Privacy policy


Privacy Policy

Last updated: September 29, 2026

1. Overview and Data Controller Information

This Privacy Policy describes how Matthew Grant trading as Evergreen Elves (referred to as "we", "us", or "our") collects, uses, and discloses your personal information when you visit, use, or make a purchase from our store at www.evergreenelves.co.uk (the "Services") or otherwise communicate with us. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Evergreen Elves is the data controller responsible for your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read and understand the practices described herein.

2. Personal Information We Collect

When we refer to "personal information", we mean any information that identifies or can reasonably be linked to an identifiable individual. We collect or process the following categories of personal information:

  • Contact Information: Your full name, delivery address, billing address, telephone/mobile phone number, and email address.

  • Order and Fulfilment Details: Items purchased, tree dimensions, preferred delivery dates and time windows, delivery notes (such as safe place instructions, access gate codes, or delivery access requests), and delivery status updates.

  • Accessibility and Health Data (Special Category Data): Where you voluntarily provide information regarding mobility impairments or accessibility requirements to facilitate safe doorstep handover, we process this information strictly with your explicit consent and solely for delivery coordination.

  • Financial and Payment Details: Payment card details, billing address, and transaction confirmation numbers. Payment processing is handled directly by encrypted, PCI-DSS compliant third-party payment gateways; we do not store full payment card numbers on our servers.

  • Account Information: If you create an account, we collect your login credentials, saved addresses, and order history.

  • Device and Usage Data: IP address, browser type, device information, operating system, and data about how you interact with our website via cookies and tracking pixels.

  • Customer Support Records: Details and attachments shared when you contact us via email, phone, or contact forms.

  • Competitions and Promotions: If you enter our promotional draws, giveaways, or social media campaigns, we may collect your social media handle, public profile information, and any contact details provided to verify your entry and notify you if you win.

3. Lawful Bases for Processing

Under the UK GDPR, we only process your personal data where we have an established lawful basis:

  • Performance of a Contract: To process your payment, schedule your tree delivery, manage route logistics, communicate order updates, and deliver your products.

  • Legitimate Interests: To optimize our delivery routes, prevent fraud, secure our website, defend against delivery disputes, and provide customer support. Where permitted by direct marketing regulations, we may also rely on legitimate interests (or statutory soft opt-in) to send relevant seasonal reminders to existing customers.

  • Legal Obligation: To retain tax, accounting, and financial transaction records as required by UK law.

  • Consent: Where you have explicitly opted in to receive non-transactional marketing communications, consented to non-essential website cookies, or provided voluntary accessibility notes. You may withdraw consent at any time.

  • Performance of a Contract / Legitimate Interests: To administer promotional giveaways, verify eligibility within our delivery postcodes, and notify winners.

4. Delivery Scheduling, SMS Tracking, and Third-Party Applications

To ensure a seamless, time-specific delivery experience, we share necessary customer details with trusted operational service providers:

  • Delivery Scheduling and Slot Selection (DingDoong and Similar Applications): We use specialised Shopify fulfilment and delivery-slot management apps, such as DingDoong, to manage our delivery calendar, route capacity, and checkout date/time pickers. Your delivery postcode, selected time slot, and order details are processed through these applications to reserve your delivery window.

  • SMS Notifications and Driver Communication: We collect your mobile telephone number specifically for delivery coordination. On the day of delivery, when your address is next on the route, you will receive an automated SMS containing a tracking link. Additionally, our delivery drivers or support team may call or message this number to locate you or request instructions if no one answers the door or if access to your property is restricted.

  • Google Maps Integration: Our driver routing and customer tracking links utilise the Google Maps API. When you access your live tracking link to follow our delivery vehicle, your browser interacts directly with Google Maps services, which may collect technical device identifiers in accordance with Google's standard Privacy Policy.

  • Delivery Confirmation Records & Keepsake Footage: Where a tree is left in an agreed safe place, or as part of our festive handover, our team may capture timestamped photographs or brief video clips of the tree and its location. These recordings serve two purposes:

    • Proof of Delivery: To verify safe, undamaged placement at your threshold and provide an audit trail for liability, insurance, and dispute-resolution purposes.

    • Customer Keepsake: We may transmit this media directly to you via SMS, email, or your tracking link so your household can see the elves completing your delivery even if you were unable to greet them in person.

    • Privacy & Scope: Such recordings are focused strictly on the delivered goods and immediate external drop-off area. They are transmitted directly to the contact details provided on your order, retained securely for up to 90 days, and will never be published publicly or used for marketing without separate, explicit written consent.

5. How We Share Personal Information

We do not sell, rent, or trade your personal information. We disclose personal data only to third parties necessary to operate our business and fulfil our services:

  • Shopify: Our store is hosted on Shopify, which powers our e-commerce platform and processes personal information securely on our behalf.

  • Logistics, Routing, and Communication Partners: Including delivery route optimisation apps, SMS messaging gateways, and mapping services (Google Maps).

  • Payment Gateways: Secure processors such as Shopify Payments, Stripe, or PayPal to handle transactions.

  • Professional Advisers and Legal Authorities: Accountants, insurers, legal counsel, or law enforcement authorities when required to comply with UK statutory obligations or protect our legal rights.

6. International Data Transfers

Certain third-party service providers (such as Shopify or cloud communication platforms) may store or process your data outside the United Kingdom, including in the European Economic Area, the United States, or Canada. Whenever we transfer your personal information out of the UK, we ensure an equivalent level of protection is maintained by relying on adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or by implementing UK International Data Transfer Agreements (IDTAs) and the UK Addendum to the EU Standard Contractual Clauses (SCCs).

7. Cookies and Tracking Technologies

Our website uses cookies to remember your shopping basket, analyse website traffic, and ensure secure checkout sessions. For detailed information on the specific cookies deployed by our platform, please refer to Shopify's Cookie Policy. You can adjust your browser settings to refuse non-essential cookies at any time.

8. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected:

  • Order and Transaction Records: Kept for up to six years following the end of the relevant tax year to comply with UK HMRC statutory accounting requirements.

  • Fulfilment and Tracking Data: Delivery tracking links, SMS logs, and proof-of-delivery photos/videos are retained for up to 90 days following the delivery date to resolve any delivery queries, after which they are securely deleted or anonymised.

  • Marketing Data: Contact details used for marketing are retained until you opt out or withdraw consent.

9. Your Rights Under UK GDPR

As an individual in the United Kingdom, you have statutory rights concerning your personal data:

  • Right of Access: You have the right to request a copy of the personal data we hold about you.

  • Right to Rectification: You may request that we correct any inaccurate or incomplete information.

  • Right to Erasure (Right to be Forgotten): You can request the deletion of your personal data where it is no longer required for statutory or contractual purposes.

  • Right to Restrict or Object to Processing: You may object to the processing of your data for direct marketing or on grounds relating to your particular situation.

  • Right to Data Portability: You may request that we transfer your personal data to you or a third party in a structured, commonly used machine-readable format.

To exercise any of these rights, please contact us using the details provided below. We will respond within one calendar month. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at www.ico.org.uk if you are concerned about our data handling practices.

10. Contact Details

If you have questions, wish to exercise your data rights, or require further information regarding this Privacy Policy, please contact us at:

  • Trading Name: Evergreen Elves

  • Business Entity: Matthew Grant trading as Evergreen Elves

  • Address for Service: 173 Station Road, Wythall, B47 6AF, United Kingdom

  • Email: elves@evergreenelves.co.uk

  • Telephone: 07576 451605