Privacy policy

Last updated 1 September 2026.

This policy explains what personal information Crook and Staple collects, why, who we share it with, and what you can do about it. We do not sell your personal information, and we do not pass your details to third parties for their own marketing.

Who we are

The data controller is Matthew Petrie trading as Crook and Staple, Ground Floor Office, 2 Pentwyn Close, NP16 6UB, United Kingdom. VAT number GB441266609. Email sales@crookandstaple.com.

What we collect and why

Device and browsing information — browser version, IP address, time zone, cookie data, pages and products viewed, search terms and how you move around the site. We use this to load the site correctly and to understand how it is used so we can improve it. It is collected automatically through cookies, log files and similar technologies.

Order information — your name, billing address, shipping address, email address, telephone number where you give one, and payment information. We use this to take and fulfil your order, arrange delivery, send you order confirmations and invoices, deal with returns, screen orders for fraud risk, and — where you have asked for it — send you marketing. Card numbers are handled by our payment providers; we never see or store your full card number.

Customer service information — your name, contact details, order history and anything you tell us in an email or live chat. We use it to answer you and to keep a record of what was agreed.

Reviews — if you leave a product review, your first name, last initial and review content are published on the product page.

Age confirmation — where you buy a bladed item, your confirmation that you are 18 or over.

Our lawful bases

• Performance of a contract — taking, fulfilling and supporting your order.
• Legal obligation — keeping VAT and accounting records, and age-confirmation records for bladed items.
• Legitimate interests — running and securing the site, preventing fraud, understanding how the shop is used, and answering your enquiries. We balance these against your rights.
• Consent — marketing emails and non-essential cookies. You can withdraw consent at any time.

Who we share it with

We share your information with the service providers we need in order to run the shop:

• Shopify — our ecommerce platform, checkout, payment processing and live chat. Shopify's privacy policy.
• Shiptheory — generates our shipping labels from your order and delivery address.
• Royal Mail — delivers your parcel and, for tracked and age-restricted services, records delivery.
• Payment providers offered at checkout — such as Klarna, Apple Pay and Google Pay, where you choose one of them.
• Seal Subscriptions — manages recurring subscription orders.
• Judge.me — collects and publishes product reviews.
• Google Analytics — helps us understand how the site is used. Google's privacy policy; you can opt out with Google's browser add-on.
• Google Workspace — hosts the email you send us and our replies.

We will update this list if the providers we use change. We may also disclose information where we are legally required to — for example in response to a lawful request from an authority — or to establish or defend legal claims.

Where your information goes

Some of these providers are based outside the United Kingdom, including in the European Economic Area and the United States. Where information is transferred outside the UK we rely on UK adequacy regulations or on appropriate safeguards, such as the UK International Data Transfer Addendum.

How long we keep it

• Order, invoice and VAT records: six years from the end of the accounting period, as HMRC requires.
• Customer service correspondence: up to six years, so we can deal with any later query or claim about an order.
• Age-confirmation records for bladed items: for as long as the law requires.
• Marketing consent: until you unsubscribe, and a suppression record afterwards so we do not email you again by mistake.
• Analytics data: as set by the retention settings in the tools above.

Where you ask us to erase your information, we will do so unless we are required to keep it — for example a VAT record.

Marketing

We only send marketing emails if you have asked for them. Every one has an unsubscribe link, and you can also email us to be removed. Unsubscribing does not stop the transactional emails about an order you have placed.

Cookies

Cookies are small files stored on your device. Some are strictly necessary — they keep your cart, your session and the checkout working, and they cannot be switched off. Others are for analytics and marketing, and we only set those if you agree. You can change your choice at any time through the cookie banner or your browser settings, and through Your Privacy Choices. Blocking cookies may stop parts of the site working properly.

Automated decision-making

We do not make decisions about you by automated means that have a legal or similarly significant effect. Shopify applies limited automated fraud screening, including temporary blocks on IP addresses and cards associated with repeated failed transactions; these last hours or days and do not have a legal effect on you.

Children

Our site is not aimed at children, and we do not knowingly collect personal information from anyone under 18. Bladed items may only be bought by adults aged 18 or over. If you are a parent or guardian and believe your child has given us personal information, please contact us and we will delete it.

Your rights

You have the right to ask us for a copy of the information we hold about you, to have it corrected or erased, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time.

To exercise any of these, email sales@crookandstaple.com or write to us at the address above. We will respond within one month.

If you are in the EEA, the equivalent rights under the EU GDPR apply to you, and you may complain to your local supervisory authority.

If you are in the United States, some states — including California — give residents rights to know what personal information is collected, to have it deleted or corrected, and to opt out of its sale or sharing. We do not sell or share personal information for cross-context behavioural advertising. To make a request, contact us at the address above, or use Your Privacy Choices. We will not treat you differently for exercising these rights. You may use an authorised agent; we may ask for proof of their authority.

Complaints

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator: ico.org.uk/make-a-complaint.

Changes

We may update this policy to reflect changes in how we work or in the law. The date at the top shows when it was last revised.

Contact

Crook and Staple, Ground Floor Office, 2 Pentwyn Close, NP16 6UB, United Kingdom. Email sales@crookandstaple.com.