Privacy policy
1. Who we are
This website and store are operated by Brand Sauce Limited, a company registered in England and Wales (company number 11327898), trading as Oswin Hyde. Our registered office is Unit 7, 55 Hastings Road, Leicester LE5 0BT, United Kingdom.
In this policy, "we", "us" and "our" mean Brand Sauce Limited.
We are the data controller for the personal information described in this policy. That means we decide how and why your information is used, and we are responsible for looking after it.
Our store is powered by Shopify, which processes information on our behalf and, in some cases, as a controller in its own right. Section 9 explains this.
This policy explains what we collect, why, what we do with it, and the rights you have. If anything here is unclear, contact us — details are in Section 15.
2. The information we collect
Depending on how you use our site, we may collect:
Contact details — your name, email address, phone number, billing address and delivery address.
Order and payment information — what you bought, when, the delivery method, order value, and payment confirmation. We do not store your full card number. Payments are handled by our payment providers, who are responsible for that data.
Account information — your username, password (stored encrypted), saved addresses, preferences and settings.
Browsing and transaction activity — products you view, add to your basket or wishlist, and your order, return and exchange history.
Messages you send us — anything you include when you contact us by email, phone, live chat or social media, including the content of the conversation.
Reviews and content you post — product reviews, ratings and photos you choose to submit.
Technical information — your IP address, device type, browser, operating system, and how you move around our site. Collected automatically, largely through cookies.
Marketing preferences — whether you've opted in to hear from us, and which channels you've agreed to.
3. Where we get it
-
Directly from you — when you order, create an account, subscribe, leave a review, or contact us.
-
Automatically — through cookies and similar technologies when you browse.
-
From our suppliers — for example, delivery updates from DPD or Evri, or fraud signals from our payment providers.
-
From advertising and social platforms — where you've engaged with our ads or content and the platform's own settings permit it.
4. Why we use it, and our legal basis
UK data protection law requires us to have a valid legal basis for everything we do with your information. Here is ours, purpose by purpose.
| What we do | Why | Legal basis |
|---|---|---|
| Process and deliver your order, take payment, handle returns and exchanges | To do what you've asked and fulfil our contract with you | Contract |
| Create and manage your account | To provide the account you signed up for | Contract |
| Answer your questions and provide customer support | To help you and run our business properly | Legitimate interests — responding to customers who contact us |
| Send you marketing emails and texts | To tell you about products you may like | Consent, or the soft opt-in where you've bought from us before and haven't objected |
| Send postal marketing | To share catalogues and offers | Legitimate interests — promoting our business, balanced against your right to object at any time |
| Show you personalised ads on other websites and social platforms | To reach people likely to be interested in what we make | Consent (given through our cookie banner) |
| Recommend products and personalise what you see on our site | To make the store more useful to you | Consent for non-essential cookies; legitimate interests for basic on-site personalisation |
| Detect and prevent fraud, and keep the site secure | To protect you, us, and other customers | Legitimate interests — protecting our business and customers from crime |
| Keep accounting and tax records | Because the law requires it | Legal obligation |
| Handle complaints, disputes and legal claims | To defend our position and comply with legal process | Legitimate interests, or legal obligation where a court or authority requires it |
| Analyse how the site is used and improve it | To build a better shop | Consent for analytics cookies; legitimate interests for aggregated, non-identifying analysis |
Where we rely on legitimate interests, we've weighed our interests against your rights and concluded ours don't override yours. You can ask us to explain that assessment, and you can object — see Section 12.
5. Marketing, and how to stop it
We'll only send you marketing emails or texts if you've opted in, or if you've bought from us before, we're telling you about similar products, and you were given the chance to opt out when we collected your details.
You can stop marketing at any time. Use the unsubscribe link in any email, reply STOP to any text, or email us at hey@oswinhyde.com. We'll action it promptly and at no cost to you.
If you opt out, we'll keep a minimal record of your details on a suppression list. This exists solely so we don't accidentally contact you again.
We'll still send you service messages — order confirmations, dispatch notices, delivery updates and returns information. These aren't marketing and you can't opt out of them while you have an active order.
6. Cookies
We use cookies and similar technologies to make the site work, remember your basket, understand how the site is used, and — where you've agreed — show you relevant advertising.
Only strictly necessary cookies are set automatically. Everything else requires your consent, which you give through our cookie banner.
7. Profiling and automated decisions
We use your browsing and purchase history to group customers into audiences and tailor the products and adverts you see. This is a form of profiling.
We do not make any decision about you by automated means alone that produces a legal or similarly significant effect. Our fraud checks may flag an order for review, but a person makes the final call before any order is cancelled.
8. Who we share it with
We share personal information only where there's a reason to. Specifically:
Service providers acting on our instructions — Shopify (hosting and store platform), payment providers, DPD and Evri (delivery), our email and SMS marketing platform, our review platform, our customer support tools, and our IT and cloud providers. They may only use your information to do the job we've asked of them.
Advertising and analytics partners — where you've consented via our cookie banner. These partners use your information in line with their own privacy notices.
Professional advisers — accountants, auditors, insurers and lawyers, where necessary.
Authorities and regulators — where we're legally required to disclose, or where it's necessary to establish, exercise or defend legal claims.
A buyer or successor — if the business is sold, merged or restructured, your information may transfer as part of that.
We do not sell your personal information.
9. Shopify
Our store runs on Shopify. Shopify processes your information to provide the platform to us, and also uses certain data as a controller in its own right — for example, to improve its services and support fraud prevention across merchants.
You can read the Shopify Consumer Privacy Policy and exercise rights relating to Shopify's own processing through the Shopify Privacy Portal.
10. Sending information outside the UK
Some of our providers are based outside the UK, including in the United States and the European Economic Area.
Where we transfer your information to a country that the UK Government hasn't judged to offer adequate protection, we put safeguards in place — normally the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum.
You can ask us for a copy of the safeguards we rely on. Contact details are in Section 15.
11. How long we keep it
| Information | Kept for |
|---|---|
| Order, payment and tax records | 6 years after the end of the financial year the order falls in (HMRC requirement) |
| Account details | While your account is open, then [2 YEARS — CONFIRM] after your last activity |
| Marketing consents and preferences | Until you opt out |
| Suppression list (opt-outs) | Indefinitely, so we can honour your opt-out |
| Customer service correspondence | [2 YEARS — CONFIRM] after the query is closed |
| Reviews you've published | Until you ask us to remove them |
| Cookie and analytics data | Per our Cookie Policy, typically [14 MONTHS — CONFIRM] |
| Records relating to a dispute or claim | Until the matter is resolved and any limitation period expires |
When a retention period ends we delete the information or anonymise it so it can no longer identify you.
12. Your rights
Under UK data protection law you have the right to:
-
Be informed about how we use your information — this policy.
-
Access a copy of the personal information we hold about you.
-
Correct information that's wrong or incomplete.
-
Erase your information, in certain circumstances.
-
Restrict how we use your information while a concern is resolved.
-
Data portability — receive certain information in a machine-readable format, or have it sent to another provider.
-
Object to processing based on legitimate interests.
-
Object to direct marketing at any time. This right is absolute — we will always stop.
-
Withdraw consent where we've relied on it. This doesn't affect anything we did before you withdrew.
To exercise any of these, email hey@oswinhyde.com or write to us at the address in Section 15.
We'll respond within one month. If your request is complex we may extend this by up to two further months, and we'll tell you if so. There's no charge unless a request is manifestly unfounded or excessive.
We may ask you to verify your identity first. You can authorise someone to act for you, but we'll need proof of that authority.
We will never treat you differently for exercising your rights.
13. Children
Our products and services are intended for adults. We don't knowingly collect information from children under 13.
If you believe a child has given us their personal information, contact us and we'll delete it.
14. Keeping your information secure
We use appropriate technical and organisational measures to protect your information, including encryption in transit, access controls, and contractual obligations on our suppliers.
No system is completely secure, and we can't guarantee absolute security. Please don't send sensitive information — such as full card details — to us by email or social media message. We will never ask you to.
Keep your account password confidential and don't share it with anyone.
15. Contact us, and how to complain
For any question about this policy, or to exercise your rights:
Email: hey@oswinhyde.com Phone: +44 333 050 9604 Post: Brand Sauce Limited (trading as Oswin Hyde), Unit 7, 55 Hastings Road, Leicester LE5 0BT, United Kingdom
If you're unhappy with how we've handled your information, please tell us first — we'd like the chance to put it right.
You also have the right to complain to the UK's data protection regulator:
Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 ico.org.uk
If you live in the EEA, you may complain to your local supervisory authority instead. A list is available on the European Data Protection Board website.
16. Changes to this policy
We may update this policy to reflect changes in how we work or in the law. The current version is always on this page, with the date it was last updated at the top. If we make a significant change, we'll tell you directly.