate: Art. 22 restricts purely automated decisions with legal or similarly significant effects, and we would rather not operate at the edge of it.
If an order of yours is cancelled on fraud grounds, you can ask us to look again, and a person will. You will not be told "the system declined it".
11. NOBODY, BECAUSE WE NEVER COLLECTED IT
The shortest section, and the only one that gets shorter the better we do our job.
We do not hold your card number. See section 3.
We do not collect special category data — health, beliefs, biometrics, anything in Art. 9. We sell blankets, including heated ones, and we have no interest in why you want one. If you volunteer medical context in an email because it is relevant to your question, we answer the question and we do not build a record of it.
We do not knowingly collect data from children under 13, the age at which a child can consent to an information society service in the UK (Data Protection Act 2018, s.9). Orders require a person of 18. If you believe a child's data has reached us, tell us and we will delete it.
We do not buy marketing lists, and we do not add people who have not asked.
We do not have a statutory requirement to appoint a Data Protection Officer at our size, and we have not appointed one. Data protection questions go to the contact address below and are handled by us directly. We say this plainly rather than implying an office that does not exist.
12. IF SOMETHING GOES WRONG
A personal data breach is reportable to the ICO within 72 hours of our becoming aware of it, where it is likely to result in a risk to people's rights and freedoms (Art. 33).
Where the risk is high, we tell you too, without undue delay (Art. 34) — what happened, what data was involved, what we have done, and what you should do.
We will not describe a breach as a "technical issue". If your data has been exposed, that is what the message will say.
13. CHANGES TO THIS POLICY
The date at the top is the version in force. If we change something that materially affects you — a new recipient of your data, a new purpose, a longer retention period — we tell you directly rather than relying on you to re-read this page. Previous versions are available on request.
WHERE THINGS ARE WRITTEN DOWN
Terms and Conditions — the contract, your 30-day cancellation right and your rights when goods are faulty. Delivery Policy — times, tracking and reporting deadlines. Returns Policy — how a return runs and when the money arrives.
CONTACT
| Store name | Harwelton |
| Company name | Harwelton LTD |
| Address | St Ann's Road, Harrow, Middlesex HA1 1HS, United Kingdom |
| support@harwelton.com | |
| Phone | +44 20 8424 2828 |
| Customer service hours | Mon–Fri: 09:00–17:00 |
| Sat & Sun | Closed |
| Response time | Within one business day |