1. Who we are

Toiletry Packs ("we", "us", "our") runs toiletrypacks.co.uk (the "Site") and is the data controller for the personal data described here. We are a UK company and this policy is written for UK GDPR and the Data Protection Act 2018.

Registered office: Unit X003, 107 Westmead Road, Sutton, SM1 4JD. Contact details are in section 14.

2. Information you give us

You give us personal data when you place an order, create an account, use the bag builder, sign up for emails, leave a review or contact us. Depending on what you do, that can include your name, email address, delivery and billing addresses, telephone number, company name, order details and anything you write to us.

Payment cards. Card, Apple Pay and Google Pay payments are processed by Stripe. The card fields on our checkout page are provided by Stripe and send your card details directly to Stripe, so your card number, expiry date and security code never reach our servers and we do not store them. We receive confirmation of whether the payment succeeded.

3. Information collected automatically

When you use the Site our servers record standard technical information: the pages requested, the time, your IP address, browser and device type. We use these logs to keep the Site running, to detect abuse (for example repeated failed sign-in attempts) and to fix errors. They are not used to build a profile of you.

If you choose to allow analytics (see section 4), Google Analytics also collects usage data as described in section 5. Without that choice, no analytics data is collected.

4. Cookies and your choices

Cookies are small text files stored on your device. We use three kinds: strictly necessary cookies, and two optional kinds you choose separately.

Strictly necessary cookies

These are needed for the Site to work and do not require your consent. They are never used for advertising. All are set by us except the Stripe cookies at the end of the list.

• tp_cart — identifies your shopping basket so it is still there when you come back. Kept for 30 days from your last visit.
• tp_cookie_consent — records the cookie choice you made so we do not ask again. Kept for 12 months.
• Sign-in cookies (authjs.session-token, authjs.csrf-token, authjs.callback-url) — keep you signed in to your account and protect the sign-in form. The session lasts up to 30 days; the others are deleted when you close your browser.
• tp_recent_order — set after checkout so you can view your order confirmation page. Kept for 7 days.
• tp_admin — set only for our staff when they sign in to the administration area. Expires after 12 hours.
• Stripe fraud-prevention cookies (__stripe_mid, __stripe_sid) — set by Stripe when its payment fields or Apple Pay / Google Pay buttons load, so Stripe can detect and prevent fraudulent payments. __stripe_mid lasts one year and __stripe_sid 30 minutes. Stripe's privacy policy is at stripe.com/privacy.

Analytics cookies (your choice)

With your permission we use Google Analytics to understand which products and pages are useful. These cookies are off by default. They are set only if you choose Accept all, or choose Manage, switch analytics on and Save. If you choose Reject all, or make no choice, no analytics cookies are set and no analytics data is collected.

Advertising measurement cookies (your choice)

We advertise on Google. With your permission, Google Ads measures which of our ads led to an order: when you arrive from one of our ads, Google stores a click identifier in a cookie (_gcl_au or _gcl_aw, kept for up to 90 days), and when you complete an order Google Analytics tells Google Ads that an order of that value was placed. We do not use this to show you ads elsewhere, to add you to advertising audiences, or to build an advertising profile, and Google's ad-personalisation setting stays off on this Site. These cookies are off by default and are set only if you choose Accept all, or choose Manage, switch advertising measurement on and Save.

Making and changing your choice

The first time you visit we show a cookie banner with three options: Accept all, Reject all and Manage, which lets you switch analytics and advertising measurement on or off separately and Save. Nothing is assumed from you continuing to browse: until you choose, both stay off. If you made a choice before 15 October 2026, we ask again, because advertising measurement is new.

You can change your mind at any time. Every page has a Cookie settings link in the footer that reopens the banner with your current choice; saving a new choice takes effect immediately. If you withdraw consent, we stop collecting analytics or advertising-measurement data from that moment. Cookies Google has already placed can be removed through your browser's settings.

We do not use social-media tracking cookies or remarketing. Google's advertising-personalisation setting is always kept off on this Site; its advertising-storage and advertising user-data settings are switched on only if you allow advertising measurement.

5. Google Analytics

If you allow analytics, Google Analytics 4 (provided by Google Ireland Limited) sets cookies named _ga and _ga_… that contain a random identifier for your browser. They last up to two years and are set by Google. We use Google Consent Mode, so Google is told that analytics is allowed only after you have said so, that advertising measurement is allowed only if you have separately said so, and that ad personalisation is never allowed. If you allow advertising measurement, Google Analytics shares with Google Ads (Google Ireland Limited) that an order was placed, its value and the ad click it came from, so we can see which ads work.

Google Analytics processes: the pages you view and how you move between them, the products and categories you look at, your browser, device and screen size, the random identifier in the cookie, and an approximate location (town or city level) derived from your IP address. Google Analytics 4 does not log or store your IP address. This is personal data, which is why we ask first. Google may transfer this data outside the UK; those transfers are covered by the UK's data-bridge arrangements and Google's standard contractual clauses. Google's own privacy policy is at policies.google.com/privacy.

The legal basis for analytics and for advertising measurement is your consent. For everything in sections 2 and 3 it is the performance of our contract with you (processing your order), our legal obligations (tax and accounting records) and our legitimate interests in running and protecting the Site.

6. How we use information

• To process and deliver your orders, including bespoke bags made to your specification, and to handle returns and refunds.
• To run your account: sign-in, saved addresses, order history and wishlist.
• To contact you about your order: confirmations, dispatch notices, invoices and replies to your messages.
• To send marketing emails only if you have asked for them. Every marketing email has an unsubscribe link.
• To keep the Site secure: rate limiting, fraud and abuse prevention, and an audit trail of administrative actions.
• To improve the Site, using analytics data only if you have allowed it.

We do not sell personal data and we do not make automated decisions about you that have legal or similarly significant effects.

7. Who we share it with

• Stripe, which processes card, Apple Pay and Google Pay payments and receives your card details directly through the payment fields on our checkout page.
• Delivery companies, who receive the name, address and telephone number needed to deliver your order.
• Our email service provider, which sends order and account emails on our behalf.
• Our hosting and storage providers, which run the Site and store product images and uploads.
• Google, for analytics and, separately, advertising measurement, each only if you have allowed it (section 4, section 5).
• Professional advisers and authorities where the law requires it, for example HMRC for tax records.

Each provider receives only what it needs for its task and acts under a contract that restricts how it may use the data.

8. How long we keep it

We keep personal data only as long as it is needed. These periods are enforced automatically.

• Orders, invoices, credit notes and refunds: six years from the end of the accounting year, as required by the Companies Act 2006 and HMRC rules.
• Guest baskets that never became an order: deleted 30 days after the basket expires. Signed-in baskets with no activity for 180 days are deleted.
• Accounts with no orders that have not been used for 24 months are anonymised.
• Emails we sent you (order and account messages): a copy is kept for 180 days to resolve delivery problems.
• Password-reset links: deleted seven days after they are used or expire.
• Technical logs and security counters: up to 30 days.
• Your cookie choice: 12 months, after which we ask again.

If you ask us to delete your account we remove or anonymise your personal data within one month. Where you have placed orders we must keep the financial records for the statutory period, so we anonymise the account and address details on those records instead of deleting them.

9. Keeping your data secure

All traffic between your browser and the Site is encrypted (HTTPS). Passwords are stored only as salted hashes. Access to the administration area requires a password and a second factor, is limited to the staff who need it, and every administrative action is recorded in an audit log that cannot be edited. We take regular backups and test that they can be restored.

10. Your rights

Under UK GDPR you can ask us to: give you a copy of the personal data we hold about you; correct it; delete it; restrict or object to how we use it; and give you a copy in a portable format. Where we rely on your consent (analytics, advertising measurement, marketing emails) you can withdraw it at any time, using the footer's Cookie settings link or the unsubscribe link in any email.

To exercise any of these rights, contact us using the details in section 14. We respond within one month. If you are not happy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.

11. Children

The Site sells to adults and businesses and is not directed at children. We do not knowingly collect personal data from anyone under 13, the age at which UK law lets a child consent to online services. If you believe a child has given us personal data, contact us and we will delete it.

12. Other websites

The Site may link to other websites, for example a courier's tracking page. We do not control those sites and this policy does not cover them; please read their own privacy notices.

13. Changes to this policy

We will update this page when our practices change and show the date of the latest version at the top. If a change affects how we use data you have already given us, or needs your consent, we will ask you rather than assume it.

14. Contact us

Questions about this policy, or requests about your data, can be sent to:

• Website: Contact form
• Address: Toiletry Packs, Unit X003, 107 Westmead Road, Sutton, SM1 4JD
• Telephone: (+44) 2035 441 072
• Email: [email protected]