Privacy Policy

Copper Bottles ("we", "us") operates the online store at copperbottles.uk. We are the data controller for the personal data described in this policy.

If you have any question about this policy or want to exercise your data rights, send us a message through our contact form.

We only collect what we need to run the shop:

• Order details — your name, email address, phone number (optional) and delivery address, so we can process and ship your order.
• Payment reference data — a payment reference and status returned by our payment provider. We never see or store your bank login details or card numbers.
• Messages — anything you send us through the contact form, so we can reply.
• Basic analytics — aggregated, privacy-friendly page view data via Vercel Analytics. This does not use cookies and does not identify you personally.

Your shopping bag is stored in your own browser's local storage. It never leaves your device until you place an order.

We use your personal data to:

• Take payment for, fulfil and deliver your order.
• Send you order confirmation and dispatch emails.
• Answer your questions and provide customer support.
• Handle returns, refunds and warranty claims.
• Keep records we are legally required to keep, such as sales records for tax.

Under UK GDPR we rely on the following legal bases:

• Contract — processing your order and delivering your bottle.
• Legal obligation — retaining transaction records for tax and accounting.
• Legitimate interests — preventing fraud, securing our site and improving our products.
• Consent — if you opt in to marketing emails. You can withdraw this at any time.

We never sell your personal data. We share it only with the service providers needed to run the shop, and only to the extent they need it:

• Fena — open banking payment processing. Fena is authorised and regulated by the Financial Conduct Authority.
• Vercel — website hosting and privacy-friendly analytics.
• MongoDB Atlas — encrypted database hosting for orders and products.
• Resend — transactional email delivery.
• Cloudinary — hosting of product images.
• Delivery carriers — the name and address needed to deliver your parcel.

Some providers may process data outside the UK. Where they do, transfers are protected by UK adequacy regulations or standard contractual clauses.

Order and transaction records are kept for seven years to meet UK tax and accounting requirements. Contact form messages are kept for up to two years. Marketing consent records are kept until you unsubscribe, plus a short period afterwards to honour your choice.

You have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased, where we have no legal reason to keep it.
• Restrict or object to how we use your data.
• Receive your data in a portable format.
• Withdraw consent to marketing at any time.

Contact us through our contact formand we will respond within one month. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk.

We do not use advertising or tracking cookies. The only browser storage we rely on is a local shopping bag and, for shop staff only, a secure sign-in cookie for the admin area.

All traffic is encrypted over HTTPS, admin access is restricted and passwords are stored hashed. No system is perfectly secure, but we take these safeguards seriously.

If we make material changes to this policy we will update the date at the top of this page. Please check back occasionally so you know how your data is handled.