Privacy policy

This policy explains how Ruuted Ltd ("we") processes personal data, in line with the UK GDPR and the Data Protection Act 2018. The data controller is Ruuted Ltd, registered in England & Wales. Contact us at hello@ruuted.co.

1. What we collect

• Order data: name, delivery and billing address, email, phone (optional), order history.
• Payment data: handled by our PCI-DSS compliant payment providers; we never see full card details.
• Account data if you create one: email, hashed password, saved addresses.
• Marketing consent if you sign up to the newsletter.
• Technical data: IP address, device, browser and pages visited (see Cookies).

2. Why we use it (lawful bases)

• Contract: to process and deliver your order, handle returns and provide customer service.
• Legal obligation: to keep tax and accounting records (typically 6 years).
• Legitimate interests: to run and improve the site, prevent fraud and secure our systems.
• Consent: for marketing emails and non-essential cookies. You can withdraw consent at any time.

3. Who we share it with

Only the processors we need to run the shop:

• Payment providers (e.g. Stripe, PayPal, Klarna, Clearpay).
• Carriers (e.g. Royal Mail, DPD) for delivery.
• Email and analytics providers under a data-processing agreement.
• Regulatory or law-enforcement bodies where legally required.

We do not sell personal data.

4. International transfers

Some processors may be based outside the UK. Where they are, transfers are protected by UK adequacy regulations or the International Data Transfer Agreement / Addendum with UK Standard Contractual Clauses.

5. How long we keep it

Order records: 6 years after your last purchase (HMRC requirement). Account data: until you ask us to close it. Marketing data: until you unsubscribe.

6. Your rights

Under UK GDPR you have the right to:

• access a copy of the data we hold;
• ask us to correct or delete data;
• restrict or object to processing;
• data portability;
• withdraw consent at any time;
• complain to the Information Commissioner's Office (ico.org.uk).

Email hello@ruuted.co to exercise any of these — we'll reply within 30 days.

7. Security

The site runs over HTTPS. Passwords are hashed. Access to personal data is restricted to staff who need it.