Your information.

1. Who we are

Costly Oak Limited (trading as Trade Desk Co.) decides how your personal information is used and is responsible for it. Trade Desk Co. is a trading name of Costly Oak Limited, a private limited company registered in England and Wales (company number 16371446). Registered office: 5 Edgehill Chase, Wilmslow, SK9 2DJ, United Kingdom.

For any privacy question or request, email [email protected] or write to us at 5 Edgehill Chase, Wilmslow, SK9 2DJ, United Kingdom.

2. What we collect

• Order details: your name, email address, delivery address, the products you bought, the amount paid and your order number.
• Your phone number, for orders delivered outside the UK, so the carrier and customs can contact you about delivery.
• Your billing address, where the payment page asks for it.
• Payment details: entered on Stripe's payment page and held by Stripe. We see the payment status and, in Stripe's dashboard, limited card details such as the card type and last four digits. We never see your full card number.
• Messages you send us, for example about a return or a complaint.
• Technical information: our hosting provider, Cloudflare, processes your IP address and basic request details to deliver and protect the website. When you start a checkout we store a scrambled (hashed) version of your IP address with that checkout to stop automated abuse.

Your basket is saved in your own browser and is not sent to us until you start a checkout.

3. How we use it and our legal basis

• To take payment, pack and deliver your order, send order emails, and handle cancellations, returns, refunds and complaints. Legal basis: performing our contract with you.
• To complete customs declarations for international orders and to keep accounting and tax records. Legal basis: legal obligation.
• To prevent fraud and misuse of the checkout and to keep the website secure. Legal basis: our legitimate interest in running a safe shop.
• To answer your questions. Legal basis: our legitimate interest in helping customers, or our contract with you.

We do not send marketing emails. If we start a newsletter, we will only send it to people who have agreed to receive it or, for customers, give a clear way to opt out in every email.

Stripe screens payments automatically for fraud and may decline a payment it considers high risk. If that happens and you think it is a mistake, email us and we will look into it with Stripe.

4. Who we share it with

• Stripe, which processes payments and screens for fraud. For some of that work Stripe is responsible for your information itself; see stripe.com/privacy.
• Cloudflare, which hosts this website and our order database.
• Our email provider, which sends order confirmation emails on our behalf.
• Royal Mail and other delivery partners, which receive the name, address and contact details needed to deliver your parcel.
• Customs and tax authorities in the UK and the destination country, when an international parcel needs a customs declaration.
• Our accountants and professional advisers, and the police or regulators when the law requires it.

We do not sell your personal information.

5. International transfers

Stripe, Cloudflare and our email provider may process information outside the UK, including in the European Economic Area and the United States. Where they do, the transfer is covered by UK adequacy regulations or by the safeguards the UK GDPR requires, such as the International Data Transfer Agreement or Addendum. If you order delivery to another country, we have to send your delivery details to carriers and customs there.

6. How long we keep it

• Paid orders: six years from the end of the financial year in which you ordered, because UK company and tax law requires us to keep these records.
• Checkouts that were started but never paid: up to 12 months, to help resolve payment problems and prevent abuse.
• Emails with us: up to two years after our last contact, unless they relate to an order, in which case we keep them with the order.

7. Your rights

You can ask for a copy of your information, ask us to correct it or delete it, ask us to restrict or stop using it, object to our use of it, or ask for it in a portable format. Email [email protected]. We will reply within one month. Some rights are limited, for example we must keep order records for tax purposes.

If you are unhappy with how we have used your information, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk, telephone 0303 123 1113.

8. Cookies and browser storage

We do not use analytics, advertising or tracking cookies. We only use storage that is strictly necessary for the shop to work, so we do not need to ask for your consent:

• Basket and delivery region: saved in your browser's local storage so your basket is still there when you come back. You can clear it by emptying your basket or clearing your browser data.
• Security: Cloudflare may set a cookie such as __cf_bm to tell people from bots and protect the site.
• Payment: Stripe sets cookies on its own payment page to process your payment and prevent fraud. See Stripe's cookie policy at stripe.com/cookie-settings.

If we ever add analytics or marketing tools that need consent, we will ask you first.

9. Changes to this notice

We will update this notice if how we use personal information changes. Last updated 4 October 2026.