Privacy policy

Privacy Policy

Gryphon's Hoard LTD

Last updated: 7 October 2026

Gryphon's Hoard LTD (“Gryphon's Hoard”, “we”, “us” or “our”) operates gryphonshoard.co.uk and is the data controller responsible for the personal information described in this Privacy Policy.

We respect your privacy and are committed to handling personal information fairly, lawfully and transparently.

This Privacy Policy explains what personal information we collect, why we use it, the lawful bases on which we process it, who we may share it with, how long we retain it and the rights available to you.

Our online store is powered by Shopify.

1. Personal Information We Collect

The personal information we collect depends on how you interact with us and may include:

Identity and contact information, such as your name, billing address, delivery address, email address and telephone number.
Order and transaction information, including products purchased, order history, returns, refunds, exchanges and payment status.
Payment information. Payments are processed using our payment providers. We may receive transaction and payment-confirmation information, but payment providers may process payment-card or financial information directly.
Account information, where you create or use a customer account.
Communications, including information you provide when contacting us about an order, product, return, complaint or other enquiry.
Device and technical information, such as your IP address, browser, device, network information and other online identifiers.
Website usage information, including how you interact with our website, products, shopping cart and other features.
Marketing information and preferences, including whether you have agreed to receive marketing communications and information about your interaction with those communications.
Fraud and security information, where necessary to protect our customers, website and business.

We do not intentionally collect more personal information than we reasonably need for the purposes described in this policy.

2. How We Collect Personal Information

We may collect personal information:

Directly from you, for example when you place an order, create an account, contact us, request a return or subscribe to marketing.
Automatically, when you use our website, including through cookies and similar technologies where permitted.
From Shopify and service providers that help us operate our store, process payments, fulfil orders, provide website functionality or prevent fraud.
From delivery providers, for example in relation to tracking, delivery or a delivery problem.
From other third parties, where lawful and relevant to operating our business.

3. How and Why We Use Your Personal Information

Under UK data-protection law, we need a lawful basis for processing personal information.

Depending on the circumstances, we process personal information on one or more of the following bases.

To fulfil orders and our contract with you

We use personal information to:

Process and administer orders.
Take or facilitate payment.
Arrange delivery.
Provide order and delivery communications.
Process cancellations, returns and refunds.
Provide customer service relating to your purchase.
Manage customer accounts where applicable.

Our lawful basis is generally performance of a contract with you, or taking steps at your request before entering into a contract.

To comply with legal obligations

We may process and retain information where necessary to:

Maintain accounting, tax and VAT records.
Meet consumer-protection obligations.
Respond to lawful requests from regulators, courts or public authorities.
Meet other legal and regulatory requirements applicable to our business.

Our lawful basis is compliance with a legal obligation.

To operate, protect and improve our business

We may use personal information to:

Maintain and secure our website and systems.
Prevent and investigate fraud, abuse and security incidents.
Understand how our store is being used.
Improve our products, website and customer experience.
Administer and defend legal claims.
Maintain appropriate business records.

Where applicable, our lawful basis is our legitimate interests in operating, securing, improving and protecting Gryphon's Hoard, provided those interests are not overridden by your rights and interests.

Marketing and advertising

Where required by law, we rely on your consent to send electronic direct marketing.

You can withdraw your consent or unsubscribe from marketing communications at any time.

In circumstances where UK law permits marketing without consent, we may rely on our legitimate interests, subject to your right to object and applicable direct-marketing rules.

We may also use cookies and similar technologies for advertising, personalisation and measurement where permitted and subject to the choices available through our cookie and privacy controls.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

4. Cookies and Similar Technologies

Our website uses cookies and similar technologies for purposes that may include:

Operating essential website and checkout functions.
Remembering preferences.
Security and fraud prevention.
Measuring website performance and usage.
Personalisation, marketing and advertising where permitted.

Where UK law requires consent for non-essential cookies or similar technologies, we will request that consent through our cookie controls before using them.

You can use the cookie controls available on our website to manage your preferences.

Some cookies are necessary for the operation and security of the website and do not depend on consent where permitted by law.

Please note that withdrawing or refusing optional cookies may affect some non-essential website features.

5. How We Share Personal Information

We may share personal information where reasonably necessary with organisations that help us operate Gryphon's Hoard, including:

Shopify, which provides our ecommerce platform and related services.
Payment providers, which process or facilitate payments.
Delivery and logistics providers, where necessary to deliver or return orders.
IT, hosting, security and technical service providers.
Marketing, analytics and advertising providers, where applicable and permitted.
Professional advisers, such as accountants, legal advisers or insurers where necessary.
Government bodies, regulators, law-enforcement agencies or courts, where disclosure is legally required or otherwise lawful.

We may also disclose information in connection with a sale, restructuring or transfer of all or part of our business where lawful and subject to appropriate safeguards.

We do not disclose personal information simply because another organisation requests it. Disclosure must have an appropriate purpose and lawful basis.

6. Shopify and Enhanced Services

Our store is hosted and powered by Shopify.

Shopify collects and processes personal information relating to your access to and use of our store in order to provide its ecommerce and related services.

Information submitted through our store may therefore be transmitted to and processed by Shopify and relevant service providers, including organisations located outside the United Kingdom.

We also use certain Shopify features that may use information from your interactions with our store together with information relating to your interactions with Shopify or other merchants in order to provide enhanced services, including personalisation, analytics, marketing or advertising functionality.

In circumstances where Shopify independently determines the purposes and means of processing personal information for these enhanced services, Shopify is responsible for that processing and for handling applicable data-protection rights relating to it.

You can learn more through the Shopify Consumer Privacy Policy and exercise relevant Shopify privacy choices through the Shopify Privacy Portal.

7. Third-Party Websites and Services

Our website may contain links to websites, social-media services or other platforms operated by third parties.

Those organisations may process your personal information under their own privacy policies.

We are not responsible for the privacy or security practices of third-party websites or services that we do not control. We recommend reviewing their privacy information before providing personal information to them.

8. Children's Personal Information

Our store is intended for general retail customers and is not directed specifically at children.

We do not knowingly seek to collect personal information from children where doing so would be inappropriate or unlawful.

If you are a parent or guardian and believe a child has provided personal information to us in circumstances where it should not have been collected, please contact us.

9. Security

We take reasonable organisational and technical measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

However, no method of electronic transmission or storage can be guaranteed to be completely secure.

Please do not send payment-card details, passwords or other highly sensitive information to us through ordinary email unless specifically requested through an appropriate secure process.

10. How Long We Keep Personal Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to:

Complete and administer transactions.
Maintain customer accounts where applicable.
Meet accounting, tax, VAT and other legal record-keeping requirements.
Deal with returns, warranties, disputes and complaints.
Establish, exercise or defend legal claims.
Maintain appropriate fraud-prevention and security records.

Different categories of information may therefore be retained for different periods.

When personal information is no longer required, we will delete or anonymise it where appropriate, subject to legal, regulatory or legitimate record-keeping requirements.

11. International Transfers

Shopify and some of our other service providers may process personal information outside the United Kingdom.

Where a transfer of personal information from the UK is subject to the UK GDPR's restricted-transfer rules, we will ensure that an appropriate lawful transfer mechanism or safeguard is used where required.

This may include transferring information to a country covered by UK adequacy regulations or using approved contractual safeguards or another lawful transfer mechanism.

12. Your Data-Protection Rights

Depending on the circumstances, UK data-protection law may give you rights including:

The right to be informed about how your personal information is used.
The right of access to personal information we hold about you.
The right to rectification of inaccurate or incomplete information.
The right to erasure in circumstances where the law provides that right.
The right to restrict processing in certain circumstances.
The right to data portability where applicable.
The right to object to certain processing, including direct marketing.
Rights relating to certain automated decision-making, where applicable.
The right to withdraw consent at any time where processing is based on consent.

These rights are not absolute and may be subject to legal conditions or exemptions.

We may need to verify your identity before responding to a request.

To exercise your rights, contact us using the details in Section 16.

13. Marketing Choices

You may unsubscribe from marketing emails at any time using the unsubscribe option contained in those communications or by contacting us.

Opting out of marketing will not prevent us from sending transactional or service communications necessary to administer an order, return, customer account or other existing relationship with you.

You also have the right to object to the use of your personal information for direct marketing.

14. Complaints

If you have concerns about how Gryphon's Hoard uses your personal information, please contact us first so that we have an opportunity to investigate and respond.

You also have the right to complain to the UK's independent data-protection regulator:

Information Commissioner's Office (ICO)

Further information about making a complaint is available from the ICO.

You do not have to contact us before making a complaint to the ICO.