Privacy policy

This policy explains how MrPutty(“we”, “us”) collects, uses and protects your personal data when you visit mrputty.co.uk or place an order. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

MrPutty is the trading name of Mr Putty Ltd, a company registered in England and Wales (company number 11447460), registered office 7 Canon Place, Southampton, England, SO19 6AG, VAT number GB476486931. We supply refinishing, sealants and bodywork products. Contact us at sales@mrputty.co.uk. Mr Putty Ltd is the data controller for any personal data processed via this website.

2. What data we collect

• Account data: email address, name (optional), bcrypt-hashed password, marketing consent choice, account creation timestamp.
• Order data: shipping and billing addresses, contact phone number, the items you ordered, your payment status. We do not store card numbers. Payments are handled by Stripe under their own privacy policy.
• Browsing data: cart and wishlist contents, recently viewed products, the products you searched for. For signed-in customers this lives in our database; for visitors this lives in your browser via localStorage.
• Newsletter data: if you opt in, your email plus a record of when and from where you subscribed (consent proof under UK GDPR).
• Technical data: server logs (IP address, user agent, request path) for security and debugging. Retained for 30 days, then automatically deleted.

3. Lawful basis for processing

• Contract: account, order, shipping and customer-service data. We need this to fulfil your purchase.
• Consent: marketing emails and non-essential cookies, only with your explicit opt-in. You can withdraw consent at any time.
• Legitimate interest: fraud prevention, security logging, and basic site analytics that do not identify individuals.
• Legal obligation: tax and accounting records, retained for 6 years as required by HMRC.

4. Who we share your data with

We use the following processors. None of them sell your data.

• Sanity (sanity.io): content management for product catalogue. Does not see customer data.
• Neon (neon.tech): Postgres database hosting in London. Encrypted in transit (TLS) and at rest.
• Resend (resend.com): transactional and newsletter email delivery.
• Stripe (stripe.com): payment processing. Subject to Stripe’s own privacy policy.
• 20i (20i.com): server hosting in London for the website itself. They do not have access to customer database content.
• Couriers we ship with (Royal Mail, Parcelforce, DPD or similar): name, delivery address and phone number for delivery notifications.

5. International transfers

All primary data (database, application servers, email infrastructure) is hosted within the UK and EEA. Some processors may transfer data to other regions under UK GDPR-approved safeguards (Standard Contractual Clauses, UK Adequacy Regulations).

6. How long we keep your data

• Account data: while your account is active, plus 30 days after deletion request.
• Order records: 6 years after the order date (HMRC requirement).
• Marketing data: until you unsubscribe, plus a small suppression list to prevent re-mailing.
• Server logs: 30 days.
• Anonymised analytics: indefinitely (no longer personal data).

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data (with exceptions for legal obligations e.g. tax records).
• Restrict or object to processing.
• Receive your data in a portable format.
• Withdraw consent for marketing at any time.
• Lodge a complaint with the Information Commissioner’s Office (ico.org.uk).

To exercise any of these rights, email sales@mrputty.co.uk from the address on the account. We respond within 30 days.

8. Security

Data is encrypted in transit using TLS 1.2+ and at rest at the database layer. Passwords are hashed with bcrypt (12 rounds). Sessions are stored as HttpOnly, Secure, SameSite=Lax cookies. We will notify affected users and the ICO within 72 hours of becoming aware of any personal data breach that poses a risk to your rights.

9. Cookies

We use a small number of cookies. See our cookie policy for the full list and how to manage them.

10. Changes

We may update this policy. Material changes will be communicated by email to account holders and flagged at the top of this page. The current version is always the one shown here.