Privacy policy
Privacy Policy
Last updated: 11 September 2026.
This policy explains how Kaleidosocial CIC trading as Social Stories Club (“we”, “us”) uses personal data when you use socialstoriesclub.com, place a consumer order, contact us, or join our mailing list. Read it with our Terms & Conditions.
We are the data controller. Company number SC665056. Registered office: International House, 38 Thistle Street, Edinburgh, EH2 1EN. Email: info@socialstoriesclub.com.
ICO registration number: ZA769483. The public register entry is at ico.org.uk under that number. We pay the Tier 1 data protection fee. We do not have a statutory Data Protection Officer.
1. The law we follow
We process personal data under the UK GDPR and the Data Protection Act 2018. Electronic marketing and cookies are also covered by the Privacy and Electronic Communications Regulations 2003 (PECR).
2. Data we collect
We only collect what we need for the purposes below. We do not ask for date of birth or gender on the website. If an order contains alcohol we ask you to confirm that you and the recipient are 18 or over.
From you
• Identity and contact data: name, email, phone, billing address.
• Order data: products, gift messages, dietary or allergy notes you choose to give, discounts, and order history.
• Recipient data, when you send a gift to someone else: their name, delivery address, and any message or dietary note you include.
• Account data, if you create an account: login email and hashed password.
• Payment status and method (for example “Visa ending 1234”). Card numbers are taken by Shopify Payments and the payment method provider, not stored by us in full.
• Support correspondence, including emails you send us.
• Marketing preferences and newsletter sign-ups.
Collected automatically
• Device and usage data: IP address, browser type, pages viewed, dates and times, referring URL.
• Cookie and similar technology data, as described in section 11.
From others
Payment providers tell us whether a payment succeeded. Our fulfilment partner and couriers tell us tracking and delivery events. If you arrive via an Awin affiliate link, Awin may pass a click reference so we can attribute the order.
3. How we use data and our lawful bases
UK GDPR requires a lawful basis for each purpose. We use the following.
|
Purpose |
Types of data |
Lawful basis |
|
Take and fulfil an order, including sending a gift to a recipient you name |
Identity, contact, order, recipient, payment status |
Contract with you (Art 6(1)(b)). Recipient data: our legitimate interests in delivering the gift you ordered (Art 6(1)(f)) |
|
Customer service, replacements and complaints |
Identity, contact, order, support |
Contract, and legitimate interests in running the shop |
|
Accounts, VAT and legal records |
Order, payment status, identity |
Legal obligation (Art 6(1)(c)) |
|
Prevent fraud and misuse |
Identity, order, device, payment status |
Legitimate interests |
|
Email you about similar goods after a purchase, with an unsubscribe link |
Email, order history |
Legitimate interests plus PECR soft opt-in |
|
Newsletter or other marketing where you have not bought from us |
Email, name if given |
Consent (Art 6(1)(a)) and PECR consent |
|
Improve the website and measure campaigns |
Device, cookies, approximate location from IP |
Consent for non-essential cookies. Legitimate interests for strict diagnostics where no consent is required |
|
Affiliate attribution, where an affiliate referred you |
Order reference, click ID |
Legitimate interests in paying publishers |
You may object to processing based on legitimate interests. See section 8. Where we rely on consent you may withdraw it at any time. Withdrawal does not affect processing already carried out.
If you give us information about a recipient’s allergy or diet, treat that as data you are authorised to give us so we can fulfil your instructions. Do not send health information we do not need.
4. Who we share data with
We do not sell personal data. We share it with organisations who need it to run the shop.
|
Who |
Why |
Where |
|
Shopify |
Store, checkout, accounts, payments and some emails |
Ireland / Canada / other Shopify regions, with UK/EU transfer tools |
|
Card schemes and wallets shown at checkout (for example PayPal, Shop Pay, Apple Pay, Google Pay, Amazon Pay) |
Take payment and refunds |
UK, EEA, US as each provider states |
|
Commands |
Pick, pack, store and dispatch |
United Kingdom |
|
Royal Mail, DPD, DHL and Parcelforce |
Deliver parcels and provide tracking |
UK and, for AU/US orders, destination country |
|
HubSpot |
Customer records and email |
EEA / US with transfer tools |
|
xAI |
Help us draft and handle customer emails and order queries on our instructions |
United States, with transfer tools |
|
|
Analytics and advertising measurement |
US / global, with transfer tools |
|
Meta |
Advertising measurement |
US / global |
|
Awin |
Affiliate commission |
UK / EEA |
5. International transfers
Some providers store or access data outside the UK. Where that happens we use a lawful transfer mechanism, typically the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the ICO’s International Data Transfer Agreement / Addendum to the EU standard contractual clauses, plus an assessment of the destination.
Shopify, Google, Meta, HubSpot and xAI use facilities in the United States and elsewhere. Ask us if you want more detail about a named provider.
6. Retention
We keep data only as long as needed for the purpose, including legal claims and tax. Typical periods:
|
Record |
Period |
Why |
|
Orders, invoices, VAT records |
7 years after the end of the financial year of the order |
Tax and company law |
|
Delivery addresses and recipient details |
3 years after delivery, then review |
Complaints, lost parcels, repeats |
|
Customer service emails |
3 years after the last message |
Complaints and training |
|
Website account |
While the account is open, then 12 months after last login unless we must keep order records |
Contract and security |
|
Marketing email list |
Until you unsubscribe or the address hard-bounces, then suppression as needed |
PECR |
|
Cookie identifiers |
As set out in the cookie banner and section 11 |
Cookie rules |
|
Allergy notes on an order |
With the order record |
Fulfilment and safety |
Backups may hold a copy for a short period after deletion from live systems.
7. Security
We use technical and organisational measures appropriate to the risk. These include HTTPS on the website, access limited to people who need it, processor contracts, and payment data handled by PCI-DSS certified providers. No method of transmission is completely secure. If you suspect misuse of your data, email info@socialstoriesclub.com.
8. Your rights
You have the following rights in relation to your personal data, with the usual legal limits:
• Access: a copy of the data we hold about you, free of charge in almost all cases. We will not charge a standard fee. We may charge a reasonable fee, or refuse, only if a request is manifestly unfounded or excessive, or you ask for further copies.
• Rectification of inaccurate data.
• Erasure in the cases the UK GDPR allows.
• Restriction of processing.
• Objection to processing based on legitimate interests, and to direct marketing (always).
• Portability of data you provided, where we process it by contract or consent and by automated means.
• Withdrawal of consent, where consent is the basis.
Email info@socialstoriesclub.com. We may need to check your identity. We will respond within one month, or tell you if we need extra time under the UK GDPR (up to two further months for complex requests).
You may also complain to the Information Commissioner’s Office: ico.org.uk, or 0303 123 1113. We would rather fix the problem first.
A recipient of a gift may also make a request about data we hold that identifies them. We will need to balance that request against the buyer’s data and our ability to verify the requester.
9. Marketing
If you join our newsletter we will email you about our goods and the social enterprises we work with. That is consent-based marketing. You can unsubscribe on any email or by writing to us.
If you have bought from us, we may email you about similar goods under PECR soft opt-in. Every such email includes an unsubscribe link. We will not use soft opt-in for a person who only gave an address as a gift recipient.
We do not sell or rent our list.
10. Children
The shop is aimed at adults. We do not knowingly take website orders from children. Alcohol cannot be bought by or delivered to anyone under 18.
11. Cookies
A cookie is a small file placed on your device. Some are essential to run the checkout. Others measure traffic or ads. Non-essential cookies are set only if you accept them via the cookie banner, except where PECR allows a strict exception.
You can also block cookies in your browser. If you block essential cookies the shop may not work.
The banner on the website shows the live list. The types we use are:
|
Type |
Purpose |
Provider |
Typical life |
|
Essential / checkout |
Cart, session, security, payment |
Shopify |
Session to 1 year |
|
Account |
Keep you signed in if you have an account |
Shopify |
Session / 1 year |
|
Analytics |
How the site is used (only if you consent in the banner) |
|
Up to 2 years |
|
Advertising |
Measure Google and Meta ads (only if you consent in the banner) |
Google and Meta |
Up to 90 days |
|
Affiliate |
Attribute an order to an Awin publisher |
Awin |
As Awin sets |
12. Links
The website may link to other sites. Their privacy notices apply to those sites.
13. Changes
We will post any change on this page and update the “Last updated” date. If a change is material we will also email account holders or subscribers where we can.
14. Contact
Kaleidosocial CIC trading as Social Stories Club
International House, 38 Thistle Street, Edinburgh, EH2 1EN
ICO registration ZA769483