Privacy Policy

Short answer: technical information about the visit, and the details you give us when you order or write to us.

The technical side covers the device and browser you used, an approximate location derived from your IP address, and which pages you viewed. None of it identifies you by name, and it is used in aggregate to keep the site working and to see which pages are read.

The details you give us are the name, email address, delivery and billing addresses, a contact number where the carrier requires one, the items purchased and the result of the payment returned by the processor.

Correspondence is filed against the relevant order, so that a later question can be answered without you repeating the history. No special category information, such as health or biometric data, is ever requested.

Optional fields at checkout can be left blank without affecting the order, and required fields are marked as such rather than being discovered by rejection.

Short answer: to take payment, send the order, support you afterwards, and keep the site working.

Order details are used to take payment, dispatch the parcel, send delivery updates, handle returns and meet accounting obligations.

Technical information is used to run the site, to detect unusual activity that may indicate fraud, and to understand in aggregate which pages are useful.

Correspondence is used to answer the question and, where it concerns an order, to keep a record of what was agreed.

What does not happen matters just as much: your information is not used to build advertising profiles and is not sold. Each category is held against one of the purposes above rather than retained on the chance it becomes useful.

Where a use rests on your consent rather than on performing a contract, you can withdraw that consent at any time, and the withdrawal applies to future use rather than to anything already done.

We keep a written note of why each category of information is held, so that a specific answer can be given if you ask why a particular detail is needed.

Short answer: a few essential ones for the basket and checkout, and one analytics cookie. No advertising cookies.

The essential entries hold the contents of your basket and keep the checkout session alive. Without them the basket empties whenever you change page, which is why they cannot be switched off from inside the site.

The analytics cookie records page views in aggregate using a random identifier. It cannot be joined to your order record and is not used to identify you personally.

No third-party advertising or retargeting cookies are present. Campaign visits are counted in aggregate only, and no profile is built that follows you to other websites.

You can block cookies in your browser. The pages will still load, but the basket will not survive a change of page and the checkout cannot be completed without essential storage.

Where you return to the site, the analytics identifier may recognise your browser as a previous visitor, but that recognition is statistical rather than personal and does not affect prices or content.

Short answer: only the companies needed to complete your order, and only what each of them needs.

Those companies are the payment processor, the delivery carrier, the hosting provider and the service that sends confirmation emails. The carrier receives your delivery address and a contact number, not your payment details.

Before appointing any supplier that receives order data, we establish what it does with that data and how long it keeps it, and record the answer. A supplier that cannot meet the standard we expect is not appointed.

Suppliers are bound by contract to process information only on our instruction and to apply appropriate security measures, and any replacement inherits the same restriction.

We do not sell your information and we do not pass it to unrelated mailing lists. It is released to a public authority only where the law compels it, and you are told unless that disclosure is prohibited.

If a supplier is replaced, the newcomer gets order data for fulfilling and supporting orders and for nothing else.

Short answer: seven years for order records, two years for support emails, and no individual link for analytics.

Order records, including the delivery address and items purchased, are kept for seven years because tax and accounting rules require it. That period is set by law rather than by preference.

Support correspondence is kept for two years, which is long enough to resolve a repeated question without retaining every message permanently.

Analytics remain in aggregate form with no route back to an individual, and a basket that is never ordered is cleared automatically after a short period.

When a period ends the record is deleted rather than hidden, and it is not left in a secondary system that nobody revisits. If you close your account, we remove everything we are not legally obliged to keep.

Those periods are revisited periodically to confirm they remain correct and that nothing is retained beyond its purpose.

If you ask us to delete your account, we remove everything we are not legally required to keep.

Short answer: encryption in transit, card data kept out of our systems, and access restricted to a small team.

Traffic to the site is encrypted, so what you type cannot be read on the network. Card details are entered on the processor's hosted page and never reach our servers or our logs.

Access to order data is limited to the small team that packs and supports orders, each using an individual account rather than a shared credential. Access is removed on the day someone stops working with us.

We watch for patterns that look unusual, such as a run of failed payments from a single address, because that usually indicates card testing rather than a genuine attempt to buy.

No system is perfect and we will not pretend otherwise. If a breach ever affected your information, we would tell you directly, explain what happened and say what we are doing about it.

Access rights are reassessed whenever somebody joins or leaves the team that handles orders, and the review is recorded.

Short answer: you can ask for a copy, ask for corrections, ask for deletion, object to a use, or ask for your data in a portable format.

All of those rights are free to exercise, no reason needs to be given, and a request is not treated as a complaint or held against you.

Marketing email can be stopped at any time using the unsubscribe link at the foot of every message. Order and dispatch emails are not marketing and will still be sent, because they carry information you need about a purchase.

A request is answered within 30 days. If it is complex we tell you why it is taking longer rather than letting the deadline pass in silence.

If a request cannot be granted in full, we name the rule that prevents it and set out the options that remain, instead of issuing a flat refusal.

The people who answer order questions are the same people who handle data requests, so whoever replies can already see the order in question.

Short answer: the site is intended for adults, and we do not knowingly collect information from anyone under 13.

No competitions, newsletters or accounts aimed at children are operated, and no advertising is directed at them. The checkout does not ask anyone to state an age.

When something is bought for a child, the purchase is made by an adult and the contact details we hold belong to that adult, not to the child.

A parent or guardian may exercise any of the rights above on a child's behalf, and the request is handled in the same way, and within the same 30-day period, as any other.

Photographs sent in for a sizing or fit question are used only to answer that question. They are not published, used in advertising or passed to anyone else.

An age range on a product page is about using the item safely; it says nothing about who may buy it.

If you believe a child has sent us personal information, one short email is enough and it will be removed.

Short answer: email support@willaonline.shop with the word privacy in the subject line and say what you would like us to do.

No particular form of words is needed. A short email is enough, and anything further we require will be asked for in the reply.

We answer within one working day, and formal requests are answered within 30 days. Identity may be verified before information is released or deleted, so that it cannot be obtained by someone impersonating you.

If you are unhappy with the answer, you can ask for the matter to be reviewed, and you will be told who considered the original decision.

Should the way we handle personal information change in substance, the revised text appears on this page with the revision date shown at the top.

If a request cannot be met in full, we name the rule standing in the way and set out the remaining options, instead of a flat refusal.

You can also write simply to ask how a clause applies to your own circumstances, and we will answer in plain words.