Privacy Policy

Last updated: 26/10/2026

This policy explains how I collect, use and protect your personal information when you visit joethomas.eu, buy from me online, or buy from me in person at markets. I take your privacy seriously and I only collect what I need.

Who I am

I am Joe Thomas, trading as Joe Thomas, based in Wiltshire, UK. I am the data controller for the information described here. You can contact me through the contact form.

What information I collect

  • Order details: your name, email address, phone number (if you give one), and delivery and billing addresses.
  • Payment details: card payments are processed securely by Square. I never see or store your full card number.
  • Account details: if you create an account, your name, email address, password (stored securely) and order history.
  • Messages: anything you send me through the contact form or by email, such as questions or commission enquiries.
  • Technical information: basic information such as your IP address and browser type, collected by my website and hosting systems to keep the site working and secure.

If you buy from me in person at a market, Square processes your payment. If you ask for an emailed receipt, I will receive your email address.

How I use your information, and why

  • To take and deliver your order, and handle returns or questions. This is necessary to carry out our contract.
  • To keep records and meet tax and legal obligations. This is a legal requirement.
  • To keep the website secure and working well, and to prevent fraud. This is in my legitimate interests.
  • To reply to your enquiries. This is in my legitimate interests, or necessary before entering a contract.

Who I share it with

I only share your information with the people and services I need to run the shop, and only as much as they need:

  • Square: payment processing, and my point-of-sale and stock records.
  • Delivery companies such as Royal Mail: your name, address and, where needed, phone number.
  • 123 Reg: hosts this website.
  • Cloudflare: provides domain name and security services for this website.

I do not sell your information to anyone.

Transfers outside the UK

Some of these providers may process information outside the UK. Where they do, they use legal safeguards approved under UK data protection law to protect it.

How long I keep it

I keep order and payment records for six years, as needed for tax and accounting. Enquiries are kept for as long as needed to deal with them, then deleted. If you have an account, I keep it until you ask me to close it.

Cookies

This website uses only essential cookies, such as those that remember what is in your basket and keep you logged in during checkout.

Your rights

Under UK data protection law you have the right to ask me to:

  • tell you what information I hold about you and give you a copy;
  • correct anything that is wrong;
  • delete your information, where I don’t need to keep it;
  • restrict or object to how I use it;
  • move your information to another provider, where it applies.

To use any of these rights, get in touch through the contact form. I will reply within one month.

Complaints

If you are unhappy with how I have handled your information, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

Changes to this policy

I may update this policy from time to time. The date at the top shows when it was last changed.