Privacy Policy
This policy explains what personal information Mustard & Grace collects when you visit our shop or place an order, why we use it, who we share it with, and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Who we are
Mustard & Grace is run by Zhizhou Fu, an individual seller based in China, who is the data controller for the personal information described here. Our full postal address is available on request. You can contact us about privacy via our contact form.
What we collect
- Order details: your name, email address, delivery address, the items you order and the amount paid.
- Payment: you pay through PayPal. PayPal processes your payment details; we never see or store your card or bank details. PayPal tells us whether the payment succeeded and may share your PayPal email address with us.
- Newsletter: if you subscribe in our footer, your email address and the date you signed up.
- Messages: when you use our contact form, your name, email address, the topic, your order number (if you give one) and your message. To stop spam we also keep a one-way scrambled (hashed) form of your connection's IP address, never the address itself. We also keep anything you send us by email.
- Technical data: like any website, our hosting provider processes your IP address and basic request information to deliver pages and protect the site from abuse.
Why we use it (and our legal basis)
| Purpose | Legal basis |
|---|---|
| Processing, delivering and supporting your order, refunds and returns | Performance of a contract |
| Answering messages you send through our contact form or by email | Legitimate interests (replying to you), or performance of a contract when it is about your order |
| Limiting spam on the contact form (hashed IP address) | Legitimate interests |
| Keeping order and accounting records | Legal obligation |
| Sending our newsletter | Your consent, which you can withdraw at any time |
| Keeping the site secure and preventing fraud | Legitimate interests |
We do not sell your personal information, and we do not use it for automated decision-making.
Who we share it with
We use a small number of service providers, who process data on our behalf:
- PayPal — payment processing. PayPal is also an independent controller for the data it collects under its own privacy statement.
- Cloudflare — hosts our website and database and provides security. If we enable Cloudflare Web Analytics, it gives us aggregated, cookie-free visit statistics.
- Delivery carriers — receive your name and delivery address so they can deliver your order.
- Telegram — when a new order or contact-form message arrives, we receive a short notification in a private Telegram chat (your name, email, order number and the start of your message) so we can reply quickly.
Some of these providers may process data outside the UK. Where they do, they rely on safeguards recognised under UK law, such as adequacy regulations or the UK International Data Transfer Agreement/Addendum.
Cookies
We use only cookies that are strictly necessary for the shop to work — for example, to remember what's in your basket. We don't use advertising or tracking cookies.
We also count visits without cookies. When you arrive on our site from somewhere else, your browser tells us which website or campaign sent you (for example Pinterest or a search engine) and what kind of page you landed on. We keep only daily totals. We don't store your IP address, a cookie or any identifier for this, so the totals can't be linked to you.
How long we keep it
- Order and payment records: 6 years after the end of the financial year they relate to, to meet UK tax and accounting rules.
- Newsletter sign-ups: until you unsubscribe or ask us to remove you.
- Contact-form messages and emails with you: as long as needed to deal with your enquiry, and no longer than the related order records. You can ask us to delete a message at any time.
- The hashed IP form is kept with your contact-form message and deleted with it; short-lived spam counters are cleared automatically.
Your rights
You have the right to access your personal information, to have it corrected or erased, to restrict or object to its use, to data portability, and to withdraw consent at any time (for example, to unsubscribe from our newsletter). To exercise any right, contact us via our contact form. We'll respond within one month.
If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.
Last updated: 22 October 2026.