Privacy policy

Effective date: 16 June 2026
Last updated: 16 June 2026

This Privacy Policy explains how Boneroshop (operated by BLUESTONE ECOM LTD) collects, uses, stores, shares, and protects your personal information when you visit our website, place an order, contact our customer support team, or interact with us in any way. It also explains your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about this Privacy Policy or how we handle your data, please contact us at support@boneroshop.com.

1. Who we are

This website (https://www.boneroshop.com) is operated by BLUESTONE ECOM LTD ("Boneroshop", "we", "us", "our"), a company registered in England and Wales.

Company name: BLUESTONE ECOM LTD
Trading as: Boneroshop
Company number: 17105446
Registered office: 128 City Road, London, EC1V 2NX, United Kingdom
Email: support@boneroshop.com
Phone: +44 20 8040 0104
ICO Registration Number: [pending]

For the purposes of UK GDPR, BLUESTONE ECOM LTD is the data controller of the personal information you provide to us.

2. What personal information we collect

We collect the following categories of personal information:

Identity and contact information: Full name, email address, postal address, mobile or landline phone number, billing address, shipping address.

Order and transaction information: Items ordered, order history, order total, payment method, transaction reference, returns and refund records.

Payment information: Card type, last four digits of payment card, billing address, and Klarna or Shop Pay account identifiers where used. We do not store full card numbers — these are processed directly by our payment providers (Shopify Payments, Klarna, Shop Pay, Google Pay).

Technical information: IP address, browser type and version, device type, operating system, time zone, language, referring website, pages visited, time spent on pages, and clickstream data.

Communications information: The content of any emails, messages, or chat conversations you send to us, and our responses.

Reviews and feedback: Any product review, rating, or feedback you choose to submit through our store.

We do not knowingly collect special category data (such as health, racial or ethnic origin, religious beliefs, or political opinions). Please do not provide such information to us.

3. How we collect personal information

We collect personal information directly from you when you:

Visit our website (technical information collected automatically through cookies and similar technologies)
Place an order at checkout
Contact our customer support team by email, phone, or in-store messaging
Submit a product review or feedback
Subscribe to any service we may offer in future (such as email updates — currently not active)
Initiate a return or refund

We may also receive information about you from third parties, including:

Payment providers confirming a transaction
Shipping carriers updating delivery status
Klarna confirming a buy-now-pay-later transaction
Analytics providers giving us aggregated insights about website usage

4. How we use your personal information and our lawful basis for doing so

Under UK GDPR, we must have a lawful basis for processing your personal information. The lawful basis we rely on depends on the purpose:

Processing and fulfilling your order — Performance of a contract (Article 6(1)(b))
Communicating with you about your order, returns, or support enquiries — Performance of a contract (Article 6(1)(b))
Processing payment for your order — Performance of a contract (Article 6(1)(b))
Meeting our legal and tax obligations (e.g. keeping order records for HMRC) — Legal obligation (Article 6(1)(c))
Improving our website and customer experience — Legitimate interest (Article 6(1)(f))
Detecting and preventing fraud or abuse — Legitimate interest (Article 6(1)(f))
Analytics through cookies and similar technologies — Consent (Article 6(1)(a))

5. Third parties we share your information with

We share your personal information only with the third-party service providers we need in order to operate our store and fulfil your orders. We do not sell, rent, or trade your personal information to anyone, ever.

The third-party providers we use are:

Shopify Inc.
Hosting platform for our website and the data we collect through it.
What we share: all order data, customer information, and storefront analytics.
Privacy policy: https://www.shopify.com/legal/privacy

Shopify Payments
Payment processing for credit and debit card transactions.
What we share: card details, billing information, transaction amount.
Privacy policy: https://www.shopify.com/legal/privacy

Shop Pay
Express checkout service operated by Shopify.
What we share: email address, shipping and billing details, payment data (only when a customer uses Shop Pay).
Privacy policy: https://www.shopify.com/legal/privacy

Google Pay
Express checkout service operated by Google.
What we share: payment data, billing details (only when a customer uses Google Pay).
Privacy policy: https://policies.google.com/privacy

Apple Inc.

Apple Pay is an express checkout service operated by Apple Inc.

Information shared: Payment information and billing details (only when a customer chooses to pay using Apple Pay).

Klarna Bank AB
Buy-now-pay-later service.
What we share: full purchase data, contact details, payment information (only when a customer chooses Klarna at checkout).
Privacy policy: https://www.klarna.com/uk/privacy/

ShipBob (ShipBob, Inc.)
Fulfilment partner that processes and ships orders from our warehouse in Northamptonshire, UK.
What we share: name, shipping address, phone number, order contents.
Privacy policy: https://www.shipbob.com/privacy-policy/

Royal Mail, DPD, and Evri
Delivery carriers.
What we share: recipient name, delivery address, contact phone number.
Privacy policies: Royal Mail / DPD / Evri

Track123
Order tracking service that sends shipment updates to customers.
What we share: order number, tracking number, customer email or phone.
Privacy policy: https://www.track123.com/privacy

ParcelWILL Returns
Returns management platform.
What we share: customer name, order data, return reason, return shipping details.
Privacy policy: https://parcelwill.com/privacy-policy

EasyScan
Order processing scanner used internally by our team.
What we share: minimal customer data — order numbers only.
Privacy policy: https://logbase.io/privacy-policy

Vitals
Shopify app providing customer reviews and storefront features.
What we share: reviews submitted by customers, anonymised browsing data used by Vitals features.
Privacy policy: https://vitals.co/privacy

Shopify Inbox / Messaging
In-store messaging used for customer service conversations.
What we share: content of customer service conversations.
Privacy policy: https://www.shopify.com/legal/privacy

Google Analytics 4
Website analytics provided by Google.
What we share: anonymised browsing data and aggregated website usage.
Privacy policy: https://policies.google.com/privacy

Simprosys Google Shopping Feed
Product feed sync to Google Merchant Center.
What we share: product information only — no customer personal data.
Privacy policy: https://simprosys.com/privacy

In addition, we may share your information:

With law enforcement, regulators, or other authorities if required by law
With professional advisers (such as accountants or legal advisers) where necessary for our legitimate business interests
In connection with a sale, merger, or acquisition of our business

6. We do not sell your personal information

We do not sell, rent, lease, or otherwise commercialise your personal information. We do not share your information with advertising networks for the purpose of profiling or targeting you with third-party advertising beyond the analytics use of Google Analytics 4 described above. If we ever change this practice in future, we will update this Privacy Policy and obtain your consent where required.

7. International data transfers

Some of our third-party providers are based outside the United Kingdom (notably in the United States, Canada, and the European Economic Area). When your personal data is transferred outside the UK, we ensure that the transfer is protected by one of the following safeguards:

The country has been recognised by the UK government as providing adequate protection (such as the EEA and the United States under the UK-US Data Bridge)
The Standard Contractual Clauses approved by the UK Information Commissioner's Office
The International Data Transfer Agreement (IDTA)

8. How long we keep your personal information

We retain your personal information only for as long as necessary for the purposes for which we collected it:

Order and transaction data — kept for 7 years after the order is placed, to comply with UK tax and accounting law (HMRC requirement)
Communications (customer support emails, chat messages) — kept for 3 years after the last contact
Reviews and feedback — kept for as long as the review is published on our store
Abandoned cart data — kept for 30 days, then deleted
Technical data (server logs, analytics) — kept for 14 months as per Google Analytics defaults

After these periods, your data is securely deleted or anonymised.

9. How we protect your personal information

We use industry-standard security measures to protect your personal information:

Our entire website is served over HTTPS using a valid SSL/TLS certificate, meaning your data is encrypted in transit
Payment information is processed directly by our payment providers (Shopify Payments, Klarna, Shop Pay, Google Pay) using PCI-DSS compliant systems — we never see or store full card numbers
Access to customer information within our team is limited to authorised personnel only
Our service providers (Shopify, ShipBob, etc.) are themselves bound by strict data security obligations

While we take reasonable steps to protect your data, no system is 100% secure. If you believe your account or information has been compromised, please contact us immediately at support@boneroshop.com.

10. Cookies and similar technologies

Our website uses cookies and similar technologies. Cookies are small text files stored on your device that help our website function properly and improve your experience.

Strictly necessary cookies — required for the site to function (e.g. keeping your cart, processing checkout). These do not require your consent.

Analytics cookies — Google Analytics 4 (anonymous browsing data). We only set these cookies after you give consent through our cookie banner.

Functional cookies — set by certain Shopify apps (e.g. Vitals, Shop Pay) to improve store features and your experience.

You can control or delete cookies at any time through your browser settings. You can also manage your consent preferences through the cookie banner on our website.

11. Your rights under UK GDPR

You have the following rights regarding your personal information:

Right of access — you can request a copy of the personal information we hold about you
Right of rectification — you can ask us to correct inaccurate or incomplete information
Right to erasure — you can ask us to delete your personal information (subject to legal retention requirements)
Right to restrict processing — you can ask us to limit how we use your information
Right to data portability — you can ask us to provide your data in a portable format
Right to object — you can object to certain types of processing, including processing based on legitimate interests
Right to withdraw consent — where we rely on your consent (e.g. for analytics cookies), you can withdraw it at any time
Right not to be subject to automated decision-making — we do not currently use automated decision-making that significantly affects you

To exercise any of these rights, please contact us at support@boneroshop.com. We will respond within one month.

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: https://ico.org.uk

12. Children's privacy

Our website and services are not intended for individuals under the age of 16. We do not knowingly collect personal information from anyone under 16. If you become aware that a child under 16 has provided us with personal information, please contact us at support@boneroshop.com and we will take steps to delete it.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we use, or applicable law. When we make a material change, we will update the "Last updated" date at the top of this page and, where appropriate, notify customers by email or a notice on our website.

We recommend you review this Privacy Policy periodically to stay informed of how we protect your personal information.