Privacy policy

NEEDLE & HUE — Privacy Policy
Last updated: 23 September 2026

This Privacy Policy explains how Paula Szumacher trading as NEEDLE & HUE ("NEEDLE & HUE", "we", "us" or "our") collects, uses, stores and shares personal information when you visit needleandhue.co.uk, place an order, create an account, contact us, subscribe to marketing, make a return or claim, or otherwise interact with our online store and services.
Data controller: Paula Szumacher trading as NEEDLE & HUE.
Business address: 10 Acorn House, Paper Mill Lane, IP8 4DW, United Kingdom.
Email: needleandhue@gmail.com.
Website: needleandhue.co.uk.
Our online store is powered by Shopify. Shopify and other service providers may process personal information to enable the store, payments, security, analytics, fulfilment and other functions described below.
This Policy should be read together with our Terms & Conditions, Returns & Refunds Policy, Shipping & Delivery Policy and any cookie or consent information displayed on our website.

1. Who this Policy applies to
This Policy applies to customers, prospective customers, website visitors, account holders, people who contact us, recipients of deliveries and other individuals whose personal information we process in connection with NEEDLE & HUE.
If you provide us with personal information about another person, for example a delivery recipient, you should ensure that you are entitled to provide that information to us.

2. Personal information we may collect
Depending on how you interact with us, we may collect or process the following categories of personal information:
• Identity and contact information, such as your name, billing address, delivery address, email address, telephone number and account contact details.
• Order and transaction information, such as products ordered, quantities, prices, discounts, order dates, returns, refunds, exchanges, cancellations and transaction history.
• Payment-related information, such as payment method, payment status, transaction identifiers, billing information and limited payment information made available to us by Shopify or payment providers. Full card details may be handled directly by payment processors and may not be visible to NEEDLE & HUE.
• Account information, such as login or account identifiers, preferences and account settings.
• Communications, such as emails, messages, support requests, complaints, return requests and other correspondence with us.
• Device and technical information, such as IP address, browser type, device identifiers, network information and security logs.
• Website and usage information, such as pages viewed, actions taken on the store, cart activity, referral information and cookie or similar-technology data where applicable.
• Delivery and fulfilment information, such as carrier, tracking number, delivery status, attempted-delivery information, proof of delivery, delivery photographs, signatures, safe-place information and location or GPS information where generated and supplied by the carrier.
• Fulfilment and traceability records linked to an order, which may include parcel weight, SKU, quantity, dispatch records, return records, product LOT or batch number, serial number and expiry information where relevant.
• Fraud, security and dispute information, such as transaction risk indicators, address inconsistencies, suspected unauthorised activity, chargeback information, payment disputes and evidence relevant to preventing or resolving fraud or disputes.
• Marketing and consent information, such as newsletter subscriptions, marketing preferences, opt-outs and records of consent or cookie choices.

3. Personal information we do not need
Please do not send us special category or highly sensitive personal information unless it is genuinely necessary for a specific legal, safety or dispute-related matter and we have asked for it or there is another lawful reason to provide it.
We do not require medical information in order to sell ordinary goods through the NEEDLE & HUE online store.

4. Where we obtain personal information
We may obtain personal information:
• directly from you when you browse the store, place an order, create an account, contact us, make a return or claim, subscribe to marketing or otherwise provide information to us;
• from Shopify and technology providers that support our online store;
• from payment processors, banks and payment service providers in connection with transactions, payment status, fraud prevention and disputes;
• from delivery carriers and fulfilment providers in connection with dispatch, tracking, delivery, failed delivery, return-to-sender and delivery disputes;
• from fraud-prevention, security, insurance or dispute-resolution providers where relevant;
• from professional advisers, regulators, courts, law-enforcement bodies or other organisations where permitted or required by law; and
• automatically through cookies, pixels, logs and similar technologies, subject to applicable consent requirements.

5. Why we use personal information and our lawful bases
We only process personal information where we have a valid lawful basis under applicable UK data protection law. Depending on the purpose, we may rely on one or more of the following bases:
• Contract — where processing is necessary to take steps at your request before entering into a contract or to perform our contract with you, including processing orders, taking payment, arranging delivery, providing customer service and handling returns or refunds.
• Legal obligation — where processing is necessary to comply with obligations relating to tax, accounting, product safety, regulatory requirements, court orders or other applicable law.
• Legitimate interests — where processing is necessary for our legitimate business interests or those of a third party and those interests are not overridden by your rights and freedoms. Our relevant interests may include operating and improving the store, preventing misuse, maintaining security, managing stock and traceability, protecting our legal rights, resolving disputes, defending or bringing legal claims and preventing financial loss.
• Recognised legitimate interests — where applicable law permits this basis for a specified public-interest purpose, including processing that is necessary to prevent, detect or investigate crime.
• Consent — where you have given valid consent, for example for certain marketing or non-essential cookies or similar technologies where consent is required. You may withdraw consent at any time without affecting processing that was lawful before withdrawal.

6. Orders, payments and customer service
We use personal information to receive and administer orders, confirm payment status, provide order updates, arrange delivery, manage customer accounts, respond to enquiries, process returns and refunds and otherwise perform or administer our contract with you.
Payment providers may process payment-card and financial information under their own terms and privacy notices. We receive the information reasonably necessary to confirm and administer the transaction.

7. Fraud prevention, security and order verification
We may use personal information to protect customers, NEEDLE & HUE, payment providers and other parties against fraud, unauthorised transactions, identity or address misuse, cyber-security threats and other unlawful activity.
This may include reviewing payment status, billing and delivery information, transaction risk indicators, IP or device information, unusual purchasing patterns and other relevant order information.
Where an order is flagged as unusual or higher risk, we may carry out a manual review, request reasonable verification or cancel an order where permitted by our Terms & Conditions and applicable law.
Where processing is genuinely necessary to prevent, detect or investigate crime, we may rely on the recognised legitimate interests lawful basis where the statutory conditions are met. For wider security, fraud-risk management and defence of legal rights, we may rely on legitimate interests or another applicable lawful basis.

8. Delivery, tracking and fulfilment evidence
We use delivery information to fulfil orders and investigate delivery issues. Carriers may generate or provide tracking events, delivery photographs, signatures, safe-place details, collection information or location data where their service supports those features.
Where a delivery claim arises, we may compare the information supplied by the customer with tracking records, dispatch records, parcel weight, packing records and other appropriate fulfilment evidence.
We only use such information where reasonably necessary for fulfilment, customer service, fraud prevention, dispute resolution, legal claims or another lawful purpose.

9. Product traceability, safety and recalls
For products where traceability is relevant, we may link order information with SKU, LOT or batch numbers, serial numbers, expiry information, supplier records or other product identifiers.
We may use these records for stock control, complaint investigation, product-safety monitoring, warranty administration, regulatory compliance, recalls, corrective action and the establishment, exercise or defence of legal claims.
Where a safety issue or recall affects a product you purchased, we may use your order and contact information to provide important safety or recall information even if you have opted out of marketing. Safety and transactional communications are not marketing communications.

10. Returns, complaints, chargebacks and legal disputes
If you make a return, complaint, non-delivery claim, warranty claim, payment dispute or chargeback, we may process the information reasonably necessary to investigate and respond to it.
This may include order information, correspondence, photographs supplied by you, tracking data, proof of delivery, payment records, parcel weight, packing records, LOT or batch information, serial numbers and return-inspection records.
Where lawful and necessary, relevant information may be shared with payment providers, banks, carriers, insurers, professional advisers, dispute-resolution bodies, courts, regulators or law-enforcement authorities.

11. Marketing communications
We may send marketing communications where permitted by applicable data protection law and the Privacy and Electronic Communications Regulations (PECR).
For individual subscribers, we will use consent where required. Where the legal requirements of the products-and-services soft opt-in are met, we may send marketing about our own similar products or services without separate marketing consent, provided an appropriate opportunity to opt out was given when the details were collected and in each subsequent message.
You can unsubscribe from marketing at any time using the unsubscribe method provided in the message or by contacting us. Transactional, legal, product-safety and order-related communications may still be sent where necessary.

12. Cookies and similar technologies
Our website and Shopify may use cookies, pixels, local storage and similar technologies for functions such as shopping-cart operation, checkout, security, preferences, analytics and advertising.
Strictly necessary technologies may be used where they are required to provide a service requested by the user or to operate essential store functions.
Where consent is required for non-essential storage or access technologies, such technologies should not be used until the required consent has been obtained. You can manage available choices through the cookie or privacy controls displayed on the website where provided.
More detailed information may be provided in a separate Cookie Policy or consent interface.

13. How we share personal information
We may share personal information with the following categories of recipients where necessary and lawful:
• Shopify and providers that host, secure and operate our online store;
• payment processors, banks, card networks and payment-service providers;
• delivery carriers, fulfilment services and logistics providers;
• IT, cloud, email, customer-support, analytics, security and fraud-prevention providers;
• accountants, tax advisers, legal advisers, insurers and other professional advisers;
• suppliers, manufacturers or distributors where information is reasonably required for warranty, traceability, product-safety or recall purposes;
• payment providers, banks, carriers, insurers and dispute-resolution services where necessary to investigate a claim or chargeback;
• regulators, courts, law-enforcement authorities, public bodies or other parties where disclosure is required or permitted by law; and
• a purchaser, successor or new operating entity if all or part of the NEEDLE & HUE business is reorganised, incorporated, transferred or sold, subject to appropriate data-protection requirements.

14. Shopify
The NEEDLE & HUE store is powered by Shopify. Information submitted through the store is processed through Shopify systems to provide ecommerce, checkout, security and related services.
Depending on the particular Shopify feature, Shopify may process information on our behalf and may also process certain information for its own purposes under its own privacy documentation.
Customers can review Shopify’s consumer privacy information through Shopify’s published privacy resources. Where Shopify provides privacy controls or portals directly to customers, those controls relate to processing for which Shopify is responsible.

15. International transfers of personal information
Although NEEDLE & HUE currently ships goods only within the United Kingdom, personal information may be processed or made accessible outside the UK by Shopify or other service providers.
Where NEEDLE & HUE is responsible for a restricted transfer of personal information outside the UK, we will use a transfer mechanism permitted by UK data protection law, such as UK adequacy regulations, an appropriate safeguard such as the UK International Data Transfer Agreement or UK Addendum where applicable, or another lawful exception where available.
Where an appropriate safeguard is used, any additional assessment required by applicable UK law will be carried out as necessary. You may contact us for further information about relevant safeguards that apply to transfers for which we are responsible.

16. Data retention
We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, including to perform contracts, meet tax and accounting requirements, maintain product traceability, deal with returns and warranties, prevent fraud, resolve disputes, respond to regulatory or product-safety matters and establish, exercise or defend legal claims.
The retention period depends on the type of information and why we hold it. In deciding how long to retain information, we consider applicable statutory retention requirements, limitation periods, chargeback or dispute periods, product-safety and traceability needs, warranty periods, the sensitivity of the information and whether continued retention is necessary and proportionate.
Marketing information is retained while it remains relevant to our marketing relationship and applicable legal requirements. If you opt out, we may retain limited suppression information so that we can respect your opt-out.
Deletion of an online account does not necessarily require deletion of order, tax, fraud-prevention, safety or dispute records that we are legally required or otherwise lawfully entitled to retain.

17. Security
We use reasonable technical and organisational measures appropriate to the nature of the information and the risks involved. We also rely on Shopify and other service providers to maintain appropriate security for the systems they operate.
No method of transmission or storage is completely secure. Customers should protect account credentials and should not send unnecessary sensitive information through ordinary email or other insecure channels.

18. Automated tools and fraud-risk indicators
Shopify, payment providers and security services may use automated systems to assess transactions, detect unusual activity or generate fraud-risk indicators.
NEEDLE & HUE may use those indicators as part of order verification. Where reasonably practicable, an order that requires further verification may be reviewed before a final merchant decision is made.
Payment providers may make their own payment-authorisation or fraud decisions under their own terms and privacy notices.

19. Your data protection rights
Depending on the circumstances and lawful basis, you may have rights to:
• request access to personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to erase personal information in circumstances where the right to erasure applies;
• ask us to restrict processing in certain circumstances;
• receive certain information in a portable format or ask for it to be transferred where the right to data portability applies;
• object to certain processing, including processing based on legitimate interests in circumstances where the law gives you that right;
• withdraw consent at any time where processing is based on consent; and
• raise a complaint about our handling of your personal information.
These rights are not absolute and may be subject to exemptions or limitations. We may need to verify your identity before acting on a request.

20. Your right to object to direct marketing
YOU HAVE THE RIGHT TO OBJECT TO THE USE OF YOUR PERSONAL INFORMATION FOR DIRECT MARKETING AT ANY TIME.
You can use the unsubscribe option in a marketing message or contact us at needleandhue@gmail.com. We will stop using your personal information for direct marketing as required by law, although we may retain limited suppression information to ensure that your preference is respected.

21. Data protection complaints
If you have a concern or complaint about how NEEDLE & HUE uses your personal information, please contact us at needleandhue@gmail.com and identify the message as a data protection or privacy complaint.
We will take reasonable steps to facilitate complaints, acknowledge a data protection complaint within the period required by applicable law and respond without undue delay after making appropriate enquiries.
If you remain dissatisfied, you may complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection. Information about making a complaint is available at ico.org.uk.

22. Requests from authorities and prevention of crime
We may disclose personal information where required by law or where a lawful request is made by a regulator, court, law-enforcement authority or other competent public body.
Where applicable statutory conditions are satisfied, processing necessary to prevent, detect or investigate crime may rely on the recognised legitimate interests lawful basis. We will not treat every customer dispute or unsuccessful claim as evidence of criminal activity.

23. Business restructuring or future incorporation
NEEDLE & HUE is currently operated by Paula Szumacher as a sole trader. If the business is later transferred to or operated by a limited company or another legal entity, personal information may be transferred to the successor operator where lawful and necessary for continuity of the business.
If the identity of the data controller changes, this Privacy Policy and relevant customer information will be updated as required.

24. Children
The NEEDLE & HUE store is not specifically directed at children. We do not knowingly seek to collect personal information from children for purposes unrelated to legitimate ecommerce activity.
If we become aware that personal information has been provided by a child in circumstances where we should not retain it, we will take appropriate steps in accordance with applicable law.

25. Third-party websites and services
Our website may contain links to third-party websites or services. Their privacy practices are governed by their own privacy notices and are not controlled by NEEDLE & HUE.
We encourage customers to review the privacy information of third parties before providing personal information to them.

26. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in our business, technology, service providers, legal obligations or regulatory guidance.
The current version will be published on our website with an updated date. Where a change is material and applicable law requires additional notice, we will provide that notice in an appropriate way.
A later version of this Policy does not retrospectively change the lawful basis or purpose for which information was processed at an earlier time.

27. Contact
For privacy questions, data protection requests or complaints, contact:
Paula Szumacher trading as NEEDLE & HUE
Email: needleandhue@gmail.com
Business address: 10 Acorn House, Paper Mill Lane, IP8 4DW, United Kingdom
Website: needleandhue.co.uk
For the purposes of UK data protection law, Paula Szumacher trading as NEEDLE & HUE is the data controller for the merchant-side processing described in this Policy.