Last updated: March 2026

This privacy policy explains how Merchant & Mills collects, uses, and protects your personal data in accordance with UK GDPR and the Data Protection Act 2018. Please read it carefully. We recommend having this reviewed by a solicitor or data protection specialist before publication.

1. Who We Are

Merchant & Mills is a fabric, sewing pattern, and haberdashery retailer based in Rye, East Sussex, UK. We operate online at merchantandmills.com and through our physical shop.

For the purposes of data protection law, Merchant & Mills is the Data Controller responsible for your personal data.

If you have any questions about this policy or how we handle your data, you can contact us at:

• sales@merchantandmills.com
• Unit 7-9 Rye Industrial Park, Harbour Road, Rye, East Sussex. TN31 7TE

2. What Data We Collect

Depending on how you interact with us, we may collect the following types of personal data:

When you place an order:

• Name, billing and delivery address
• Email address and telephone number
• Payment information (processed securely via our payment provider — we do not store card details)
• Order history and purchase preferences

When you create an account:

• Name, email address, and password (encrypted)
• Saved addresses and order history

When you sign up to our newsletter:

• Name and email address

When you book a class or retreat:

• Name, email address, and telephone number
• Dietary requirements or access needs (where provided)
• Emergency contact information (for residential retreats)

When you apply for a wholesale account:

• Business name, contact name, address, and email
• VAT number (where applicable)

When you visit our website:

• IP address and browser type
• Pages visited and time spent on site
• Cookie data (see Section 8)

3. How We Use Your Data

We use your personal data for the following purposes:

Purpose — Legal Basis

• Processing and fulfilling your orders — Contract
  
• Sending order confirmations and shipping updates — Contract
  
• Managing your online account — Contract
  
• Sending marketing emails (newsletter) — Consent
  
• Booking and administering classes and retreats — Contract
  
• Processing wholesale applications and orders — Contract
  
• Improving our website and customer experience — Legitimate interest
  
• Complying with legal and financial obligations — Legal obligation
  
• Fraud prevention and security — Legitimate interest

We will never use your data in a way that is inconsistent with the purpose for which it was collected.

4. Marketing Communications

We only send marketing emails to customers who have explicitly opted in to receive them. You can unsubscribe at any time by clicking the unsubscribe link in any email, or by contacting us directly.

If you have placed an order with us, we may occasionally contact you about similar products or services under the soft opt-in provisions of UK law — but you can opt out of this at any time.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

5. Who We Share Your Data With

We only share your data with trusted third parties where necessary to deliver our services. These include:

• Shipping partners (DHL, DPD) — to deliver your orders
• Payment processors — to handle transactions securely
• Email marketing platforms — to send newsletters and order communications
• Website hosting and analytics providers — to operate and improve our website
• Booking platforms — to manage class and retreat registrations
• Accountancy and legal advisors — where required by law

All third parties we work with are required to handle your data securely and in accordance with UK GDPR. We do not transfer your data outside the UK or EEA without appropriate safeguards in place.

6. How Long We Keep Your Data

We only keep your personal data for as long as necessary:

• Order and transaction records — 7 years (required for tax and legal purposes)
• Active customer accounts — for as long as the account remains active
• Newsletter subscribers — until you unsubscribe
• Class and retreat bookings — up to 2 years after the event
• Wholesale accounts — for the duration of the business relationship plus 7 years

When data is no longer needed, it is securely deleted or anonymised.

7. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access — you can request a copy of the data we hold about you
• Right to rectification — you can ask us to correct inaccurate data
• Right to erasure — you can ask us to delete your data in certain circumstances
• Right to restrict processing — you can ask us to limit how we use your data
• Right to data portability — you can request your data in a portable format
• Right to object — you can object to processing based on legitimate interest, including direct marketing
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time

To exercise any of these rights, please contact us at [contact email]. We will respond within one month.

If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

8. Cookies

Our website uses cookies to improve your experience and help us understand how visitors use the site. Cookies are small text files placed on your device.

We use the following types of cookies:

• Essential cookies — necessary for the website to function (e.g. shopping cart, login)
• Analytics cookies — help us understand how visitors use our site (e.g. Google Analytics)
• Preference cookies — remember your settings and choices

You can manage or disable cookies through your browser settings at any time. Please note that disabling essential cookies may affect how the website functions.

9. Security

We take the security of your personal data seriously. We use appropriate technical and organisational measures to protect your information against unauthorised access, loss, or disclosure. Payment data is processed through secure, encrypted payment providers and we do not store card details on our systems. 

10. Children's Privacy

Our website and services are not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.

11. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies independently.

12. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The most current version will always be available on our website, and significant changes will be communicated to customers directly where appropriate.

13. Contact Us

For any questions or concerns about this privacy policy or how we use your data, please contact:

Merchant & Mills

• sales@merchantandmills.com
• Unit 7-9 Rye Industrial Park, Harbour Road, Rye, East Sussex. TN31 7TE
• +44 (0) 1797227789

This document is a template for guidance only and does not constitute legal advice. Merchant & Mills should seek independent legal advice to ensure full compliance with UK GDPR, the Data Protection Act 2018, and any other applicable legislation before publishing this policy.