Privacy Policy
Privacy Policy
Last updated: 15 August 2026
1. Who we are
Octopus Baits is a partnership between Christopher Root and Jonathan Root, trading from 20a Goulds Farm, Shalford Rd, Rayne, Braintree CM77 6DF.
We are the data controller for the personal data described in this policy. If you have any questions about how we use your data, contact us at octopusbaits@gmail.com.
2. What we collect
Depending on how you use our site, we may collect:
- Order information — your name, billing and delivery address, email address, phone number, and order history.
- Payment information — processed directly by our payment providers. We do not store your full card details.
- Account information — if you create an account, your login details and saved addresses.
- Marketing preferences — whether you have opted in to receive emails from us.
- Technical data — IP address, browser type, device information, and pages viewed, collected through cookies and similar technologies.
- Correspondence — messages you send us by email or social media.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Processing and delivering your order, and handling returns | Performance of a contract |
| Keeping accounting and tax records | Legal obligation |
| Sending marketing emails | Consent, or legitimate interests where you are an existing customer buying similar products |
| Preventing fraud and securing our site | Legitimate interests |
| Understanding how our site is used so we can improve it | Consent (analytics cookies) |
| Responding to your enquiries | Legitimate interests |
4. Who we share it with
We share personal data only with organisations that help us run the business:
- Shopify — our ecommerce platform, which hosts our store and processes orders.
- Payment providers — including Shopify Payments and PayPal, who process your payment.
- APC Overnight — our courier, who receives your name, address and contact details to deliver your order.
- Email and marketing tools — where you have subscribed.
- Our accountant and professional advisers, where necessary.
- HMRC and other authorities, where we are legally required to.
We do not sell your personal data to anyone.
5. International transfers
Some of our providers, including Shopify, process data outside the UK. Where that happens, we rely on safeguards recognised under UK data protection law, such as the UK International Data Transfer Agreement or an adequacy decision.
6. How long we keep it
We keep order and transaction records for 6 years after the end of the relevant tax year, as required by HMRC. Marketing data is kept until you unsubscribe or ask us to delete it. Account data is kept while your account is open.
7. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Have your data erased in certain circumstances
- Restrict or object to how we process your data
- Receive your data in a portable format
- Withdraw consent at any time, where we rely on consent
- Object to direct marketing at any time
To exercise any of these, email octopusbaits@gmail.com. We will respond within one month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
8. Cookies
Our site uses cookies — small files stored on your device.
- Strictly necessary cookies keep the site working, remember your basket and keep you logged in. These do not require consent.
- Analytics cookies help us understand how the site is used.
- Marketing cookies may be used to show you relevant advertising and measure its performance.
Analytics and marketing cookies are only set with your consent, which you can give or withdraw through the cookie banner. You can also block or delete cookies through your browser settings, though this may stop parts of the site working.
9. Marketing
We will only send you marketing emails where you have opted in, or where you have bought from us before and we are offering similar products. Every email includes an unsubscribe link, and you can opt out at any time by emailing us.
10. Changes to this policy
We may update this policy from time to time. The current version will always be posted on this page with the date it was last updated.