Privacy policy
SAVE OUR SESSION LTD
PRIVACY NOTICE
Version 1.1 — PROVISIONAL DRAFT Last updated: 13 September 2026
PROVISIONAL DRAFT — NOT YET FOR ISSUE. Company details, dates and the effective date are confirmed. Everything marked [TO CONFIRM] is still outstanding and must be closed before this document is issued, printed on an invoice, or published on a live page. Numbers shown in square brackets, such as [30] days, are proposed defaults that are fine to leave as they are unless you want them changed. This document has not yet been reviewed by a solicitor. See
SOS-Legal-Pack-Status-and-Plan.mdfor what is outstanding and who owns it.
1. Who we are
Save Our Session Ltd ("SOS", "we", "us", "our") is the controller of the personal data described in this notice.
| Company | Save Our Session Ltd |
| Registered in | Scotland, company number SC866757 |
| Registered office | 18 McPherson Street, Glasgow, G1 5AJ |
| Trading address | Yard Road, Blairgowrie, PH10 6NW |
| ICO registration | [TO CONFIRM — ICO registration number] |
| Privacy contact | privacy@saveoursession.com |
| EU representative | [TO CONFIRM — name and address of EU representative] |
We do not have a statutory Data Protection Officer. Privacy questions go to privacy@saveoursession.com.
Because we sell to customers in the EU as well as the UK, this notice covers our obligations under both the UK GDPR and the EU GDPR, together with the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
2. What this notice covers
This notice explains what we do with personal data when you:
- buy from saveoursession.com;
- browse the site;
- sign up to our emails;
- submit a trade, wholesale, festival or distributor enquiry;
- contact us by email or social media; or
- interact with us at an event.
Our use of cookies and similar technologies is covered separately in our Cookie Notice at saveoursession.com/cookies.
3. The personal data we collect
3.1 Data you give us
| Category | Examples |
|---|---|
| Identity and contact | Name, email address, delivery address, billing address, telephone number |
| Order | Products ordered, order value, order number, order history, delivery instructions |
| Payment | Payment method type, the last four digits of your card, billing postcode. We never see or store your full card number — payments are handled by our payment providers |
| Age confirmation | Your confirmation that you are 18 or over, and the outcome of any age check |
| Account | If you create one: username, password (stored encrypted), saved addresses, preferences |
| Marketing | Whether you have consented to marketing emails, and your preferences |
| Enquiries | For trade enquiries: your business name, role, trading address, sales channel, estimated quantities, and anything else you put in the message |
| Correspondence | Emails, messages, complaints, returns requests and our replies |
3.2 Data we collect automatically
| Category | Examples |
|---|---|
| Device and technical | IP address, browser type and version, operating system, device type, screen size, time zone, language |
| Usage | Pages visited, products viewed, time on page, referring site, what you added to your basket, whether you completed checkout |
| Cookies and similar | See our Cookie Notice |
We collect the usage and cookie data described above only where you have consented, other than the strictly necessary items explained in the Cookie Notice.
3.3 Data we receive from others
- Shopify, our ecommerce platform, which processes orders, accounts and checkout on our behalf
- Payment providers, which confirm whether a payment succeeded and provide fraud-screening results
- Delivery carriers, which give us tracking and delivery status
- Social media platforms, where you interact with us publicly or send us a message
- Age verification providers, where used
3.4 What we do not collect
We do not seek or knowingly collect special category data — health, racial or ethnic origin, religious beliefs, sex life or sexual orientation, political opinions, trade union membership, genetic or biometric data. Please don't send it to us. If you tell us something about your health when asking whether a product suits you, we will use it only to answer your question and will not keep it beyond that.
4. Why we use your data, and our legal basis
| What we do | Data used | Legal basis |
|---|---|---|
| Take and fulfil your order, take payment, arrange delivery, handle returns and refunds | Identity, contact, order, payment | Contract — we need this to supply what you bought |
| Create and manage your account | Identity, contact, account, order | Contract |
| Answer your questions and handle complaints | Identity, contact, correspondence, order | Contract, and legitimate interests in running a responsive business |
| Confirm you are 18 or over | Age confirmation, identity | Legitimate interests in selling a caffeinated product responsibly, and in complying with age-restriction rules that apply to us |
| Keep accounting and tax records | Identity, order, payment | Legal obligation |
| Trace product batches and manage a product withdrawal or recall | Identity, contact, order | Legal obligation under food law, and vital interests where there is a safety risk |
| Send you marketing emails | Identity, contact, marketing preferences | Consent, or the soft opt-in under PECR where you have bought from us and we are marketing similar products. You can opt out at any time |
| Measure how the site is used and improve it | Device, usage, cookies | Consent for analytics cookies. Where we look at aggregated data that doesn't identify you, no personal data is involved |
| Show you relevant advertising | Device, usage, cookies | Consent |
| Handle trade and wholesale enquiries and manage trade accounts | Identity, contact, enquiry | Legitimate interests in developing our trade business, and contract once you become a customer |
| Prevent, detect and investigate fraud and misuse | Identity, order, payment, device | Legitimate interests in protecting our business, and legal obligation |
| Establish, exercise or defend legal claims | Any of the above | Legitimate interests in protecting our legal position |
Where we rely on legitimate interests, we have weighed our interests against your rights. You can ask us for our assessment for any of the purposes above by emailing privacy@saveoursession.com.
5. Marketing
5.1 We will send you marketing emails only if you have asked us to, or if you have bought from us and we are telling you about similar products. Every marketing email has an unsubscribe link, and we act on unsubscribes promptly.
5.2 Opting out of marketing does not stop the emails we have to send about an order you have placed — order confirmations, despatch notices, delivery updates and refund confirmations.
5.3 Trade enquiries are not a marketing sign-up. If you contact us about wholesale, a festival or distribution, we will use your details to answer that enquiry and manage the relationship. We will not add you to our consumer marketing list unless you ask us to.
5.4 You can change your preferences at any time by using the link in any email or emailing privacy@saveoursession.com.
6. Who we share your data with
We share personal data with the following categories of recipient, all of whom are bound to protect it and to use it only on our instructions.
| Recipient | What for | Where |
|---|---|---|
| Shopify (Shopify Inc. and its group) | Ecommerce platform, storefront, checkout, order management, customer accounts, analytics | Canada, USA, EU |
| [PAYMENT PROVIDERS — e.g. Shopify Payments, PayPal, Apple Pay, Google Pay] | Taking payment, refunds, fraud screening | [TO CONFIRM] |
| [DELIVERY CARRIERS] | Delivering your order and providing tracking | UK / EU |
| [EMAIL MARKETING PLATFORM] | Sending marketing and transactional emails | [TO CONFIRM] |
| [ANALYTICS PROVIDER, IF USED] | Understanding how the site is used | [TO CONFIRM] |
| [ADVERTISING PLATFORMS, IF USED] | Measuring and delivering advertising | [TO CONFIRM] |
| Google (Workspace) | Our business email | EU / USA |
| Cloudflare / Shopify Oxygen | Hosting and delivering the website | Global edge network |
| Our accountants, insurers and professional advisers | Running the business, advice, claims | UK |
| Enforcement authorities and regulators | Where we are required to disclose, or in a product safety matter | UK / EU |
We do not sell your personal data, and we do not share it with third parties for their own marketing.
If our business is sold or transferred, customer data may transfer with it. We will tell you before that happens and this notice will continue to apply until you are told otherwise.
7. Sending data outside the UK and EEA
Some of our providers are based outside the UK and the EEA, or use servers there.
Where that happens, we make sure one of the following is in place:
- the country has been formally recognised as providing adequate protection (for example, Shopify Inc. is based in Canada, which benefits from an adequacy finding for commercial organisations);
- the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, is in place; or
- for transfers from the EEA, the EU Standard Contractual Clauses are in place,
in each case together with any additional safeguards the transfer risk assessment shows are needed.
You can ask us for a copy of the safeguards that apply to a particular transfer by emailing privacy@saveoursession.com.
8. How long we keep your data
| Data | How long |
|---|---|
| Order, payment and delivery records | 7 years from the end of the financial year in which the order was placed, to meet HMRC and Companies Act requirements |
| Batch traceability records linking orders to batch codes | The shelf life of the product plus [6] months |
| Customer account | For as long as the account is open, then [24] months after your last order, then deleted or anonymised |
| Marketing list | Until you unsubscribe, then a suppression record is kept indefinitely so that we do not email you again |
| Trade enquiry that does not become an account | [24] months from the last contact |
| Trade account records | For the life of the account and 7 years afterwards |
| Correspondence, complaints and returns | [3] years from resolution, or longer where a claim is live |
| Website analytics | As set out in our Cookie Notice |
| Age verification outcome | [12] months |
Where we no longer need data for the purpose we collected it, we delete it or make it permanently anonymous.
9. Your rights
Under the UK GDPR and the EU GDPR you have the right to:
- be told how we use your data — that's what this notice is for;
- access the personal data we hold about you;
- have it corrected if it is wrong or incomplete;
- have it erased, where we no longer have a good reason to keep it;
- restrict how we use it while a concern is being resolved;
- object to our use of it where we rely on legitimate interests, and to object to direct marketing at any time, with no reason needed;
- portability — receive the data you gave us in a common machine-readable format, or ask us to send it to another provider; and
- withdraw consent at any time, where we relied on consent. Withdrawing consent doesn't affect anything we did before you withdrew it.
To use any of these rights, email privacy@saveoursession.com. We will respond within one month. If your request is complex we may extend that by up to two further months, and we will tell you if so. There is no charge unless a request is manifestly unfounded or excessive.
We may ask you to confirm your identity before we act, so that we don't disclose your data to someone else.
10. Automated decision-making
We do not make decisions about you by purely automated means that produce legal effects or similarly significantly affect you.
Our payment providers run automated fraud screening on transactions, which can result in a payment being declined. If that happens to you and you think it is wrong, contact us at hello@saveoursession.com and a person will look at it.
11. Children
Our products are sold to over-18s only and our site is not intended for children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, email privacy@saveoursession.com and we will delete it.
12. Keeping your data secure
We use appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS across the site), access controls and multi-factor authentication on the systems that hold customer data, and providers who maintain recognised security standards. No transmission over the internet is completely secure, so we cannot guarantee absolute security, but we take the protection of your data seriously and we have a process for handling a data breach, including notifying the regulator and, where required, you.
13. Complaints
If you are unhappy with how we have handled your personal data, please tell us first at privacy@saveoursession.com so that we can put it right.
You also have the right to complain to a supervisory authority:
- In the UK: the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk — 0303 123 1113.
- In the EU: the data protection authority in the country where you live, where you work, or where the issue arose. A list is published by the European Data Protection Board.
Complaining to a regulator doesn't affect any other legal remedy you have.
14. Changes to this notice
We may update this notice from time to time. The date at the top shows when it was last changed. Where a change is significant we will tell you by email or by a notice on the site. Previous versions are available on request.
Save Our Session Ltd is a company registered in Scotland, company number SC866757. Registered office: 18 McPherson Street, Glasgow, G1 5AJ. VAT number GB 505 3851 05.