Privacy policy.

Last updated: 2026-04-29.

ENDRRA is a small brand based in England. The information you share with us when you place an order, sign up to hear from us, or write in with a question is treated with the same care we put into the silk itself.

This policy explains what we collect, why we collect it, the legal basis we rely on, and the choices you have. It is written to comply with the UK GDPR and the Data Protection Act 2018. If something here isn’t clear, please write to us at [email protected] and we will answer plainly.

Who we are.

ENDRRA is operated by [TODO: legal entity name], registered in England and Wales (company number [TODO: company registration number]) at [TODO: registered address]. For the purposes of UK data protection law, we are the data controller of any personal data you share with us.

What we collect.

When you place an order or contact us, we collect the things needed to make the order happen — your name, shipping address, email address, phone number if you give it, and order details. Payment information (card number, billing address) is collected and processed by our payment providers through Shopify. We never see or store the full card number ourselves.

If you sign up to our waitlist or newsletter, we collect your email address and the date you signed up. If you write to us, we keep the message and our reply so we can pick up where we left off if you write again.

We also collect a small amount of technical information automatically when you visit the site — pages viewed, approximate location from IP address, device and browser type, and similar analytics. This is standard for any modern shop and helps us understand how the site is used.

Why we collect it, and on what legal basis.

We rely on the following lawful bases under UK GDPR:

• Performance of a contract — to process your order, take payment, and arrange delivery. Without this data we cannot fulfil what you have asked for.
• Legitimate interests — to keep the shop running, prevent fraud, improve the site through analytics, and reply to your messages. We have weighed these interests against your rights and believe they are proportionate.
• Consent — for marketing emails and any non-essential cookies. You can withdraw consent at any time, and any email we send you carries a one-click unsubscribe.
• Legal obligation — to keep order and tax records for the period required by HMRC, typically six years.

Who we share it with.

We do not sell your data. We share it only with the partners who help us run the shop:

• Shopify — hosts the store and processes orders. Their privacy policy: shopify.com/legal/privacy.
• Payment processors through Shopify (Shopify Payments, PayPal, Apple Pay, or similar) — handle the card transaction.
• Shipping carriers — receive your name, address, and order details so they can deliver the parcel.
• Email and SMS services — send order updates and, if you’ve opted in, our newsletter.
• Analytics — anonymous or pseudonymous data only, used to understand site traffic.

Each of these handles your data on our behalf and is bound by their own privacy terms. Where data leaves the UK — for example to a US-based service — we rely on the UK’s adequacy decisions or standard contractual clauses to keep it protected.

Your rights under UK GDPR.

You have the right to:

• Access the personal data we hold about you.
• Rectification — correct anything that is wrong or incomplete.
• Erasure — ask us to delete your data, where we no longer need it for the purpose it was collected.
• Restriction — pause our processing while a question is sorted out.
• Portability — receive your data in a machine-readable form, or have it sent to another controller.
• Objection — object to processing based on legitimate interests, including any direct marketing.
• Withdraw consent at any time, where consent is the basis we are relying on.
• Not be subject to automated decision-making that has a legal or similarly significant effect. We do not make decisions about you this way.

To exercise any of these rights, write to [email protected] and we will respond within one month.

If you believe we have mishandled your data, you have the right to complain to the Information Commissioner’s Office (ICO) — the UK supervisory authority. You can reach them at ico.org.uk or 0303 123 1113. We would always rather you wrote to us first so we can put it right.

How long we keep it.

Order and tax records are kept for six years, as HMRC requires. Marketing data is kept only until you ask us to remove it, or until we judge it to be no longer relevant. Support correspondence is kept for as long as it takes to help you, and then archived briefly before deletion.

Cookies.

The site uses a small number of cookies to keep your bag working between pages, to remember whether you’ve seen our welcome popup, and to measure how the site is used. Strictly necessary cookies (the bag, security) do not require consent. Anything beyond that — analytics, marketing — is set only with your consent, in line with the Privacy and Electronic Communications Regulations (PECR). You can change your choices or clear cookies through your browser at any time. The bag may not work if you block cookies entirely.

Children.

The site is not intended for anyone under sixteen, and we do not knowingly collect data from children. If you believe a child has sent us their information, write to us and we will delete it.

Changes.

If we make material changes to this policy, we will note them at the top and, where appropriate, email customers on file before the change takes effect.

For questions: [email protected].