Ren / Shop
The Shop

Privacy Policy

Last updated: 13 April 2026

1. Who we are

Ren Shop is run by a private individual based in the United Kingdom. If you have any questions about this policy or how your data is handled, please contact us at -.

Our processing of personal data falls within the personal/household affairs exemption under UK data protection law and we are not currently required to register with the Information Commissioner's Office (ICO).

2. What data we collect

When you place an order, we collect:

  • - Your name
  • - Your email address
  • - Your shipping address

Providing this information is necessary to fulfil your order. Without it, we cannot process or deliver your purchase.

3. Lawful basis for processing

We process your personal data on the basis of Article 6(1)(b) UK GDPR — performance of a contract. Your data is used solely to fulfil the order you have placed with us.

4. How we process payments

All payments are handled by Stripe. We never see or store your card or bank details — these go directly to Stripe and are governed by Stripe's Privacy Policy. Stripe acts as a data processor under a Data Processing Agreement.

5. Third parties and data processors

We share your data only with the following parties, to the minimum extent necessary:

  • Stripe — payment processing. A Data Processing Agreement is in place. Data may be processed outside the UK under Standard Contractual Clauses.
  • Vercel — website hosting and infrastructure. A Data Processing Agreement is in place. Data may be processed outside the UK under Standard Contractual Clauses and the UK Addendum.
  • Telegram— we receive order notifications via Telegram Bot API, which means your name and order summary transit Telegram's servers. Telegram does not offer a formal Data Processing Agreement. Data transmitted is limited to what is necessary to fulfil your order.

We do not share your data with analytics platforms, advertising networks, or data brokers.

6. International transfers

Stripe and Vercel may process your data on servers outside the UK. Both have Standard Contractual Clauses and a UK Addendum in place to ensure your data remains protected. Telegram's servers are located in the Netherlands (EEA); however, Telegram does not provide a Data Processing Agreement.

7. Data retention

We retain order records for at least 5 years from the end of the relevant tax year, in line with HMRC record-keeping requirements. After this period, your data will be deleted unless there is another legal reason to retain it.

8. Data security

Your personal details are stored securely and access is restricted to the shop owner only. We take appropriate measures to protect your data against unauthorised access, loss, or disclosure. Personal data is deleted once the sale is complete and any necessary record-keeping period has passed.

9. Your rights under UK GDPR

You have the following rights regarding your personal data. To exercise any of them, contact us at -.

  • Right of access (Article 15) — request a copl of the data we hold about you.
  • Right to rectification (Article 16) — ask us to correct inaccurate data.
  • Right to erasure (Article 17) — ask us to delete your data. Requests made during the mandatory 5-year retention period may be declined to the extent required by law; we will comply to the fullest extent permitted.
  • Right to restriction of processing (Article 18) — ask us to limit how we use your data.
  • Right to data portability (Article 20) — request your data in a structured, machine-readable format.
  • Right to object (Article 21) — object to our processing of your data.

10. Right to complain

If you believe your personal data has been handled unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11. Cookies

We do not use tracking or analytics cookies. Session cookies are used solely for functionality (such as admin authentication). These are strictly necessary for the site to operate and do not require your consent under PECR.

12. Changes to this policy

We may update this policy from time to time. The date at the top of this page reflects the version currently in effect.