Privacy & cookies

Last updated: 2 November 2026

This notice explains what personal data we collect when you visit or buy from Breed & Birch, why, who else handles it, how long we keep it, and your rights. We collect what we need to make and post your order, and little else.

Who we are

Breed & Birch is a trading name of Realtime Tech Ltd, a company registered in England and Wales, company number 11073804. We decide how your personal data is used, so we are its “controller” under UK data protection law.

Address: Sunrise, Chawston Lane, Chawston, Bedford MK44 3BH, United Kingdom
Email: info@breedandbirch.shop
ICO registration number: ZB820799

What we collect

When you buy:

your name, delivery address and email address, and your phone number if you or your wallet gives it (Apple Pay, Google Pay and Link send these to us from your wallet)
your order: each pet’s name as you confirmed it, the designs, the prices, the delivery service, any name changes (old name, new name and when) and any notes we add while making it
the outcome of your payment: Stripe takes your card details, so we never see or store your full card number, only limited details Stripe shows us, such as the card type and its last 4 digits
how you found us: the campaign tags in the link you arrived by (such as utm_campaign and the advert’s ID), the click ID Meta adds to links from Facebook and Instagram ads (fbclid), and when you arrived. Until you order they are held only in the open page, not stored on your device
whether you accepted cookies

When you visit:

counts of visits and of steps in the shop, which don’t identify you and aren’t personal data (see Cookies)
your IP address and browser details, which our hosting provider and Stripe need to deliver the site and take payments securely
if you choose Accept, what Meta’s tools collect (see Cookies)

When you email us: your email address and what you write.

How we use it, and why we’re allowed to

UK data protection law requires a lawful basis for each use.

To make, post and support your order, including order emails, the 60-minute name change, adding another pet, and answering questions about your order. Basis: contract (we need it to do what you asked).
To keep tax and accounting records. Basis: legal obligation.
To prevent fraud and keep the shop and payments secure. Basis: legitimate interests (safe payments, for you and for us).
To see which adverts lead to orders, from the campaign tags and click ID kept with your order. Basis: legitimate interests (running and improving a small business). You can object by emailing us.
To count visits and steps in the shop so we can improve it. These counts don’t identify you and aren’t personal data (see Cookies), so they need no lawful basis or consent.
To answer messages that aren’t about an order, and to deal with complaints and legal claims. Basis: legitimate interests.
To measure and improve our Facebook and Instagram adverts with Meta. Basis: consent, only if you choose Accept. You can withdraw it at any time.

We need your name, address and email address to take an order. Without them we can’t make or post it.

We don’t send marketing emails, and we don’t sell personal data.

We don’t make decisions about you based only on automated processing. Stripe checks payments automatically for fraud and may decline one; if that happens, email us.

Companies that handle it for us, only to provide their service:

Amazon Web Services (AWS) hosts this website and our order database, and sends our order emails, in London.
Stripe processes your payment.
Our email providers carry and store the emails between you and us.

Organisations that use it under their own responsibility:

Stripe, which also uses payment and device data to prevent fraud and meet financial regulations, and saves your details for you if you use Link. See Stripe’s privacy policy.
Royal Mail, which gets your name and address, and your email address and phone number if you gave them, to deliver your order and send delivery updates.
Meta (Facebook and Instagram), unless you turn it off in Cookie settings. See Cookies and Meta’s privacy policy.
HMRC, the police or the courts when the law requires it, and our professional advisers, such as an accountant or solicitor, when they need it.

Outside the UK

AWS keeps our order database, and sends our emails, in London. Stripe and Meta may handle data in other countries, including the United States. When personal data leaves the UK, it must be protected as UK law requires: for example, because UK regulations recognise the other country’s protection (such as the European Economic Area, or US companies certified under the UK Extension to the EU-US Data Privacy Framework), or because the companies have signed data protection clauses approved for UK transfers. Email us if you want details.

How long we keep it

Orders, payments and name changes: 6 years from the end of the financial year in which you ordered, because tax and VAT law requires us to keep business records.
Unpaid checkouts (you started but didn’t pay): deleted within 30 days.
Details kept only for Meta (your IP address, browser details and Meta’s cookie IDs, only if you chose Accept): deleted once they have been sent to Meta.
Emails you send us: as long as we need them to help you, or, if they’re about an order, as long as the order records.
Your cookie choice: 6 months, in your browser.

Stripe, Royal Mail and Meta keep their own records for as long as their policies and the law require.

Your rights

You have the right to:

get a copy of your personal data
have it corrected if it’s wrong
have it deleted, unless we have to keep it (for example, order records for tax)
ask us to restrict how we use it, or object to uses based on our legitimate interests
receive the data you gave us in a common digital format, to take elsewhere
withdraw your consent to advertising cookies at any time, with “Cookie settings” at the bottom of the shop page (this doesn’t affect what happened before)

To use any of these rights, email info@breedandbirch.shop. It’s free. We’ll reply within a month, or tell you within that month if a complex request needs up to 2 more months. We may ask you to confirm who you are.

Complaints

If you’re unhappy with how we’ve used your personal data, tell us first at info@breedandbirch.shop. We’ll acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.

You can also complain to the ICO, the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Keeping it safe

Card details go straight to Stripe and never reach us. Your order page has a private link: anyone with it can see your order and, during the first 60 minutes, change the names, so please don’t share it.

Cookies

Cookies are small files a website keeps in your browser. We use as few as we can.

Essential (always on)

These are needed for the shop and payments to work, so they don’t need your consent.

Your cookie choice: whether Meta is on (the default) or you turned it off, with Accept also the random ID described under Advertising, kept in your browser for 6 months. Safari may forget it sooner if you don’t visit for a week; then the default applies again until you choose.
Your order page: unless you turned Meta off, the page takes its private link out of the address bar, so Meta’s Pixel never sees it, and keeps it in that browser tab until you close it.
Stripe: when the payment buttons load, Stripe sets cookies it needs to take payments safely and prevent fraud (such as __stripe_mid and __stripe_sid). See Stripe’s cookie policy.

Advertising (Meta, on unless you turn it off)

We use Meta’s advertising tools when you visit the shop, as our terms say. You can turn them off at any time: choose “Cookie settings” at the bottom of the shop page, then Reject. From then on nothing about your visit or your order goes to Meta (no Meta Pixel, no Meta cookies and no events from our server), we remember that for 6 months, and the shop works exactly the same.

Meta Pixel. It tells Meta what you do in the shop, for example viewing a design, starting to type a name (not the name itself), adding a pet, starting checkout, and buying, with the order value. It sets Meta’s cookies on our site (_fbp, and _fbc if you came from an ad), which normally last 90 days, and your browser may send Meta the cookies Meta has already set, for example if you’re logged in to Facebook or Instagram.
The same events from our server (Meta’s Conversions API), so they still count if your browser blocks the Pixel. With them we send your IP address and browser details, Meta’s cookie IDs, a random ID we keep with your cookie choice and, at checkout and when you buy, your email address, phone number, name, town and postcode, turned into codes (hashed) so that Meta can match them to an account without us sending them in plain text.

Meta uses this to tell us which adverts lead to visits and sales, and to show our adverts to people likely to be interested, including people who have visited the shop. Meta also uses it for its own purposes, as its privacy policy explains.

Counting visits, without cookies

We count visits and steps in the shop ourselves, such as choosing a design, tapping Buy or a payment error, to see how the shop is used and which adverts bring visitors, and to improve both. Each count records the step, the design, the campaign tags from the link you arrived by, whether that link had a Facebook click ID (not the ID itself), and the type of device and browser and the rough screen width. It uses no cookies, stores nothing on your device, and doesn’t record your IP address, name or email address.

Because it stores nothing on your device and records no personal data, this counting runs whatever you choose in Cookie settings, which is about Meta only.

Changing your mind

Use “Cookie settings” at the bottom of the shop page to turn Meta off, or back on, at any time. You can also delete cookies in your browser’s settings.

Changes to this notice

If we change how we use personal data, we’ll update this page and the date at the top.