Privacy Policy

Who we are

This website and the Reba's Talismans brand are run by [Legal business name], trading as Reba's Spiritual Way ("we", "us", "our"). We are the controller of your personal information, which means we decide how and why it is used and we are responsible for looking after it.

We are a very small business, so we have not appointed a formal Data Protection Officer. Reba handles privacy questions personally; just email the address above.

At a glance

• We only collect what we need to make, sell and deliver your talisman, and to look after you afterwards.
• We never see or store your full card details. Payments are handled by Stripe and PayPal.
• We do not sell or share your personal information, and we do not use it for profiling.
• Your intention note is optional. We only use it with your explicit consent, and we delete it 90 days after delivery.
• Our newsletter is strictly opt-in, with a confirmation email, and you can leave with one click.
• Analytics and marketing cookies are off unless you switch them on. We honour Global Privacy Control.
• You can ask to see, correct, delete or take a copy of your information at any time.

What we collect

Information you give us

• Contact and delivery details: your name, email address, delivery and billing address, and phone number (carriers often need one to deliver).
• Order details: what you bought, prices, currency, delivery choice, and any returns or refunds.
• Channelled Commission details: your preferences for a made-to-order piece, such as stones, colours, size and metal.
• Your intention note (optional): the words you choose to share about the intention behind your piece. See Your intention note.
• Messages: anything you send us by email, contact form or social media, and our replies.
• Newsletter sign-up: your email address and, if you give it, your first name.
• Privacy requests: the details you give us when you use your privacy rights.

Information collected automatically

• Technical information: your IP address, browser type, device and the pages requested, recorded briefly by our hosting provider to keep the site running and secure.
• Cookies and local storage: small items saved in your browser, such as your bag contents and cookie choices. Analytics and marketing cookies are only used if you opt in. See our Cookie Policy.

Information from others

• Payment providers (Stripe and PayPal): confirmation that you have paid, the payment method type, limited card details such as the brand and last four digits, and fraud-check results. We never receive your full card number or security code.
• Delivery carriers: tracking and delivery updates about your parcel.

Your intention note

At checkout, and when you order a Channelled Commission, you can add a short note about the intention you would like your talisman to hold. It helps Reba choose and work with the stones for you. It is entirely optional; you can buy anything in the shop without writing one.

Because an intention note is personal, it could reveal your religious or philosophical beliefs, or information about your health. Data protection law calls this "special category" or "sensitive" information and gives it extra protection. So:

• We only use it with your explicit consent. If you write a note, you will see a separate checkbox, which is never ticked in advance, asking you to agree that we may use it to make your piece. If you don't tick it, we won't use the note.
• Please don't include health information. We don't need medical details to make your talisman. If you include them anyway, we will only use them for making your piece and will delete them on the same schedule.
• We use it for one purpose only: making your piece. We don't use it for marketing, we don't build a profile from it, and we never share it beyond the hosting and email services that store it for us.
• We delete it 90 days after delivery. That leaves time for any questions about your piece and then it is gone.
• You can withdraw your consent at any time by emailing [privacy@yourdomain.com]. We will delete the note straight away. This won't affect your order, although if your piece is already being made, we will finish it without referring to the note again.

How we use your information and our lawful bases

Data protection law (including the UK GDPR, the EU GDPR and Brazil's LGPD) requires us to have a lawful basis for each use of your information. Here is what we do and why.

Where we rely on legitimate interests, we have balanced our interests against yours and only proceed where the use is expected, proportionate and doesn't override your rights. You can object at any time.

Where we rely on consent, you can withdraw it whenever you like, as easily as you gave it. Withdrawing doesn't affect anything we did before.

If you don't give us the details marked as required at checkout, we can't take or deliver your order. Everything else is optional.

Our newsletter

• Separate opt-in: joining is never a condition of buying. The sign-up box at checkout is unticked, and you can also join from the site footer.
• Double opt-in: after you sign up, we send a confirmation email. You only join the list once you click the link in it.
• What you'll get: occasional news about new talismans, collections and studio notes.
• Leaving: every email has an unsubscribe link, or you can email us. We stop straight away.
• Records: we keep a record of when and how you agreed, so we can show we asked properly.

Our newsletter is sent through [Newsletter provider]. It may record whether an email was opened or a link was clicked so we can see what is useful. [Confirm whether open and click tracking is enabled, and whether it can be switched off.]

Cookies and local storage

We use a few strictly necessary items in your browser to remember your bag, your display currency and your cookie choices, and to allow secure payment. Analytics and marketing cookies only load if you opt in, and rejecting them is as easy as accepting them. We treat a Global Privacy Control signal as an opt-out of marketing.

You can find the full list in our Cookie Policy, and change your choices at any time with the Cookie settings button at the bottom of every page.

Who we share it with

We only share your information with trusted organisations that help us run the shop, and only what each one needs. Most act as our processors: they may only use your information on our instructions and must keep it secure.

• Stripe (card payments, Apple Pay and Google Pay) and PayPal (PayPal payments). They process your payment for us. For some purposes, such as preventing fraud and meeting their own legal duties, they act as independent controllers under their own privacy notices, which you can read on their websites.
• [Hosting provider]: hosts our website and keeps short technical logs.
• [Email provider]: sends and stores our order and customer-service emails.
• [Newsletter provider]: sends our newsletter to people who have opted in.
• [Shipping carrier] and other delivery partners: deliver your parcel and send tracking updates. For orders outside the UK, carriers share the details on the customs declaration (your name, address, the item and its value) with customs authorities in your country.
• Google Fonts: our pages load typefaces from Google's servers, which means your browser shares your IP address with Google when a page loads. Google says this service does not set cookies.
• [Analytics provider] and [Advertising pixel, e.g. Meta Pixel]: only if you opt in to those cookies.
• [Accountant] and other professional advisers, such as lawyers and insurers, where needed.
• Authorities and others where the law requires it, for example tax authorities, or to protect our rights or someone's safety.
• A future owner, if the business is ever sold or transferred. They would have to respect this policy.

We do not sell your personal information, rent it, or give it to anyone for their own marketing.

International transfers

We are based in the United Kingdom, and some of our service providers store or access information in other countries, including the European Economic Area (EEA) and the United States. When your information leaves the UK or EEA, we make sure it stays protected by at least one of these:

• Adequacy: the destination has been recognised as providing adequate protection (for example, UK adequacy regulations, EU adequacy decisions, including the one for the UK, and the EU-US Data Privacy Framework and its UK Extension, for certified US companies).
• Standard Contractual Clauses (SCCs) approved by the European Commission, with the UK Addendum where needed.
• The UK International Data Transfer Agreement (IDTA).
• For people in Brazil, Canada and Australia, equivalent safeguards recognised under local law, such as contractual protections.

When you order from outside the UK, your details travel with your parcel to your country, as they must for delivery. Information stored abroad may be accessible to authorities there under local law. You can ask us for more detail about the safeguards we use.

How long we keep it

We keep information only for as long as we need it, then delete it or make it anonymous.

Keeping it safe

• Our website uses HTTPS encryption.
• Payments are handled by Stripe and PayPal, which meet the payment card industry's security standard (PCI DSS). Your card details never touch our systems.
• Only Reba can access customer information, using strong passwords and two-step verification where available.
• We choose service providers with good security and written data protection terms.

No system is perfectly secure. If something ever went wrong and put your information at risk, we would act quickly, tell the relevant regulator where required (in the UK, within 72 hours), and tell you if it could seriously affect you.

Automated decisions

We don't make decisions about you by automated means, and we don't profile you. The one exception is payment fraud screening: Stripe and PayPal automatically check each payment for signs of fraud, and may decline a payment that looks risky. This is necessary to complete a safe purchase.

If you think a payment was wrongly declined, contact us. We can look at it personally, you can explain your side, and you can contest the outcome.

Children

Our shop is not directed at children under 16, and we don't knowingly collect their information. Orders must be placed by adults. If you believe a child has given us their details, please contact us and we will delete them.

Your rights in the UK and EU

Under the UK GDPR, the Data Protection Act 2018 and the EU GDPR, you have the right to:

• Access: get a copy of the information we hold about you.
• Rectification: have inaccurate or incomplete information corrected.
• Erasure: ask us to delete your information. We may need to keep some records, such as tax records, but we'll tell you if so.
• Restriction: ask us to pause using your information, for example while we check its accuracy.
• Portability: receive information you gave us in a common, machine-readable format, or ask us to send it to someone else.
• Objection: object to uses based on legitimate interests. You can object to direct marketing at any time, and we will always stop.
• Withdraw consent at any time, for the newsletter, your intention note or cookies.
• Not be subject to decisions based solely on automated processing that significantly affect you, other than as described above.
• Complain to a data protection regulator. See Complaints.

We will reply within one month. If a request is complex, we may extend this by up to two further months and will tell you why.

California and other US states

This section applies to residents of California under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, "CCPA"), and to residents of other US states with similar laws. We are a small business, but we choose to offer these rights to everyone in the US, whether or not the law strictly requires it of a business our size.

Notice at collection

This section is our notice at collection. The table below shows the categories of personal information we have collected in the past 12 months, where they come from, why we use them, and who receives them. How long we keep each category is set out in How long we keep it.

We do not create inferences or profiles about you.

We do not sell or share your personal information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16. Marketing cookies are off by default and only load if you actively opt in.

We only use sensitive personal information for purposes the CCPA permits (providing the goods you asked for), so we don't offer a separate "limit the use of my sensitive personal information" link. You can still withdraw consent for your intention note at any time.

Your rights

• Right to know: what personal information we have collected about you, the categories of sources, why we use it, who we disclose it to, and the specific pieces we hold.
• Right to delete personal information we collected from you, subject to legal exceptions such as tax records.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. We don't sell or share, but you can record your choice on Your Privacy Choices.
• Right to non-discrimination: we will never charge you a different price, give you a different level of service, or deny you goods because you used your privacy rights.

Global Privacy Control

If your browser sends a Global Privacy Control (GPC) signal, we treat it as a valid request to opt out of the sale or sharing of your personal information for that browser, and we keep marketing cookies off. You can check whether your browser sends GPC on Your Privacy Choices.

How we handle your request

• Send a request through our request form or by email to [privacy@yourdomain.com].
• We will confirm receipt within 10 business days and respond within 45 days. If we need more time, we may extend once by up to a further 45 days and will tell you why. Opt-out requests are acted on within 15 business days.
• To protect you, we will verify your identity, usually by matching the email address and order details we already hold. We will only ask for what we need.
• You may use an authorised agent. We will ask for proof of their authority and may ask you to confirm your identity directly.
• Other US states: if you live in a state such as Colorado, Connecticut, Virginia, Oregon or Texas, you have similar rights. If we decline your request, you can appeal by replying with "Appeal" in the subject line. We will respond within the time your state's law allows (usually 45 or 60 days), and if you are still unhappy you can contact your state Attorney General.

Brazil (LGPD)

If you are in Brazil, the Lei Geral de Proteção de Dados (LGPD) applies. We rely on equivalent legal bases to those in the table above: performance of a contract, compliance with a legal obligation, legitimate interests, and consent. For sensitive data, such as anything in your intention note, we rely on your specific and highlighted consent.

You have the right to: confirmation that we process your data; access; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed with your consent; information about who we share data with; information about the possibility of not giving consent and its consequences; and withdrawal of consent. You can also object to processing and complain to the Autoridade Nacional de Proteção de Dados (ANPD).

Our privacy contact at [privacy@yourdomain.com] is your channel for these requests. We will answer full access requests within 15 days.

Canada (PIPEDA)

If you are in Canada, we handle your information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and its fair information principles. We collect information with your knowledge and consent, only for the purposes described here.

You can ask to access your information and have it corrected, and you can withdraw consent (subject to legal or contractual limits, such as tax records). We will respond within 30 days. Your information may be stored and processed outside Canada, where it may be accessible to authorities under local law. You can complain to the Office of the Privacy Commissioner of Canada.

Australia (Privacy Act)

If you are in Australia, we follow the Australian Privacy Principles (APPs) under the Privacy Act 1988, whether or not the law strictly applies to a business our size. You can ask to access and correct the information we hold about you, and we will respond within 30 days.

As explained in International transfers, we disclose information to providers outside Australia, mainly in the UK, the EEA and the United States, and we take reasonable steps to make sure they protect it. If you have a complaint, please contact us first. If you're not satisfied with our answer, you can contact the Office of the Australian Information Commissioner (OAIC).

Wherever you live

Whatever the law in your country says, you can always:

• ask what information we hold about you and get a copy;
• ask us to correct it or delete it;
• stop our newsletter and withdraw any consent you've given;
• ask us questions about how we use your information and get a clear answer.

We will never treat you differently for asking. If your local law gives you more rights than this policy describes, we will honour them.

How to use your rights

• Use the request form on Your Privacy Choices, or
• email [privacy@yourdomain.com], or
• write to [Legal business name], [Registered address].

It's free. We will ask you to confirm your identity before sharing or changing anything, usually by replying from the email address you ordered with and giving your order number. We may refuse or charge a reasonable fee only where the law allows, for example for requests that are clearly unfounded or excessive, and we will explain why.

How quickly we reply: within one month in the UK and EU, 45 days in California and other US states, 15 days for access requests in Brazil, and 30 days in Canada and Australia, extended only where the law permits.

Complaints

We'd really like the chance to put things right, so please talk to us first. You also have the right to complain to a data protection regulator:

• United Kingdom: Information Commissioner's Office (ICO), ico.org.uk/make-a-complaint, telephone 0303 123 1113.
• European Union and EEA: the supervisory authority in the country where you live or work, or where the issue happened. You can find yours on the European Data Protection Board website.
• California: California Privacy Protection Agency, cppa.ca.gov, or the California Attorney General.
• Brazil: Autoridade Nacional de Proteção de Dados (ANPD), gov.br/anpd.
• Canada: Office of the Privacy Commissioner of Canada, priv.gc.ca.
• Australia: Office of the Australian Information Commissioner, oaic.gov.au.
• Anywhere else: your local data protection or consumer authority.

Changes to this policy

We may update this policy when our shop or the law changes. We will change the "Last updated" date at the top, and if a change is significant, for example a new use of your information, we will tell you by email or a notice on the site before it takes effect. Where a change needs your consent, we will ask for it.

Contact us

Questions, worries or requests about your privacy are always welcome.