Privacy Policy

Lorenzen Tonna Services Limited is the data controller for the personal data described here. Registered address: 5 South Charlotte Street, Edinburgh, EH2 4AN, United Kingdom.

For anything to do with your data, including the rights listed below, write to hello@mysuperstore.uk.

• Order and delivery details — your name, email address, phone number, delivery address and what you ordered.
• Account details, if you create an account — your name, email address, a hashed password and a saved delivery address.
• Basket activity — what you have added, and the delivery country you selected, so a basket survives you closing the tab.
• Your approximate country, from your IP address — used once, to pre-select a delivery destination. See below.
• Correspondence — what you write to us, and our replies.

We never see your card details. Payment happens on Stripe's own hosted page. We receive a confirmation that an order was paid and a reference to the transaction, and nothing else.

• To perform your contract — buying your items, shipping them and handling returns. This covers your order, delivery and account data.
• To comply with a legal obligation — customs declarations, import VAT records and the tax records we are required to keep.
• Our legitimate interests — keeping the site working, preventing fraud and abuse, and answering your messages. We do not think any of this overrides your interests, and you may object.
• Your consent, where we ask for it — and you may withdraw it at any time.

On your first visit we look your IP address up in a local country database to guess which country to ship to, so the prices you see are the right ones. The lookup happens on our own server against a downloaded file — your IP address is not sent anywhere, and the result is a country, never a location. It is only ever a suggestion: the moment you choose a country yourself, your choice is used and the guess is discarded.

We share only what each of these needs to do its job:

• Stripe — takes the payment. It receives your email address and the amount.
• Our carriers, and Sendcloud — receive the name, address and phone number the parcel is going to, and the customs description of its contents.
• UK retailers we buy from — receive an order shipped to our own UK hub. They are not told who you are.
• Our hosting and email providers — process data on our instructions and for no purpose of their own.

We do not sell your data, and we do not share it for anybody else's advertising.

We are established in the United Kingdom and your order is fulfilled there, so your delivery and customs details are processed in the UK. The European Commission has decided the UK offers an adequate level of protection. Where a provider processes data elsewhere, we rely on the European Commission's standard contractual clauses.

• Orders, invoices and customs records — for as long as tax and customs law requires, which is generally six years from the end of the relevant financial year.
• Account data — until you ask us to delete the account.
• Abandoned baskets — a short period, after which they are deleted.
• Correspondence — two years, unless it relates to a dispute.

We use cookies that are strictly necessary for the site to work: one that keeps you signed in and holds your session, one that remembers your basket, and one that remembers the delivery country you chose. These do not require your consent, and there is nothing to opt out of because we run no advertising or analytics cookies at all.

If that changes we will ask for your consent before setting anything, rather than telling you afterwards.

Under the GDPR you may ask us to:

• give you a copy of the data we hold about you;
• correct anything that is wrong;
• delete it, where we have no continuing obligation to keep it;
• restrict or stop a particular use of it;
• send it to you, or to somebody else, in a portable format;
• stop relying on legitimate interests, by objecting.

Write to hello@mysuperstore.uk. We answer within one month. There is no charge.

We make no automated decisions about you that produce a legal or similarly significant effect.

Please tell us first, so we can put it right. You may also complain to a supervisory authority — ours is the Information and Data Protection Commissioner (Malta), and you may instead complain to the authority in your own country.