Privacy Policy

Heartstones Ltd
Website: www.heartstonesjewellery.com
Last updated: 25 October 2026

1. Introduction

At Heartstones Ltd (“Heartstones”, “we”, “us” or “our”), we understand that the information, photographs and memories entrusted to us can be deeply personal.

We are committed to respecting your privacy and protecting your personal information.

This Privacy Policy explains how we collect, use, store, share and protect personal information when you visit our website, contact us, subscribe to our communications or purchase our products and services.

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable UK privacy laws.

2. Who We Are

Heartstones is operated by Heartstones Ltd, a company registered in England and Wales.

Company name: Heartstones Ltd
Company number: 16999965
Registered office: 23 Graig Park Road, Newport, NP20 6HD, United Kingdom
Website: www.heartstonesjewellery.com
Email: accounts@heartstonesjewellery.com

Heartstones Ltd is the data controller responsible for deciding how and why personal information is processed in connection with our business.

For privacy-related enquiries, please contact us using the email address above.

3. Personal Information We Collect

Depending on how you interact with Heartstones, we may collect the following information:

• Your name and contact details, including email address, telephone number and postal address.

• Billing, delivery and order information.

• Details of products purchased, commissions requested and personalisation instructions.

• Customer correspondence, enquiries and communication history.

• Photographs, names, dates, inscriptions and other information provided for personalised products.

• Information about personal elements supplied for memorial jewellery, including ashes, hair, fur or breastmilk, where relevant to your commission.

• Marketing subscription preferences and consent records.

• Website usage information, cookie preferences, device information and technical data.

• Payment transaction information and payment status provided through our payment service providers.

Payments are processed through secure third-party payment services. Heartstones does not normally receive or store your complete payment card details.

We ask that you provide only the personal information necessary for your order or enquiry.

4. Personalised Jewellery, Memorial Products and Photographs

We understand that memorial commissions may involve particularly meaningful and sensitive information.

Customers may provide photographs, names, dates, inscriptions, personal elements and other details to enable us to create personalised jewellery, keepsakes and memorial products.

We use this information only for purposes connected with your commission, customer service and any other purposes explained in this policy.

Photographs for lockets

Where customers supply photographs for photo lockets, these are received, prepared and printed directly by Heartstones.

Photographs for engraving

Where a photograph or design is required for an engraved product, we may securely share the relevant image and personalisation instructions with a trusted engraving supplier.

Only the information reasonably necessary to complete the commission will be shared.

Storage and retention of photographs

Customer photographs may be stored securely alongside the relevant order records to assist with enquiries, replacements and repeat commissions.

Our standard retention period for customer photographs is three years from the customer's most recent order.

After this period, photographs will be deleted unless continued retention is reasonably necessary for an identified lawful purpose.

Customers may request earlier deletion of their photographs, subject to any applicable legal requirements or other lawful reasons for retaining the information.

Financial and accounting records may be retained separately for longer periods where required by law.

Promotional use

We will not use identifiable customer photographs, personal stories or private memorial details for promotional purposes without appropriate permission.

5. How We Use Personal Information

We use personal information to:

• Respond to enquiries and provide customer support.

• Process orders and payments.

• Create personalised jewellery, keepsakes and memorial commissions.

• Arrange postal kits, collections, deliveries and returns.

• Communicate about orders, designs, personalisation and special requests.

• Manage repairs, replacements, refunds and aftercare.

• Maintain appropriate business and transaction records.

• Prevent fraud, protect our website and maintain security.

• Improve our website, products and customer experience.

• Send marketing communications where permitted by law.

• Meet our legal, tax, accounting and regulatory obligations.

We do not use customer information for purposes that are incompatible with those described in this policy without an appropriate lawful basis.

6. Our Lawful Bases for Processing

Under UK GDPR, we rely on different lawful bases depending on the purpose for which personal information is processed.

Contract: Where processing is necessary to take steps at your request before entering into a contract or to fulfil an order, commission or service.

Legal obligation: Where processing is necessary to comply with accounting, tax, consumer protection or other legal requirements.

Legitimate interests: Where necessary for our legitimate business interests, such as responding to enquiries, maintaining appropriate records, protecting our business, preventing fraud and improving our services, provided those interests are not overridden by your rights and freedoms.

Consent: Where we request your permission, including for certain marketing communications, optional cookies or promotional use of identifiable photographs and personal stories.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

If information supplied for a commission includes special category personal data, we will ensure that an additional condition for processing applies where required by law.

7. Marketing Communications

Customers and website visitors may choose to subscribe to Heartstones marketing communications, including product launches, news, updates and special offers.

Where required, we obtain your consent before sending marketing emails.

Our Shopify checkout and customer account sign-in processes may provide an optional email marketing subscription choice.

New email subscribers may be asked to confirm their subscription through a double opt-in confirmation email.

You can unsubscribe from marketing emails at any time by using the unsubscribe link provided or by contacting us directly.

Unsubscribing from marketing will not prevent us from sending necessary service communications about existing orders, payments or commissions.

We do not sell customer contact lists to third-party marketers.

8. Shopify and Website Services

Our online shop is hosted by Shopify, which provides the e-commerce platform used to operate our website and manage customer orders.

Shopify and its associated services may process personal information on our behalf or, for certain activities, for their own purposes as described in Shopify's privacy information.

This may include information relating to website visits, customer accounts, orders, transactions, security, analytics and shopping experiences.

We use Shopify features including customer privacy controls, marketing tools and other services necessary to operate our online store.

Shopify Network Intelligence

Shopify Network Intelligence is currently enabled on our store.

Where applicable, this feature allows Shopify to use certain customer and website interaction information across its services and participating merchants to improve shopping experiences, personalisation, fraud prevention, advertising and related services.

Such processing is subject to Shopify's applicable privacy terms and customer privacy controls.

Where consent is legally required for associated cookies or tracking technologies, we use consent controls to obtain and manage that consent.

For further information about Shopify's handling of personal information, please refer to Shopify's consumer privacy information.

9. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to support its operation and, where permitted, to improve the shopping experience.

These may include:

Required cookies: Necessary for essential website functions, such as security, checkout and shopping basket functionality.

Personalisation cookies: Used to remember preferences and support personalised website experiences.

Analytics cookies: Used to understand how visitors interact with our website and help us improve its performance.

Marketing cookies: Used to support advertising and measure the effectiveness of marketing activities.

Where required by UK law, non-essential cookies and similar tracking technologies are used only after you have given the appropriate consent.

Visitors in the United Kingdom can use our cookie banner to accept, decline or manage optional cookies.

You may also manage your cookie preferences through the privacy controls available on our website and through your browser settings.

Declining optional cookies will not prevent you from using the essential functions of our website.

10. Sharing Personal Information

We may share personal information with trusted third parties where reasonably necessary to operate our business and fulfil our obligations.

These may include:

• Shopify: For website hosting, e-commerce services, customer records and order management.

• Payment providers: To process payments and manage transactions.

• Delivery providers, including Royal Mail: To arrange postal kits, deliveries, collections and returns.

• Jewellery manufacturers, engraving specialists and other production suppliers: Where information is necessary to create or personalise an ordered product.

• Email and communications providers: To send order notifications, customer communications and permitted marketing emails.

• Professional advisers: Such as accountants or legal advisers, where necessary.

• Regulatory authorities: Where disclosure is required by law.

We aim to share only the information necessary for the relevant purpose.

Where third parties process information on our behalf, we take reasonable steps to ensure appropriate contractual and security protections are in place.

Some service providers, including Shopify, may also process personal information as independent controllers for certain purposes.

We do not sell customer contact lists or deliberately disclose private memorial information to unrelated third parties for their own marketing.

11. International Data Transfers

Although Heartstones Ltd is based in the United Kingdom, some of our service providers may store or process personal information outside the UK.

Our Shopify data hosting location is currently configured as the European Union.

However, Shopify and other service providers may process or access certain information from other countries as part of providing their services.

Where personal information is transferred internationally, we seek to ensure that an appropriate legal transfer mechanism or safeguard is in place, such as UK adequacy regulations or approved contractual protections, where required.

12. How We Protect Personal Information

We take reasonable technical and organisational measures to protect personal information against unauthorised access, accidental loss, alteration, misuse and unlawful disclosure.

These measures may include:

• Using reputable service providers and secure systems.

• Restricting access to information where appropriate.

• Protecting business accounts and devices.

• Using secure payment processing services.

• Sharing personal information with suppliers only where necessary.

• Reviewing and deleting information when it is no longer required.

Although we take appropriate precautions, no method of electronic transmission or storage can be guaranteed to be completely secure.

13. How Long We Keep Personal Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including satisfying legal, accounting, tax and regulatory requirements.

Our general approach is:

Customer photographs: Normally retained for three years after the customer's most recent order, unless a lawful reason requires a different period.

Order and financial records: Generally retained for at least six years where necessary to meet company accounting, tax and record-keeping obligations.

Customer correspondence and commission information: Retained for as long as reasonably necessary to manage orders, aftercare, enquiries, potential disputes and other legitimate business needs, with periodic review.

Marketing subscription information: Retained while you remain subscribed, together with appropriate records of consent, withdrawal or suppression where necessary to respect your preferences.

Website and cookie information: Retained according to the purposes of the relevant technologies, applicable consent choices and the retention arrangements of the service providers involved.

When personal information is no longer required, we will securely delete or anonymise it where reasonably practicable.

14. Your Data Protection Rights

Under UK data protection law, you may have the right to:

• Request access to the personal information we hold about you.

• Request correction of inaccurate or incomplete information.

• Request deletion of your personal information in certain circumstances.

• Request restriction of processing in certain circumstances.

• Object to certain processing, including direct marketing.

• Request transfer of certain information to yourself or another provider.

• Withdraw consent where processing relies on consent.

• Raise concerns about how your personal information is handled.

These rights are subject to applicable legal conditions and exceptions.

To exercise your rights, please contact accounts@heartstonesjewellery.com.

We may request reasonable information to verify your identity before responding.

We will respond within the time limits required by applicable data protection law.

15. Children's Personal Information

Our website and services are primarily intended for adults.

We recognise that memorial products may include photographs, names or other details relating to children, where supplied by an adult customer for a legitimate commission.

We handle this information with particular care and use it only for the relevant commission and other lawful purposes described in this policy.

We do not knowingly collect children's personal information directly for marketing purposes without an appropriate lawful basis.

16. Third-Party Websites

Our website may contain links to external websites, social media platforms and third-party services.

These organisations operate under their own privacy policies.

We encourage you to review their privacy information before providing personal information to them.

17. Complaints

If you have concerns about how Heartstones handles your personal information, please contact us first so that we have an opportunity to investigate and respond.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

Website: www.ico.org.uk

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, suppliers, legal obligations or data protection practices.

The latest version will be published on our website with an updated revision date.

Where required by law, we will provide additional notice or seek consent before making material changes to how personal information is processed.

19. Contact Us

For questions, requests or concerns relating to this Privacy Policy or your personal information, please contact:

Heartstones Ltd
23 Graig Park Road
Newport
NP20 6HD
United Kingdom

Email: accounts@heartstonesjewellery.com
Website: www.heartstonesjewellery.com