Privacy policy
Last updated: 27 October 2026
This privacy policy explains how Cabin and Cook collects, uses and protects your personal data when you visit cabinandcook.com, buy from us, sign up to our emails or get in touch. We are committed to handling your data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
1. Who we are
Cabin and Cook is a trading name of Paton Retail Services Ltd, a company registered in England and Wales (company number 17159777), with its registered office at 22 Wessex Grange, Reading Road, Sherfield-on-Loddon, Hampshire, RG27 0ER. We are the "controller" of your personal data, which means we decide how and why it is used. We are registered with the Information Commissioner's Office (ICO).
If you have any questions about this policy or your data, email us at info@cabinandcook.com.
2. The data we collect
- Identity and contact details – your name, email address, phone number, and billing and delivery addresses.
- Order details – what you buy, order value, delivery instructions and order history.
- Payment information – payments are processed securely by our payment providers. We do not see or store your full card details.
- Communications – messages you send us by email, our contact form or live chat, and our replies.
- Reviews – your name (or the name you choose), rating, review text and any photos you submit.
- Marketing preferences – whether you have subscribed to our emails, and how you interact with them (for example opens and clicks).
- Technical and usage data – IP address, browser and device type, pages viewed and how you arrived at our site, collected through cookies and similar technologies. See our Cookie Policy.
We collect most of this directly from you. We also receive some data from our payment providers (for example confirmation of payment and fraud checks), delivery partners (delivery status) and analytics and advertising partners.
We do not knowingly collect data from children under 18, and our products are sold only to adults.
3. How we use your data and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Processing and delivering your order, taking payment, handling returns and refunds | Performance of a contract with you |
| Sending order confirmations, dispatch and delivery updates | Performance of a contract with you |
| Answering your enquiries and providing customer service | Legitimate interests (responding to customers) or performance of a contract |
| Keeping accounting and tax records | Legal obligation |
| Preventing fraud and keeping our website secure | Legitimate interests (protecting our business and customers) |
| Sending marketing emails to newsletter subscribers | Consent |
| Sending marketing emails about similar products to existing customers who did not opt out when buying | Legitimate interests (permitted under PECR's "soft opt-in") |
| Publishing product reviews you submit | Consent |
| Analytics and personalised advertising using cookies | Consent (given through our cookie banner) |
| Improving our website, products and services | Legitimate interests (running and growing our business) |
We need your name, contact and delivery details to fulfil an order. Without them we cannot process your purchase. We do not make decisions about you based solely on automated processing that have a legal or similarly significant effect on you.
4. Marketing
We will only send you marketing emails if you have subscribed, or if you are an existing customer and did not opt out when buying. Every email includes an unsubscribe link, and you can also ask us to stop by emailing info@cabinandcook.com. We use Klaviyo to send our emails. We never sell your data to third parties.
5. Who we share your data with
We share your data only where needed, with trusted service providers who act on our instructions and are required to protect it:
- Shopify – our e-commerce platform, which hosts our website and stores order data.
- Payment providers – Shopify Payments (powered by Stripe) and PayPal, to process payments and prevent fraud.
- Couriers and suppliers – delivery companies, and suppliers who dispatch some products direct to you, receive your name, delivery address and contact details.
- Klaviyo – our email marketing provider.
- Product reviews provider – to collect and display reviews.
- Live chat and customer service tools – to manage your enquiries.
- Accounting software provider – to keep our financial records.
- Google and Meta – for analytics and advertising (Google Analytics, Google Ads and the Meta Pixel), only if you accept these cookies.
- Professional advisers and authorities – accountants, lawyers, HMRC, the police or regulators where required by law or to protect our rights.
A full list of the service providers we use is available on request. If our business is sold or restructured, your data may be transferred to the new owner, who will be bound by this policy.
6. International transfers
Some of our service providers, including Shopify, Klaviyo, PayPal, Google and Meta, store or process data outside the UK, including in the United States, Canada and the European Economic Area. When this happens, we make sure your data is protected by an appropriate safeguard, such as UK adequacy regulations (including the UK–US Data Bridge for certified US companies), or the ICO's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.
7. How long we keep your data
- Orders, invoices and financial records – 6 years from the end of the financial year they relate to, as required for tax purposes.
- Marketing data – until you unsubscribe. After that we keep a minimal record so we don't email you again.
- Enquiries and customer service messages – 2 years from our last contact, unless linked to an order.
- Reviews – for as long as the review is displayed on our website, or until you ask us to remove it.
- Cookie data – see our Cookie Policy.
8. Keeping your data secure
We use appropriate technical and organisational measures to protect your data, including encrypted (HTTPS) connections, PCI-compliant payment processing and restricted access to customer information. If a data breach affects your rights, we will notify you and the ICO where required.
9. Your rights
Under UK data protection law you have the right to:
- Access – ask for a copy of the personal data we hold about you.
- Rectification – ask us to correct inaccurate or incomplete data.
- Erasure – ask us to delete your data, where there is no good reason for us to keep it.
- Restriction – ask us to limit how we use your data.
- Objection – object to processing based on legitimate interests, and to direct marketing at any time.
- Data portability – receive data you gave us in a commonly used format, or have it sent to another organisation.
- Withdraw consent – where we rely on your consent, you can withdraw it at any time. This won't affect processing that has already taken place.
To use any of these rights, email info@cabinandcook.com. We may ask you to confirm your identity. We will respond within one month, which may be extended by up to two further months for complex requests, in which case we will tell you why. There is normally no charge.
10. Complaints
If you are unhappy with how we have handled your data, please contact us first at info@cabinandcook.com. We will acknowledge your complaint within 30 days and aim to resolve it promptly. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
11. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated shown at the top. If we make significant changes, we will tell you by email or through a notice on our website.