Privacy Policy
Last updated: 24 July 2026
This policy explains how Hiddenite Limited (trading as Moldavite) ("we", "us", "our"), the data controller for Moldavite, collects, uses, and protects your personal data when you visit or shop with us, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
Hiddenite Limited, trading as Moldavite
3rd Floor, 86-90 Paul Street, London, England, United Kingdom, EC2A 4NE
Company number: 17100727
Contact: [email protected]
What we collect
We collect only what's needed to run the store:
- Order and delivery data — name, email address, delivery address, and the items and value of your order.
- Account data — your email address, used to sign you in via a one-time link (we don't store or ask for a password).
- Payment data — handled entirely by Square, our payment processor. We never receive or store your card details; we only receive confirmation that payment succeeded and a payment reference.
- Contact form submissions — name, email, and message, if you contact us directly.
- Technical data — standard web server logs (IP address, browser type, pages visited) kept briefly for security and troubleshooting.
Our lawful basis for processing
- Contract — processing your order, arranging delivery, and providing customer support.
- Legitimate interests — keeping the site secure, preventing fraud, and responding to contact form enquiries.
- Legal obligation — retaining order and payment records for accounting and tax purposes.
We do not use your data for marketing emails, and we do not sell or share your data with third parties for their own marketing purposes.
Who we share data with
- Square — processes your payment. See Square's privacy policy.
- Our email provider — delivers transactional emails (order confirmations, sign-in links, shipping updates). We do not use your email address for marketing.
- Delivery carriers — receive your name and delivery address to fulfil your order.
We do not transfer your data outside the UK/EEA except where a provider above does so under a recognised adequacy decision or standard contractual clauses.
Cookies
We only use strictly necessary cookies (to keep you signed in and remember your cart) — see our Cookie Policy for details. We do not use analytics or advertising cookies.
How long we keep your data
- Order records: kept for 6 years to meet UK accounting and tax obligations.
- Account data: kept while your account is active; you can ask us to delete it at any time (subject to the order-record retention above).
- Contact form messages: kept for up to 12 months, then deleted.
Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Ask us to delete your data (subject to our legal retention obligations)
- Restrict or object to certain processing
- Receive your data in a portable format
To exercise any of these rights, contact us at [email protected]. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO).
Children's privacy
This store is not directed at children, and we do not knowingly collect data from anyone under 18.
Changes to this policy
We'll update the "last updated" date above if this policy changes, and post the new version here.
Contact
Questions about this policy or your data: [email protected] or our contact form.