PRIVACY POLICY
Last Updated 21/01/2026

A LEGAL DISCLAIMER

1. Introduction
Miraya Maison Limited ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website www.mirayamaison.com and make purchases from us ("Service"). Please read this Privacy Policy carefully. If you do not agree with our policies and practices, please do not use our Service.

2. Data Controller
For the purposes of UK GDPR and Data Protection Act 2018 (as amended), Miraya Maison Limited is the Data Controller.

Our details are:
Company Name: Miraya Maison Limited
Registered Address: 27 Fernwood Crescent, NG8 2GD.
Company Registration Number: 16679841
ICO Registration Number:  ICO REGISTRATION NUMBER
Email: mirayamaison@gmail.com
Telephone: 

We currently do not have a dedicated Data Protection Officer. Queries about data processing should be directed to the email address above.

3. What Personal Data We Collect
We collect personal data in the following categories:
3.1 Information You Provide Directly
When you place an order or interact with our Service, we collect:
• Name and billing/delivery address
• Email address
• Telephone number
• Payment card information (processed securely via third-party payment providers; we do not store full card details)
• Order history and preferences
• Communications (emails, messages, customer enquiries)

3.2 Information Collected Automatically
When you access our Service, we automatically collect certain technical information:
• IP address and device identifier
• Browser type and version
• Operating system
• Pages visited and time spent
• Referring website
• Cookies and similar tracking technologies (see Section 8)

3.3 Information from Third Parties
We may receive information about you from third parties, including:
• Payment processors
• Delivery and logistics partners
• Analytics providers

4. Legal Basis for Processing
Under UK GDPR Article 6, we process your personal data on the following legal bases:

4.1 Contract (Article 6(1)(b))
We process data necessary to perform the contract for the sale of goods: name, address, email, payment information, and order details. This is essential for fulfilling your order, processing payment, and managing delivery.

4.2 Legitimate Interests (Article 6(1)(f))
We process data for legitimate business interests, including:
• Customer service and dispute resolution
• Fraud prevention and security
• Analytics and service improvement
• Direct marketing (subject to your consent and unsubscribe rights)
• Legal compliance and records
We conduct a balancing test between our interests and your rights before processing. You have the right to object to this processing (see Section 9).

4.3 Consent (Article 6(1)(a))
We only process certain data (such as marketing email subscriptions) with your explicit consent. You can withdraw consent at any time.

4.4 Legal Obligation (Article 6(1)(c))
We process data to comply with legal obligations such as tax records, consumer protection laws, and court orders.

5. How We Use Your Personal Data
We use your personal data for the following purposes:
5.1 Order Processing & Delivery
• Processing your purchase and payment
• Arranging delivery of your goods
• Sending order confirmations and delivery updates

5.2 Customer Service
• Responding to customer enquiries
• Managing complaints and returns
• Providing customer support

5.3 Marketing & Communications
• Sending marketing emails (with your consent)
• Informing you of new products and promotions
• Personalizing your experience based on your interests

5.4 Legal & Business Operations
• Maintaining financial and tax records
• Fraud prevention and security
• Website analytics and service improvement
• Compliance with legal obligations

6. Data Retention
We retain personal data only as long as necessary for the purposes outlined above:
• Order and payment data: Retained for 6 years for accounting and tax purposes (as required by UK tax law)
• Customer service records: Retained for 3 years after final contact
• Email marketing lists: Retained for 2 years of inactivity, then deleted
• Website analytics: Retained for up to 38 months (platform default)
• Technical logs: Retained for 90 days
When data is no longer needed, we securely delete or anonymise it. If you request data deletion, we will comply within 30 days (subject to legal retention requirements).

7. Sharing Your Data with Third Parties
We do not sell or rent your personal data. However, we share data with the following categories of third parties:
7.1 Service Providers (Data Processors)
We engage third parties to help us deliver our Service. These include:
• Payment processors (Stripe, PayPal, or similar): Process payment data securely. Full card details are never stored by us.
• Delivery partners: Your address and contact details are shared only to arrange delivery.
• Email service providers: Your email is shared to send communications you have requested.
• Website hosting (Wix): Your data may be processed by Wix as per their Privacy Policy.
• Analytics tools: Cookie and tracking data may be shared for service improvement.
All processors are bound by Data Processing Agreements (DPA) requiring them to protect your data to the same standard as we do.

7.2 Legal Disclosure
We may disclose your data if required by law, court order, or other legal process. We will notify you of such requests unless legally prohibited.

7.3 Business Transfer
If we merge, are acquired, or enter into restructuring, your data may be transferred as part of that transaction. We will notify you of any such change.

7.4 International Transfers
Our website and some service providers may be hosted outside the UK. Where data is transferred outside the UK/EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses. You can request details of these safeguards.

8. Cookies & Tracking Technologies
Our website uses cookies and similar technologies to enhance your experience:
8.1 Essential Cookies
These are necessary for the website to function (e.g., shopping cart, login). No consent is required.

8.2 Analytics Cookies
We use analytics tools (e.g., Google Analytics) to understand how users interact with our site and improve performance. These require your consent before use.

8.3 Marketing Cookies
Third-party platforms may use cookies to serve targeted advertisements. These require your consent.

8.4 Cookie Management
You can manage cookies through your browser settings. Disabling certain cookies may affect website functionality. Our website displays a cookie consent banner on first visit. By continuing to use the site, you consent to our use of cookies as described.

9. Your Data Subject Rights
Under UK GDPR, you have the following rights:
9.1 Right of Access (Article 15)
You can request a copy of the personal data we hold about you. We will provide this within 30 days of your request, free of charge.

9.2 Right to Rectification (Article 16)
You can correct inaccurate or incomplete data held about you.

9.3 Right to Erasure (Article 17)
You can request deletion of your data in certain circumstances (e.g., if no longer needed, or if processing is unlawful). Note: We may retain data for legal or accounting obligations.

9.4 Right to Restrict Processing (Article 18)
You can ask us to limit how we use your data while you dispute accuracy or pursue a rights claim.

9.5 Right to Data Portability (Article 20)
You can request your data in a structured, commonly used, machine-readable format to transfer to another service provider.

9.6 Right to Object (Article 21)
You can object to direct marketing, profiling, or processing based on legitimate interests. We will stop processing for these purposes within 30 days.

9.7 Right Not to Be Subject to Automated Decision-Making (Article 22)
You have the right not to be subject to decisions made solely by automated processing that produce legal or similarly significant effects. We do not use fully automated decision-making.

9.8 How to Exercise Your Rights
To exercise any of these rights, contact us at:
Email: [INSERT PRIVACY CONTACT EMAIL]
Postal Address: [INSERT FULL UK ADDRESS]
We will respond within 30 days. If your request is complex, we may extend this to 90 days.

10. Data Security
We implement technical and organisational measures to protect your personal data from unauthorised access, alteration, disclosure, or destruction:
• SSL/TLS encryption for data in transit (HTTPS on all pages)
• Secure password storage and authentication protocols
• Regular security assessments and updates
• Access controls limiting employee access to data
• Secure disposal of physical records
While we strive to protect your data, no system is completely secure. We cannot guarantee absolute security.

11. Children's Privacy
Our Service is not directed at children under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it immediately. If you believe we have collected a child's data, please contact us urgently.

12. Third-Party Links
Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies before providing any personal data.

13. Data Protection Impact Assessments (DPIA)
We assess the impact of our data processing activities on privacy. High-risk processing activities are documented in DPIAs. We review these regularly and will conduct DPIAs for any new processing activities that may pose risks to data subjects.

14. Complaints & Contact
If you have concerns about how we handle your data, please contact us first:
Email: mirayamaison@gmail.com
Telephone: [INSERT CONTACT NUMBER]
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk

15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or other factors. We will notify you of any significant changes by email or by posting the updated policy on our website with an updated "Last Updated" date. Your continued use of the Service following any changes constitutes your acceptance of the updated Privacy Policy.

16. Definitions
Personal Data: Any information relating to an identified or identifiable individual.
Processing: Any operation performed on personal data (collection, use, storage, disclosure).
Data Controller: The entity that determines the purposes and means of data processing (Miraya Maison Limited).

Data Processor: An entity that processes data on behalf of the controller (e.g., payment processors).

This Privacy Policy is effective as of the date shown above. It has been prepared in compliance with UK GDPR and the Data Protection Act 2018 (as amended).