Privacy

Who is responsible for your data

Westor is the business you are buying from. Westor is the data controller. Business address available on request at hello@westor.co.uk. For anything in this policy, email hello@westor.co.uk.

What we collect, and why

When you order. Your name, contact details, delivery address and order details, so we can make and send what you bought. Checkout runs on Shopify, on Shopify’s own domain — your card details go to Shopify’s payment processing and never touch our servers. The lawful basis is the contract between us.

If you create an account. Your name, email address, password (held by Shopify, never by us), saved addresses and order history, so you can track orders and check out faster. Signing in sets one cookie that keeps you signed in — see the cookies page. The lawful basis is the contract between us; you can ask us to close the account at any time.

Custom parts: drawings and enquiries. When you order or ask about a custom part, we receive the drawing you upload, the specification you choose and your contact details, so we can price, make and deliver it. The lawful basis is the contract, or the steps you asked us to take before entering one. Drawings are stored in Shopify Files, linked only from your order, and deleted 12 months after the job is completed — sooner if you ask us.

If you sign up to our emails. Your email address, held by Shopify as a customer record marked as subscribed, so we can send you news and offers. The lawful basis is your consent; every email has an unsubscribe link, or email us.

When you email us. Whatever you choose to tell us, kept so we can deal with your enquiry.

If you opt in to analytics. With your consent — and only with it — we use PostHog, hosted in the EU, to understand how the site is used: pages viewed, clicks and form interactions, performance timings, device and browser information, and session replays in which everything you type is masked. Nothing analytics-related loads before you opt in, and declining is a one-click choice. The lawful basis is consent. The detail is on our cookies page.

We do not use advertising or marketing cookies, and we do not sell your data to anyone.

Who handles it for us

We use a small number of service providers, each acting on our instructions and only for the purpose described:

• Shopify — Orders, checkout and payment, customer accounts, newsletter sign-ups, and the drawings and enquiries sent through our custom parts page. (Canada and the United States)
• Vercel — Hosts this website. Like any web host it receives your IP address and the pages you request. (United States)
• PostHog (EU cloud) — Site analytics and session replay — only if you opt in. (European Union)
• Supabase, via manufacturing.fimey.com — Serves the photographs on this site, so it receives your IP address when your browser loads them. (United States)
• Our delivery courier — Your name, delivery address and contact details, to deliver your order. (United Kingdom)

International transfers

Some of these providers store or process data outside the UK. Where they do, the transfer is protected by a UK adequacy decision (the European Union, and Canada for commercial organisations), by the UK Extension to the EU–US Data Privacy Framework for certified US companies, or by the UK International Data Transfer Agreement or Addendum to the EU standard contractual clauses. Email us for more detail on any of them.

How long we keep it

Order records are kept for six years, because tax law requires it — the lawful basis for that is legal obligation. Custom-parts drawings are deleted 12 months after the job is completed. Everything else is kept only as long as we need it for the purpose we collected it.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Have your data erased
• Restrict or object to how we use it
• Receive your data in a portable format
• Withdraw consent at any time, where consent is what we rely on

To exercise any of these, email hello@westor.co.uk. If you are not happy with how we handle your data, you also have the right to complain to the Information Commissioner’s Office at ico.org.uk.