Privacy policy

Privacy Policy

Last updated: 24 September 2026

Heaven Hemp is operated by Bespoke Nepal LTD ("we", "us", or "our"). We are the "Data Controller" of the personal information collected through www.heavenhemp.co.uk.

This policy explains how we collect, use, disclose, and protect your personal information when you visit our website, place an order, contact us, or subscribe to our marketing materials.

1. Lawful Bases for Processing Your Data

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following lawful bases to process your personal data:

  • Performance of a Contract: To process, pack, ship, and deliver your orders, and handle returns or customer support.
  • Legal Obligation: To maintain business records, tax accounts, and comply with UK retail laws.
  • Consent: To send you email marketing communications and deploy non-essential tracking cookies. You can withdraw your consent at any time.
  • Legitimate Interests: To optimize our website performance, protect our store against fraud, and understand how visitors interact with our brand.

2. Information We Collect and Why

Information You Provide Directly

  • Order and Contact Details: Name, email address, delivery address, billing address, phone number, and payment preferences. Purpose: To fulfill your purchases, process transactions, and communicate regarding orders.
  • Customer Support Correspondence: Messages sent via email or contact forms. Purpose: To resolve your inquiries and maintain quality control.

Information Collected Automatically

  • Device and Usage Data: IP address, browser type, operating system, time zone, and how you interact with our shop. Purpose: To maintain website security, prevent fraud, and run analytics.

3. Third Parties We Share Your Information With

We never sell your data. We share your information only with trusted service providers critical to running our business:

Platform & Store Operations

  • Shopify: Our primary e-commerce platform hosting our store data.
  • Matrixify, Madgic, and Discounty: Store management, discounts, and optimization applications.

Fulfillment & Payment Processing

  • Diamond Logistics: Our fulfillment partner that picks, packs, and posts your orders.
  • Shopify Payments: Used to process direct credit/debit cards, Apple Pay, and Google Pay securely at checkout.
  • PayPal: Available as an alternative express payment gateway.

Note on Payment Data: We do not collect or store your full credit or debit card details on our servers. Your payment information is securely encrypted and processed directly by our payment partners (Shopify Payments or PayPal).

Marketing & Customer Reviews

  • Judge.Me: Used to collect and display verified customer reviews.

We may also disclose your data if legally compelled to do so by UK law enforcement or regulatory authorities.

4. Cookies and Tracking Technologies

Our website uses cookies to function properly (e.g., keeping items in your shopping cart).

  • Essential Cookies: Necessary for the website to function. These cannot be turned off.
  • We use essential technologies to run our shop. We may use analytics and marketing technologies where enabled, subject to the choices available through our cookie banner or preferences. You can also manage cookies through your browser settings.

You can update your choices at any time via our website cookie settings icon or your browser preferences.

5. International Data Transfers

Some of our service providers, including Shopify, may process your data outside the UK (such as in Canada or the USA). When transferring data outside the UK, we ensure it receives an equivalent level of protection.

  • UK Adequacy Regulations (e.g., transfers to Canada or the EU).
  • UK International Data Transfer Agreements (IDTA) or Standard Contractual Clauses (SCCs) with suppliers in countries without adequacy decisions (e.g., the USA).

6. How Long We Retain Your Data

We store your personal data only for as long as necessary:

  • Order & Accounting History: We retain order and accounting records for the period required by applicable tax and accounting obligations, then review the personal information in them for erasure or anonymisation where appropriate.
  • Customer Service Messages: We keep customer-service correspondence for as long as needed to respond to your enquiry and handle any related follow-up, then review it for deletion in line with our retention practices.
  • Marketing Data: Kept until you unsubscribe or withdraw your consent.

7. Your Legal Rights

Under UK data protection law, you have enforceable rights regarding your data, including:

  • The right of access: Request a copy of the personal data we hold about you.
  • The right to rectification: Ask us to correct inaccurate information.
  • The right to erasure: Ask us to delete your data under certain conditions.
  • The right to restrict or object to processing: Limit how we use your data, especially for direct marketing.
  • The right to data portability: Request a transfer of your data to another provider.

To exercise any of these rights, please email us at hello@heavenhemp.co.uk.

8. Complaints and Regulatory Body

If you are unhappy with how we process your data, please contact us first so we can resolve it. You also have the right to lodge a complaint with the UK supervisory authority:

  • Information Commissioner’s Office (ICO)
  • Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
  • Website: https://ico.org.uk

9. Contact Details

Bespoke Nepal LTD
37 St. Mary’s Road
Stratford-upon-Avon
CV37 6XG
Email: hello@heavenhemp.co.uk