Privacy Policy

Enchanted Music Boxes

Last updated: June 2026 

---

At Enchanted Music Boxes we believe your privacy is as precious as the keepsakes we create. This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit our website, place an order, or get in touch with us. Please read it carefully — and if you have any questions, our contact details are below.

This policy applies to enchantedmusicboxes.com. It has been prepared in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

---

1. Who We Are

If you have questions about how we handle your personal data, or wish to exercise any of your rights, please contact us at the email address above or see Section 14.

2. What Personal Data We Collect

Information you provide directly: When you place an order, create an account, or contact us, we may collect:

• Full name
• Email address
• Delivery and billing address (including country, for international orders)
• Telephone number
• Payment details — processed securely by our payment providers; we do not store card numbers or sensitive payment credentials
• Personalisation details for your order, such as names, dates, song choices, dedications, engravings, or photographs you submit
• Any other information you voluntarily share in order notes or correspondence with us

Information collected automatically: When you browse our website, we and our service providers may collect:

• IP address and approximate location
• Device type, operating system, and browser
• Pages visited, time on site, and referring website
• Cookie and session data (see Section 10 — Cookies)

3. How We Use Your Personal Data

We use your personal data only for the purposes listed below, each supported by a lawful basis under UK GDPR:

Fulfilling your order (Lawful basis: Contract)

• Processing and managing your purchase, including any personalisation
• Communicating with you about your order, shipping, or any issues that arise
• Coordinating delivery through our shipping providers
• Handling returns, exchanges, and refunds

Running our business (Lawful basis: Legitimate interests / Legal obligation)

• Responding to your enquiries and complaints
• Detecting and preventing fraud
• Maintaining our accounting and legal records
• Improving our products, website, and customer experience

Marketing (Lawful basis: Consent)

• Sending you our newsletter, new product announcements, and promotions — only if you have opted in
• You may withdraw consent and unsubscribe at any time

Legal compliance (Lawful basis: Legal obligation)

• Meeting our obligations under UK tax law, consumer protection legislation, and data protection law

4. Our Lawful Bases for Processing

UK GDPR requires us to identify a lawful basis each time we process your personal data. The bases we rely on are:

• Contract — processing necessary to fulfil or manage an order you have placed
• Legitimate interests — processing for our reasonable business purposes (fraud prevention, service improvement) where these are not overridden by your rights
• Consent — where you have actively opted in, such as subscribing to our mailing list or accepting non-essential cookies
• Legal obligation — where UK law requires us to process or retain your data

5. How We Share Your Data

We do not sell, rent, or trade your personal data. We share information only where necessary with the following trusted third-party providers:

Shopify Inc. — our e-commerce platform, which hosts our store and processes order data. Shopify operates servers in the EU and USA and complies with applicable data transfer requirements. View Shopify's privacy policy.

Stripe — payment processing for card transactions made via Shopify Payments. Stripe is PCI-DSS certified and handles all card data securely. We never see your full card number. View Stripe's privacy policy.

PayPal — an alternative payment option at checkout. PayPal processes payment data independently. View PayPal's privacy policy.

Klarna — a buy-now-pay-later payment option. If you pay with Klarna, they will collect and process your personal data — including performing credit checks — independently. View Klarna's privacy policy.

Shop Pay — an accelerated checkout service operated by Shopify. Data is handled in accordance with Shopify's privacy policy.

Shipping and courier providers — we share your name, delivery address, and contact details with the carrier used to fulfil your order. For international orders, this may include carriers based outside the UK. Data is shared only to the extent necessary to complete your delivery.

Manufacturing and fulfilment partners — we share your full name, delivery address, and relevant contact details with them to fulfil your order. Where your order includes personalised elements — such as an engraved name, message, or song choice — the personalisation details you provide will also be shared with our fulfilment partners, solely for the purpose of producing your order. Our manufacturing partner is not permitted to use your personal data for any purpose other than fulfilling your order.

All third-party providers are required to handle your data securely and only for the purposes we specify.

6. International Data Transfers

Your personal data may be transferred to and processed in countries outside the United Kingdom in two circumstances:

Platform providers — our e-commerce and payment platforms (Shopify, Stripe, PayPal) operate servers in the EU and USA. Both are subject to adequacy decisions or appropriate safeguards recognised by the UK, and these transfers are governed by those providers' own data processing agreements.

Manufacturing partner — as described in Section 5, your name, delivery address, and personalisation details are transferred to our production partner to manufacture and dispatch your order. We rely on the Article 49(1)(b) derogation under UK GDPR, which permits transfers that are necessary for the performance of a contract between you and us. Without this transfer, we cannot produce and deliver your order. The transfer is limited strictly to the data required for that purpose, and our manufacturing partner is not permitted to use it for any other reason.

If you have questions about any international transfer of your personal data, please contact us at paula@enchantia-gifts.com.

7. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purpose it was collected, or as required by applicable law:

• Order records: retained for 7 years to comply with HMRC and UK tax obligations
• Account information: retained while your account is active and for up to 3 years following your last purchase or interaction
• Marketing data: retained until you unsubscribe or withdraw consent; removed from active lists within 30 days of your request
• Customer service correspondence: retained for up to 3 years
• Website session and cookie data: retained as set by each service (see Section 10 for details)

When data is no longer needed, we securely delete or anonymise it.

8. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right of access — request a copy of the personal data we hold about you (a Subject Access Request)
• Right to rectification — ask us to correct inaccurate or incomplete information
• Right to erasure — ask us to delete your data, subject to legal exceptions such as tax record retention obligations
• Right to restriction — ask us to pause processing your data in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests, or to direct marketing at any time
• Automated decision-making — we do not use automated decision-making or profiling that produces legal or similarly significant effects on you

To exercise any of these rights, please email paula@enchantia-gifts.com. We will respond within one calendar month. We may ask you to verify your identity before fulfilling a request.

9. How We Protect Your Data

We have implemented technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse:

• SSL/TLS encryption across all pages of our website (HTTPS)
• PCI-DSS compliant payment processing — we never store your full card details
• Access controls limiting who can access personal data
• Password-protected and two-factor authenticated business accounts
• Regular review of our third-party processors and their security standards

No method of internet transmission or electronic storage is 100% secure. If you believe your data may have been compromised, please contact us immediately at paula@enchantia-gifts.com.

10. Cookies

Our website uses cookies — small text files placed on your device — to ensure the site functions correctly and to support a smooth shopping experience. We currently use the following categories of cookies:

• Strictly necessary cookies — essential for operating the website, your shopping cart, checkout session, and account login. These are set by Shopify and cannot be disabled without affecting core functionality.
• Functional cookies — remember your preferences (such as currency or language settings) to improve your browsing experience.

We do not currently use analytics, advertising, or social media tracking cookies. If this changes in future, we will update this policy and our cookie settings accordingly.

You can disable cookies through your browser settings, though this may affect the ability to use certain features of the site, including the shopping cart and checkout.

11. Links to Other Websites

Our website may contain links to third-party sites, including our social media profiles. Clicking these links will take you to external websites governed by their own privacy policies. We are not responsible for the content or privacy practices of those sites and encourage you to read their policies before providing personal information.

12. Children's Privacy

Our website and services are intended for users aged 18 and over, or for adults purchasing on behalf of children. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has submitted personal information to us, please contact us immediately and we will take steps to delete it promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the 'Last updated' date at the top of this document and, where appropriate, notify you by email. We encourage you to review this page periodically.

14. Contact Us & Complaints

For any questions, concerns, or requests relating to this Privacy Policy or how your data is handled, please contact:

We will respond to all privacy-related requests within 30 days. 

Thank you for trusting Enchanted Music Boxes with your personal information.