Privacy policy

PRIVACY POLICY

Last updated: 31 July 2026

This policy explains what personal information we collect when you visit tiritacase.com or buy from us, why we collect it, who we share it with, and what control you have over it. We've tried to write it in plain English. If anything is unclear, email us at hello@tiritacase.com and we'll explain it properly.

WHO WE ARE

Tirita Ltd (trading as Tirita) is the data controller for the personal information described in this policy.

Tirita Ltd
Unit 8 The Commercial Centre, Days Road, St. Philips
Bristol BS2 0QS
United Kingdom

Company number: 08103637
ICO registration number: ZB535581
Email: hello@tiritacase.com
Phone: +44 (0) 117 955 0486

WHAT WE COLLECT

When you place an order. Your name, billing and delivery address, email address, phone number, the items you ordered, any personalisation text you asked us to emboss, and your order history. Payment card details go straight to our payment providers — we never see or store your full card number.

When you create an account. Your name, email address, password (stored encrypted by Shopify, not visible to us), saved addresses and past orders.

When you sign up for marketing. Your email address, and if you give it, your name. We also record whether you open our emails and which links you click, so we can send fewer and better ones.

When you contact us. Whatever you send us: your name, email address, order number and the content of your message.

When you leave a review. Your name (or the display name you choose), your review, any photos you upload and, where relevant, confirmation that you actually bought the product.

Automatically, when you browse. Your IP address, device and browser type, time zone, the pages and products you view, what you search for, how you got to our site and how you move around it. This comes from cookies and similar technologies — see the cookies section below.

We don't collect special category data (health, religion, biometrics and so on), and we don't ask for it. Please don't send it to us.

WHY WE USE IT, AND OUR LEGAL BASIS

Under UK GDPR we need a lawful basis for everything we do with your data. Ours are:

• To take and fulfil your order — make your case, emboss it, ship it, send order and delivery updates, handle returns and refunds. Legal basis: performance of our contract with you.
• To answer your questions and provide support. Legal basis: performance of our contract, or our legitimate interest in helping people who get in touch.
• To send marketing emails and SMS about new designs, restocks and offers. Legal basis: your consent, which you can withdraw at any time. If you've bought from us, we may email you about similar products under the UK's "soft opt-in" rule — with an unsubscribe link in every single message.
• To invite you to review a product you bought and to publish reviews on our site. Legal basis: our legitimate interest in honest feedback and social proof; you're never obliged to reply.
• To understand how our site is used and improve it, using analytics. Legal basis: your consent, given through our cookie banner.
• To show you relevant ads on other platforms and measure whether they worked. Legal basis: your consent, given through our cookie banner.
• To prevent fraud and keep the shop secure. Legal basis: our legitimate interest in protecting the business and our customers, and our legal obligations.
• To keep accounting, tax and consumer-law records. Legal basis: compliance with our legal obligations.

Where we rely on legitimate interests, we've weighed them against your rights and privacy. You can object at any time — see "Your rights" below.

WHO WE SHARE IT WITH

We do not sell your personal information. We do not rent, swap or share mailing lists with other companies, ever. We share data only with the suppliers who help us run the shop, and only with what they need:

• Shopify — the e-commerce platform our store and checkout run on. See shopify.com/legal/privacy.
• Payment providers — Shopify Payments and, depending on how you choose to pay, PayPal, Apple Pay or Google Pay. They process your payment details directly and are data controllers in their own right for that.
• Delivery partners — mainly Royal Mail, plus any courier we use to get your parcel to you. They receive your name, address, and where you provide it, your email or phone for delivery notifications.
• Klaviyo — our email and SMS marketing platform.
• Judge.me — our product review platform.
• Analytics and advertising providers — Shopify's own analytics, and Google (Analytics and Ads) and Meta where we advertise. These only receive data about you if you accept marketing and analytics cookies.
• Professional advisers and authorities — our accountants, and law enforcement or regulators where we're legally required to disclose information.

If Tirita Ltd is ever sold or merges with another business, customer data may transfer as part of that; we'd tell you first.

WHERE YOUR DATA GOES

Some of our suppliers, including Shopify, store or process data outside the UK — typically in the EEA, Canada and the United States. When that happens we rely on UK adequacy regulations or on the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, so your data keeps an equivalent level of protection.

COOKIES

Cookies are small files stored on your device when you visit a site. We use them in three ways:

• Strictly necessary cookies — these make the shop work: your basket, checkout, login, security. They can't be switched off and don't need your consent.
• Analytics cookies — these tell us which pages people visit and where they get stuck, so we can fix it. They only run if you agree.
• Marketing cookies — these let us show you our ads on other sites and measure whether they led to a sale. They only run if you agree.

The first time you visit, our cookie banner asks what you're happy with. Nothing beyond the strictly necessary cookies is set until you choose — we don't use "implied consent". You can change your mind at any time through the cookie preferences link on our site, or by clearing and blocking cookies in your browser settings. Blocking necessary cookies will break parts of the shop.

Because there's no agreed standard for how sites should respond to "Do Not Track" browser signals, we don't currently act on them; use the cookie banner instead.

HOW LONG WE KEEP IT

• Order and transaction records: 7 years after the end of the relevant financial year, as UK tax law requires.
• Customer accounts: for as long as your account is open, and up to 2 years after your last activity if it goes dormant.
• Marketing contacts: until you unsubscribe, and up to 2 years of continuous inactivity after that.
• Customer service emails: up to 3 years after the conversation ends.
• Reviews: for as long as the product is on sale, unless you ask us to remove yours.
• Analytics data: normally up to 26 months, depending on the provider.

When a retention period ends we delete the data or anonymise it so it can no longer identify you.

YOUR RIGHTS

Under UK GDPR you have the right to:

• Access the personal data we hold about you, and get a copy of it.
• Rectify anything that's wrong or incomplete.
• Erase your data, where we no longer have a good reason to keep it.
• Restrict how we use it while a query is being sorted out.
• Portability — receive the data you gave us in a machine-readable format, or have it sent to another provider.
• Object to processing based on our legitimate interests, and to direct marketing at any time, no reason needed.
• Withdraw consent at any time, where consent is what we relied on. That doesn't affect anything we did before you withdrew it.

To exercise any of these, email hello@tiritacase.com or write to us at the address above. It's free, and we'll reply within one month. We may ask you to confirm your identity first, so we don't hand your data to someone else.

We don't make decisions about you by fully automated means with legal or similarly significant effects. Shopify runs limited automated fraud checks on transactions on our behalf, such as temporarily blocking IP addresses linked to repeated failed payments.

COMPLAINTS

If you're unhappy with how we've handled your data, please tell us first at hello@tiritacase.com — we'd genuinely like the chance to put it right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.

CHILDREN

Our shop is meant for adults. We don't knowingly collect data from anyone under 16. If you think a child has given us their details, email us and we'll delete them.

CHANGES TO THIS POLICY

We'll update this policy when our practices, our suppliers or the law change. The date at the top always tells you the current version. If a change materially affects you, we'll say so clearly on the site or by email.