PRIVACY POLICY

Last Updated: August 25, 2026

1. Who We Are

Wild Finch (“we”, “us”, “our”) operates the website wild-finch.online. We are committed to protecting and respecting your privacy in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Our Contact Details:

For any questions regarding this Privacy Policy or your personal data, please contact us using the details above.

2. What Personal Data We Collect

We may collect and process the following categories of personal data about you:

Identity Data – name, title.
Contact Data – email address, phone number, billing and delivery address.
Account Data – username, password, preferences, communication history.
Transaction Data – order details, payment information (please note: we do not store full payment card details; these are processed securely by our payment service providers).
Technical Data – IP address, device identifiers, browser type and version, time zone setting, operating system, cookie identifiers.
Usage Data – pages viewed, links clicked, session duration, referral source.
Marketing and Communications Data – your preferences regarding receiving marketing communications from us.

3. How We Collect Your Personal Data

We collect personal data through various means:

Direct interactions: When you fill in forms on our website, create an account, place an order, subscribe to our services, request marketing communications, or contact us.

Automated technologies: As you interact with our website, we automatically collect Technical Data and Usage Data through cookies, server logs, and other similar technologies.

Third parties: We may receive data from service providers who help us operate our business, such as payment processors, analytics providers, and delivery partners.

4. How We Use Your Personal Data and Our Legal Basis

We will only use your personal data when the law allows us to. The lawful bases we rely on for processing your personal data are:

Purpose/Activity Type of Data Lawful Basis
To register you as a new customer Identity, Contact Performance of a contract with you
To process and deliver your orders Identity, Contact, Transaction, Account Performance of a contract with you
To manage our relationship with you Identity, Contact, Account, Marketing Performance of a contract with you / Necessary to comply with a legal obligation / Necessary for our legitimate interests
To administer and protect our business and this website Identity, Contact, Technical Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security) / Necessary to comply with a legal obligation
To deliver relevant website content and advertisements Identity, Contact, Usage, Technical Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business) / Consent (for cookies)
To use data analytics to improve our website, products/services, marketing, and customer relationships Technical, Usage Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant) / Consent (for cookies)
To make suggestions and recommendations to you about goods or services that may be of interest to you Identity, Contact, Technical, Usage Necessary for our legitimate interests (to develop our products/services and grow our business) / Consent (for marketing communications)

Note: We may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.

5. Marketing Communications

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

Opting Out: You can ask us to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting us at any time.

Where you opt out of receiving these marketing messages, we will continue to process your personal data for other purposes for which we have a lawful basis.

6. Cookies and Similar Technologies

Our website uses cookies and similar tracking technologies. Cookies are small text files that are placed on your computer or device when you visit a website. We use cookies for:

  • Essential cookies: Necessary for the operation of our website (e.g., to enable you to log in or add items to your shopping basket).

  • Analytics cookies: To collect information about how visitors use our website, helping us improve it.

  • Functionality cookies: To recognise you when you return to our website and personalise content for you.

  • Marketing cookies: To deliver relevant advertising to you.

Under the Privacy and Electronic Communications Regulations (PECR), we are required to obtain your consent for non-essential cookies. When you first visit our website, you will be presented with a cookie banner that allows you to accept or reject non-essential cookies. You can manage your cookie preferences at any time through our cookie consent tool.

For more detailed information about the cookies we use, please refer to our Cookie Policy.

7. Disclosure of Your Personal Data

We may share your personal data with the following categories of third parties:

Service Providers: Who provide services to us, acting as data processors. These include IT hosting and cloud providers, payment processors, delivery and courier services, customer support platforms, and email marketing platforms.

Professional Advisers: Including lawyers, bankers, auditors, and insurers who provide consultancy, banking, legal, insurance, and accounting services.

Regulators and Authorities: HM Revenue & Customs, the Information Commissioner’s Office, and other regulatory or government authorities who require reporting of processing activities in certain circumstances.

Other Third Parties: Where we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or to protect the rights, property, or safety of Wild Finch, our customers, or others.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

8. International Transfers

We may transfer your personal data to countries outside the United Kingdom. Where we do so, we will ensure that appropriate safeguards are in place to protect your personal data, such as:

  • Transferring to countries that have been deemed to provide an adequate level of protection for personal data by the UK Government.

  • Using specific contracts approved by the UK Government which give personal data the same protection it has in the UK (such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses).

If you would like further information about the specific mechanism used by us when transferring your personal data outside the UK, please contact us.

9. Data Security

We have implemented appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed.

We limit access to your personal data to those employees, agents, contractors, and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

10. Data Retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process your personal data, and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting, or other requirements.

In some circumstances, you can ask us to delete your data (see Section 11 below for further information).

11. Your Legal Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

Right Description
Right of access You have the right to request a copy of the personal data we hold about you and to check that we are lawfully processing it.
Right to rectification You have the right to request correction of any incomplete or inaccurate personal data we hold about you.
Right to erasure You have the right to ask us to delete or remove personal data where there is no good reason for us continuing to process it. This is also known as the “right to be forgotten”.
Right to restrict processing You have the right to request the restriction of processing of your personal data in certain circumstances (e.g., where you contest the accuracy of the data).
Right to data portability You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another data controller.
Right to object to processing You have the right to object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
Right to withdraw consent If we are relying on your consent to process your personal data, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out before you withdraw your consent.
Right to complain You have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

Exercising Your Rights: To exercise any of these rights, please contact us using the details provided in Section 1. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

12. Children’s Data

Our website and services are not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us. If we become aware that we have collected personal data from a child under 13 without verification of parental consent, we will take steps to remove that information from our servers.

We also comply with the Information Commissioner’s Office (ICO) Age Appropriate Design Code where our services are accessible to children.

13. Changes to This Privacy Policy

We keep this Privacy Policy under regular review and may update it from time to time. Any changes we make to this Privacy Policy will be posted on this page and, where appropriate, notified to you by email or via a notice on our website.

The date this Privacy Policy was last updated is shown at the top of this page. We encourage you to check this page periodically to stay informed about how we are protecting your personal data.

14. Third-Party Links

Our website may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.