Pool Spa Shop, Bath Rd, Box, Corsham, Wiltshire, SN13 is the data controller for this website (https://www.poolspashop.co.uk). For any question about this policy, or about the personal data we hold on you, contact [email protected].
This policy explains what we collect, why, who else sees it, and what you can ask us to do about it. We handle personal data in line with the UK GDPR and the Data Protection Act 2018.
Last updated: 19 October 2026.
What we collect, and why
When you place an order. Your name, billing and delivery address, email address and telephone number, and the items you ordered. We need this to take payment, send your order, and deal with any return or query afterwards. Our lawful basis is performance of a contract with you.
When you pay. Card payments are taken by Stripe. Your card details are entered on Stripe’s own payment form and go directly to Stripe — they do not pass through this website, and we never see or store them. We receive confirmation of the payment, the amount, and the last four digits of the card. Stripe is a separate data controller for the payment and handles your data under its own privacy policy.
When you use a contact form. Your name, email address and your message, so that we can reply. Our lawful basis is our legitimate interest in answering you.
When you leave a comment. The name and email address you give, your comment, your IP address and your browser string. The last two help us detect spam.
Automatically, as you browse. Your IP address, browser and device type, the pages you look at and when. Some of this is strictly necessary to serve the site and keep it secure. The rest is statistics, and is only collected if you accept it on our cookie banner.
Cookies and analytics
We ask for your consent before setting any cookie that is not strictly necessary. Until you accept, no analytics or advertising cookies are set.
With your consent we use Google Tag Manager and Google Analytics to understand how the site is used. We have enabled Google Consent Mode, so before you consent Google receives no identifying information and sets no cookies.
Our full list of cookies, what each one does and how long it lasts, is in our Cookie Policy. You can change or withdraw your choice at any time using the “Manage consent” link there.
Who else sees your data
- Stripe — card payments.
- Google — analytics.
- Our email provider — to send order, booking and account emails.
- Our hosting provider, our firewall and malware scanner — server and security logs, including your IP address, to keep the site available and secure.
- Our couriers — your name, delivery address and telephone number, so that your order can be delivered.
We do not sell your personal data, and we do not share it for advertising.
Some of these providers are outside the UK. Where that is so, transfers are made under the UK’s International Data Transfer Addendum or an adequacy decision.
How long we keep it
- Order records: 7 years, because we need them for tax and accounting.
- Contact form messages: 12 months.
- Comments: until you ask us to remove them.
- Analytics data: 14 months, which is Google Analytics’ retention setting.
- Server and security logs: up to 12 months.
How we protect it
The site is served over HTTPS and administrative access is limited to named accounts. The site is monitored by a firewall and a malware scanner. Payment card data never reaches our systems.
Your rights
You have the right to ask us for a copy of your personal data, to correct it, to have it erased, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on your consent, you can withdraw it at any time. Email [email protected] and we will respond within one month.
If you are not satisfied with our response, you can complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk or on 0303 123 1113.
Children
This site is not directed at children, and we do not knowingly collect personal data from anyone under 16.
Changes to this policy
If we change this policy we will update the date above, and where the change is significant we will say so on the site.