Privacy policy
Penny & Salt
Penny & Salt respects your privacy and is committed to protecting your personal information.
This Privacy Notice explains what personal information we collect, why we use it, who we may share it with, how long we keep it and the rights you have under UK data protection law.
1. Who we are
Penny & Salt is operated by Hannah Penny, trading as Penny & Salt.
For the purposes of UK data protection law, Hannah Penny is the data controller of the personal information described in this Privacy Notice.
If you have any questions about this Privacy Notice, want to exercise your data protection rights or wish to make a data protection complaint, please contact:
Email: contact@pennyandsalt.com
2. Personal information we collect
The personal information we collect depends on how you use our website and services.
This may include:
- Contact information: such as your name, email address, telephone number, billing address and delivery address.
- Order information: including the products you order, order history, delivery information, returns, refunds and exchanges.
- Payment-related information: such as payment method, payment status and transaction information. Full payment card details are processed by our payment service providers and are not normally received or stored by Penny & Salt.
- Communications: including information you provide when you contact us with a question, request or complaint.
- Marketing information: including your email address and marketing preferences if you choose to subscribe to our newsletter or other marketing communications.
- Technical and website information: such as your IP address, browser, device information and information about how you use our website, where collected through Shopify, cookies or similar technologies.
3. How we collect your information
We collect personal information:
- directly from you, for example when you place an order, contact us or subscribe to our newsletter;
- automatically when you use our website, including through cookies and similar technologies;
- through Shopify, which provides our online shop and associated services;
- from payment providers, delivery providers and other service providers where necessary to process and fulfil your order.
4. Why we use your information
UK data protection law requires us to have a lawful basis for using your personal information.
We use personal information for the following purposes:
| Purpose | Lawful basis |
| Processing and fulfilling your order | Contract - the information is necessary to enter into and perform our contract with you |
| Taking and administering payment | Contract |
| Arranging delivery, returns, exchanges and refunds | Contract and, where applicable, legal obligation |
| Responding to enquiries about an order or potential order | Contract, steps taken at your request before entering into a contract, or our legitimate interests in providing customer service |
| Keeping accounting, transaction and tax records | Legal obligation |
| Protecting our website, customers and business against fraud, misuse and security threats | Our legitimate interests in operating a secure business and, where applicable, legal obligations |
| Dealing with complaints and legal claims | Legal obligation and/or our legitimate interests in establishing, exercising or defending legal rights |
| Sending newsletters or promotional emails where you have signed up to receive them | Consent |
| Remembering your marketing preferences and recording an unsubscribe request | Legal obligation and/or our legitimate interests in ensuring that your preferences are respected |
| Using non-essential cookies or similar technologies where consent is required | Consent |
Where we rely on legitimate interests, we only use your personal information where we consider that our interests do not override your rights and interests.
5. Information needed to place an order
Some personal information is necessary for us to accept, process and deliver an order, including your name, contact information, delivery information and the information required to arrange payment.
If you do not provide information that is necessary to complete an order, we may be unable to accept or fulfil that order.
6. Newsletter and marketing
If you choose to subscribe to the Penny & Salt mailing list, we will use the contact information you provide to send you news, product information, updates and occasional promotional communications.
We rely on your consent to do this.
You can withdraw your consent at any time by using the unsubscribe link in a marketing email or by contacting us at contact@pennyandsalt.com.
Withdrawing consent does not affect the lawfulness of marketing sent before your consent was withdrawn.
If you unsubscribe, we may retain a minimal record of your email address and opt-out preference so that we can ensure that we do not send you further marketing communications.
We may still contact you about an order, enquiry or other service-related matter even if you have opted out of marketing.
7. Cookies and similar technologies
Our website uses cookies and similar technologies.
Some cookies are necessary for the website and online shop to function, for example to maintain security, operate the shopping basket and complete checkout.
Other technologies may be used for analytics, website improvement or advertising.
Where UK law requires consent for a cookie or similar technology, it will not be used for that purpose until you have given the appropriate consent through our cookie controls.
You can use the cookie controls available on our website to manage your preferences.
8. Shopify
Our online shop is hosted and operated using Shopify.
Shopify processes personal information to provide the website, checkout and other services that enable Penny & Salt to operate its online shop.
Information you provide through our website may therefore be processed by Shopify and its service providers.
Shopify also carries out certain processing for its own purposes. Further information about how Shopify handles personal information is available in Shopify's own privacy information.
9. Who we share personal information with
We only share personal information where reasonably necessary to operate Penny & Salt, fulfil orders, comply with the law or protect our legal rights.
Depending on the circumstances, this may include:
- Shopify: which provides our e-commerce platform;
- payment service providers: to process payments and refunds;
- delivery and postal providers: to deliver orders;
- email or marketing service providers: where used to administer communications you have requested;
- website, IT and technology providers: where required to operate and secure the website;
- accountants and professional advisers: where reasonably necessary;
- government authorities, regulators, law enforcement agencies or courts: where disclosure is required by law or necessary to establish, exercise or defend legal rights.
We do not sell your personal information.
10. How long we keep your information
We do not keep personal information for longer than we reasonably need it.
The period for which information is kept depends on why it was collected and any legal or regulatory requirements that apply.
In particular:
- order, sales, payment and accounting records: are retained for the period required under applicable tax and accounting rules;
- customer service and correspondence records: are kept for as long as reasonably necessary to deal with the enquiry, any follow-up and any related legal or contractual matters;
- marketing information: is retained while you remain subscribed. If you unsubscribe, we may retain the minimum information necessary to record and respect your opt-out;
- cookie and website information: is retained in accordance with the purpose for which it was collected and the relevant cookie or service retention period.
We may keep information for longer where this is reasonably necessary to establish, exercise or defend a legal claim or where we are required to do so by law.
11. International data transfers
Some of our service providers, including Shopify and providers used by Shopify, may process or make personal information accessible outside the United Kingdom.
Where personal information is transferred outside the UK, we take appropriate steps to ensure that the transfer complies with UK data protection law.
Depending on the country and provider involved, this may include transferring information to a country covered by UK adequacy regulations or using other safeguards recognised under UK data protection law, such as approved contractual protections.
You can contact us if you would like further information about the safeguards relevant to your personal information.
12. Security
We take reasonable technical and organisational measures to protect personal information against accidental or unlawful loss, misuse, alteration, disclosure or access.
No internet transmission or electronic storage system can, however, be guaranteed to be completely secure.
13. Your data protection rights
Depending on the circumstances, UK data protection law gives you rights in relation to your personal information, including the right to:
- access: personal information we hold about you;
- correct: inaccurate or incomplete personal information;
- request deletion: of your personal information in certain circumstances;
- restrict: how we use your personal information in certain circumstances;
- object: to certain uses of your personal information;
- receive or transfer: certain personal information in a portable format where the right to data portability applies;
- withdraw consent: at any time where we rely on consent.
You have an absolute right to object to the use of your personal information for direct marketing.
These rights do not apply in every circumstance and we may sometimes be entitled or required to retain or continue using certain information.
To exercise any of these rights, contact us at contact@pennyandsalt.com.
We may need to ask you for information to confirm your identity before responding to a request.
14. Data protection complaints
If you are unhappy with the way we have used your personal information, please contact us at contact@pennyandsalt.com.
We will provide a clear means for you to raise a data protection complaint, acknowledge receipt within 30 days and, without undue delay, take appropriate steps to investigate the complaint, keep you informed where appropriate and tell you the outcome.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
15. Changes to this Privacy Notice
We may update this Privacy Notice from time to time, for example if our services, technology or legal obligations change.
The current version will be published on this website and the "Last updated" date at the top of this notice will be changed when appropriate.
16. Contact
For questions about this Privacy Notice, requests concerning your personal information or data protection complaints, please contact:
Hannah Penny, trading as Penny & Salt
Email: contact@pennyandsalt.com
Last updated: 15 August 2026