Privacy Policy

EWE & ME LIMITED (“Ewe & Me”, “we”, “us”) is the data controller for personal data processed through eweme.shop. We are a home-textile retailer selling curated wool comfort kits worldwide.

Registered address: 82/86 High Street, Grantown On Spey, Morayshire, PH26 3EL, United Kingdom. For any privacy question, email support@eweme.shop or call +44 7162695394.

We collect only what we need to run the store and fulfil your orders:

• Contact & account data: name, email, phone (optional), and country.
• Order & delivery data: your shipping address (delivery address), items ordered, order value and order history — the data we need for order fulfilment and dispatch.
• Payment data: billing country and the payment confirmation and status returned by our payment provider. We do not receive or store your full card number.
• Support & enquiry data: messages you send us via the contact, wholesale/custom-order or support channels, including your subject and message.
• Membership data: your Cosy Club plan, billing period and subscription status.
• Technical data: IP address, device/browser type and essential cookie identifiers needed for the cart and security.

We do not collect government ID numbers, and we never store plaintext card numbers.

Our collection sources are:

• Directly from you: when you browse, add to cart, check out, enter your shipping address, subscribe to Cosy Club, or contact us.
• Automatically from your device: technical data generated by your browser and our essential cookies.
• From our payment provider: payment outcome and status data returned after you complete a transaction.
• From our delivery carriers: dispatch and delivery-status updates tied to order fulfilment.

• To fulfil your order and membership (contract): processing payment, arranging delivery, handling returns, refunds and exchanges, and managing your Cosy Club subscription.
• To provide support (contract / legitimate interests): answering enquiries and resolving issues.
• To keep the store secure and prevent fraud (legitimate interests / legal obligation).
• To meet legal, tax and accounting duties (legal obligation).
• To send order-related emails (contract) and, only where you have opted in, marketing emails (consent). You can withdraw consent at any time.
• Re-marketing leads: if you enter contact and delivery details at checkout but do not complete payment, we may retain those details on the basis of legitimate interests to follow up about your intended order. You can ask us to delete them at any time.

Payments are processed by our PCI-DSS compliant payment provider (Stripe; PayPal where offered). When you pay, you enter your card details on the provider's secure, hosted checkout — not on our servers. We receive only the result of the transaction (success/failure), a payment reference, and your billing country. Neither Ewe & Me nor our hosting provider ever sees or stores your full card number, CVC or expiry.

We share personal data only with processors that help us run the store, under contract and only as needed:

• Payment: Stripe (and PayPal where offered) to take payment and manage subscriptions and refunds.
• Hosting & infrastructure: our cloud hosting and platform provider for running the site.
• Database & lead storage: our managed database provider for orders, accounts and enquiries.
• Delivery & logistics: the carriers that ship your kit, who receive your name and delivery address.
• Email: our transactional email provider for order and support messages.
• Professional advisers & authorities where required by law.

We do not sell your personal data.

We ship and operate worldwide, so your data may be processed outside your country, including outside the UK/EEA. Where that happens, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses, so your data keeps an equivalent level of protection.

We keep order and transaction records for as long as needed to fulfil the order and to meet tax and accounting obligations (typically up to 6–7 years). Account, membership and marketing data are kept while your account or consent is active. Enquiry and unconverted checkout-lead data are retained for no longer than 24 months, then deleted or anonymised.

We use encryption in transit (HTTPS), access controls, and a hosted payment boundary so card data never reaches our systems. We limit staff access to personal data and review our processors' security. No method of transmission is perfectly secure, but we take reasonable steps to protect your information.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct inaccurate data or complete incomplete data.
• Erase your data (“right to be forgotten”) where applicable.
• Restrict or object to processing, including direct marketing.
• Data portability.
• Withdraw consent at any time where processing is based on consent.

California residents (CCPA/CPRA):you have the right to know, delete and correct personal information, and to non-discrimination for exercising these rights. We do not sell or share personal information as those terms are defined under California law — see “Do Not Sell or Share” below.

To exercise any right, email support@eweme.shop. We respond within the time limits set by applicable law.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. If our practices ever change, we will update this policy and provide a clear opt-out mechanism before doing so.

We use essential cookies to run the cart, checkout and security. Any non-essential analytics are used only in aggregate and, where required, with your consent. See our Cookie Policy for detail and how to manage cookies.

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. Our store is not directed at children: it is intended for adults. Under-13s may not use the store, and 13–17s should only use it with a parent or guardian's consent. If you believe a child has provided us data, contact us and we will delete it.

Questions or requests? Contact EWE & ME LIMITED, 82/86 High Street, Grantown On Spey, Morayshire, PH26 3EL, United Kingdom, or email support@eweme.shop.

If you are in the UK or EEA and believe we have not handled your data properly, you may complain to your local supervisory authority (in the UK, the Information Commissioner's Office). We'd appreciate the chance to resolve it first. This policy is governed by the laws of England and Wales.