Privacy policy

Last updated: 28 October 2026

This policy explains how SPILT MILK (“we”, “us” and “our”) collects and uses personal information when you visit spiltmilk.uk, shop with us, contact us, subscribe to our emails or take part in our feedback, research or prize draws.

Who is responsible for your information?

SPILT MILK is the data controller for the personal information we use to run our business. You can contact us at rosina@spiltmilk.uk, by telephone on +44 7919 213943, or by post at SPILT MILK, 2 Hunt Street, Swindon SN1 3HW, United Kingdom.

Information we collect

• Orders and enquiries: your name, email, telephone number, delivery and billing addresses, order details, payment status, returns and correspondence.
• Payments: payment and transaction information needed to process your purchase. Payment providers process the card or other payment details you enter at checkout; the information available to us depends on the payment method and provider.
• Accounts and preferences: account identifiers, order history, saved preferences and marketing choices.
• Website activity: IP address, browser and device information, pages and products viewed, basket activity and interactions with our website and communications, subject to your choices and applicable consent requirements.
• Feedback and prize draws: your answers, kit or project details, and any email address or order information you choose to provide for draw entry, a requested reply or follow-up research.

We receive information directly from you, through our website and communications, and from providers involved in payments, delivery, marketing and operating the store. Please avoid including payment details, health information or other sensitive personal information in feedback or general enquiries.

Why we use information and our lawful bases

• Orders, delivery, returns and account services: to take steps you request before a purchase and perform our contract with you.
• Customer support: to perform our contract where an enquiry relates to an order, or for our legitimate interest in answering questions and resolving problems.
• Accounting and legal requirements: to comply with legal obligations, including keeping relevant tax and transaction records.
• Security, fraud prevention and disputes: for our legitimate interests in protecting customers, preventing misuse and establishing, exercising or defending legal claims, and to meet legal obligations where applicable.
• Product feedback and improvement: for our legitimate interests in understanding customer experiences and improving our kits, guidance and services. Participation is optional.
• Prize-draw administration: to perform the draw terms you enter into, including checking eligibility, preventing duplicate entries, selecting and contacting a winner and arranging the prize. We also have a legitimate interest in maintaining proportionate records of a fair draw and resolving queries.
• Optional follow-up research: with your consent when you agree to be contacted for a conversation. You may withdraw that permission at any time.
• Email marketing: with your consent, or where the law permits marketing about our own similar products under the existing-customer “soft opt-in”. We only rely on that exception where its requirements are met, including an opportunity to opt out when details are collected and in each message.
• Personalised advertising and non-exempt tracking: with your consent where required. Necessary website functions and any legally exempt uses operate under the relevant rules; where personal information is involved, we rely on the applicable lawful basis, including our legitimate interest in operating and improving the store.

Where we rely on legitimate interests, we consider the purpose, necessity and impact on your rights. You can contact us for more information or to object. You do not have to provide optional information. Without the information needed to fulfil an order, we may be unable to process it; without a contact email, we cannot contact you about a draw entry or requested reply.

Feedback, research and prize draws

We use Google Forms and related Google Workspace services to collect and manage customer feedback. We use the responses to understand how your kit is going and improve our products and guidance. Where you provide an order email or order information, we may match it to our order records to verify an entry or respond to an issue.

Entering a draw is optional. Positive, negative or unfinished feedback does not affect your chance of winning. We use draw contact information to administer the draw and contact you if you win. If you request a reply or agree to a follow-up conversation, we use your details for that purpose too.

Completing feedback or entering a draw does not sign you up for marketing. We do not publish your identifiable feedback without separate permission. Any winner-information requirements will be explained in the relevant draw terms.

Marketing and your choices

You can unsubscribe from marketing emails using the link in any marketing email, or email rosina@spiltmilk.uk. Unsubscribing does not stop necessary order or service messages. We retain enough information to record and respect your opt-out.

You have the right to object at any time to the use of your personal information for direct marketing, including related profiling.

Where permitted and subject to your choices, we use information about purchases, browsing and engagement to make messages and advertising more relevant. Klaviyo supports our email marketing, signup forms and related customer communications.

Cookies and similar technologies

Our website uses cookies and similar technologies for functions such as the basket and checkout, remembering choices, understanding site use and advertising. Some are necessary to provide services you request. We ask for consent before using advertising or other non-exempt technologies that require it.

Use Cookie preferences in the website footer to review or change available choices and withdraw consent. You can also manage cookies through your browser, although blocking necessary cookies may affect the store. If you cannot access the controls or want help exercising an advertising opt-out, email rosina@spiltmilk.uk. Where applicable law requires it, supported Global Privacy Control signals are treated as an opt-out for the relevant browser or device.

Who receives your information?

We share information where needed for the purposes described above with:

• Shopify: hosting our store, checkout, orders and related commerce services.
• Payment and delivery providers: processing payments, delivering orders and handling returns.
• Klaviyo: managing email subscriptions, signup forms and customer communications.
• Google: hosting forms, feedback responses and related business communications and storage.
• Other service providers and professional advisers: supporting IT, accounting, security and business administration.
• Analytics and advertising partners: where relevant to the services used and subject to your choices and applicable consent requirements.
• Authorities or transaction counterparties: where legally required, necessary to protect rights, or in connection with a business sale or reorganisation with appropriate safeguards.

Providers processing information on our behalf are subject to appropriate contractual requirements. Some providers also act as independent controllers for their own services.

Shopify's role

Shopify processes information to provide our store and may also act as a controller for services such as Shop, Shop Pay and enhanced services. These services may use information from interactions with our store, other merchants and Shopify. Shopify explains its own uses and your choices in its Consumer Privacy Policy. You can use the Shopify Privacy Portal for relevant requests to Shopify. You can still contact us about information we control.

International transfers

Our providers may process information outside the UK, including in Canada, the United States and other countries where they and their service providers operate. Relevant arrangements depend on the provider and service.

For restricted transfers, we rely on an applicable UK adequacy regulation, or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses, together with additional protections where required. An applicable adequacy arrangement may include the UK Extension to the EU-US Data Privacy Framework for eligible certified recipients.

You can contact us for information about the safeguards relevant to your information and how to obtain a copy, subject to necessary redactions. Further details are available in the Shopify Data Processing Addendum, Klaviyo Data Processing Agreement and Google Workspace data-processing terms.

How long we keep information

We keep identifiable information only as long as needed for its purpose. Where a fixed period does not apply, we use these criteria:

• Orders and financial records: the accounting and tax recordkeeping period that applies to the record, together with any outstanding returns, disputes or legal claims.
• Enquiries and support: the time needed to resolve the matter and any reasonable follow-up, taking account of related order records, disputes and legal requirements.
• Feedback: while identifiable responses are needed to analyse the feedback, address issues or complete agreed follow-up. Information that no longer needs to identify you can be deleted or genuinely anonymised; anonymous findings may be retained to guide improvements.
• Prize-draw details: until the draw, winner contact and prize fulfilment are complete and relevant queries or complaints are resolved, with limited records retained where necessary to demonstrate fair administration or meet legal requirements.
• Marketing: while we have a valid basis to contact you, taking account of consent, engagement and opt-outs. Limited suppression and consent records may be kept to respect choices and demonstrate compliance.
• Website and cookie information: according to its purpose, the technology's expiry and applicable provider settings, subject to your choices.

Legal obligations or an active claim may require particular records to be kept longer. Contact us if you would like more information about the retention of a particular record.

Your privacy rights

Depending on the circumstances and applicable law, you can ask to access or correct your information, have it erased, restrict its use, receive a portable copy, or object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time without affecting earlier lawful processing. Some rights depend on the purpose and lawful basis, and legal exceptions may apply.

To make a request, email rosina@spiltmilk.uk or use our postal address above. We may request proportionate information to verify your identity. We normally respond within one month, subject to any extensions or other adjustments permitted by law. Requests are normally free of charge.

If local law gives you additional rights, such as opting out of the sale or sharing of information for targeted advertising, you can use the available privacy controls or contact us. We will not discriminate against you for exercising your rights. You may use an authorised representative where the law permits.

Security and other websites

We use appropriate technical and organisational measures to protect personal information, but no system can guarantee complete security. Please do not send card details or unnecessary sensitive information by email or in a feedback form.

Other websites linked from our store have their own privacy policies. Information you post publicly on social platforms may be visible to others.

Children

Our services are not directed at children, and we do not knowingly collect children's personal information for these purposes. If you believe a child has provided information that should be removed, please contact us. Any age restrictions for a prize draw are stated in its terms.

Questions and complaints

Please contact rosina@spiltmilk.uk with any privacy concern so we can investigate and respond. You also have the right to complain to the UK Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113. You do not have to wait for our response to exercise your right to complain. If you are in the EEA, you may also complain to the relevant supervisory authority.

Changes to this policy

We may update this policy to reflect changes to our services, practices or legal requirements. We will update the date above and provide additional notice where required. This policy explains our practices; visiting our website does not itself give consent to marketing or non-exempt tracking.