Privacy Policy

What Trail Forge undertakes to do: collect only the information needed to sell, deliver and support an order, and explain here what each category covers.

Technical information is generated by visiting the site: the device and browser used, an approximate location derived from the IP address, and the pages viewed. It does not identify anyone by name.

Order information is supplied by the customer: name, email address, delivery and billing addresses, a contact number where the carrier requires one, the items purchased and the payment result returned by the processor.

What the customer can expect: no special category information, such as health or biometric data, is requested, and no information is gathered about ethnicity, religion or political opinions.

Correspondence sent to Trail Forge is filed against the relevant order, so that a later question can be answered without the history being repeated.

Optional fields at checkout may be left blank without affecting the order, and fields that are required are marked as such rather than left to be discovered by rejection.

What Trail Forge undertakes to do: use each category of information only for the purpose for which it was collected, and record that purpose in writing.

Details supplied with an order are used to collect payment, send the goods, provide tracking updates, deal with returns and satisfy accounting duties.

Technical information is used to run the site, detect unusual activity that may indicate fraud, and understand in aggregate which pages are read.

What the customer can expect: information is not used to build advertising profiles, and it is not sold. Where a use rests on consent rather than on performing a contract, that consent may be withdrawn at any time.

Withdrawal applies to future use and does not affect anything done lawfully beforehand.

A written record is kept of why each category of information is held, so that a specific answer can be given if a customer asks why a particular detail is needed.

Where information is used on the basis of consent rather than to perform a contract, that consent may be withdrawn at any time, and the withdrawal applies to future use only.

What Trail Forge undertakes to do: keep cookies to the minimum needed for the site to function, and describe each category plainly.

Essential storage holds the contents of the basket and keeps the checkout session alive. Without it the basket empties whenever a page changes, which is why it cannot be switched off from within the site.

Analytics storage records page views in aggregate, using a random identifier rather than a name or email address. It cannot be joined to an order record.

What the customer can expect: no third-party advertising or retargeting cookies are present. Blocking cookies in the browser is possible, but the basket will not survive navigation between pages and the checkout cannot be completed without essential storage.

Campaign visits are recorded in aggregate only, and no profile is built that follows a customer to other websites.

Where a customer returns to the site, the analytics identifier may recognise the browser as a previous visitor, but that recognition is statistical rather than personal and does not alter prices.

What Trail Forge undertakes to do: disclose information only to the parties needed to complete a transaction, and only to the extent required.

Those parties are the payment processor, the delivery carrier, the hosting provider and the service that sends confirmation emails. The carrier receives the delivery address and a contact number, not payment details.

Before appointing any supplier that receives order data, Trail Forge establishes what it does with that data and how long it retains it, and records the answer. A supplier that cannot meet the required standard is not appointed.

What the customer can expect: information is not sold, is not passed to unrelated marketing lists, and is released to a public authority only where legally compelled.

Where disclosure is compelled, the customer is told unless the law prohibits that notification.

Suppliers are bound by contract to process information only on instruction and to apply appropriate security measures, and any replacement inherits exactly the same restriction.

Where a supplier is replaced, the replacement receives order data only for the purpose of fulfilling and supporting orders, and for no other purpose.

What Trail Forge undertakes to do: keep each category of information only for the period stated here, and delete it when that period ends.

Order records, including the delivery address and the items purchased, are kept for seven years to satisfy tax and accounting requirements. Support correspondence is kept for two years.

Analytics stay aggregated so that no individual can be picked out, and an abandoned basket is removed automatically after a short interval.

What the customer can expect: when a retention period expires the record is deleted rather than hidden, and it is not left in a secondary system that is no longer reviewed.

Where a legal claim is ongoing, the records relevant to it are retained until it concludes, and the customer is told if that affects a deletion they have requested.

Retention periods are reviewed periodically to confirm that what is stated here remains accurate and that nothing is held beyond its purpose.

Where a customer asks for earlier deletion, the request is balanced against the accounting duty, and the outcome is explained in writing.

What Trail Forge undertakes to do: encrypt traffic in transit, keep card data out of its own systems, and restrict access to order data by role.

Card details are entered on the processor's hosted page and never reach Trail Forge systems or logs. Access to order data is limited to the small team that packs and supports orders, using individual accounts rather than a shared credential.

What the customer can expect: access is removed on the day a person stops working with Trail Forge, and patterns that look unusual, such as repeated failed payments from one address, are reviewed.

No system is perfect, and Trail Forge does not claim otherwise. Any breach affecting customer information would be investigated and the individuals concerned told what happened.

Security measures are reviewed periodically, and the outcome of those reviews informs the access rules described here.

Access rights are reassessed whenever someone joins or leaves the small team that handles orders, and the review is recorded.

Where an incident affects customer information, the investigation covers how the incident occurred and what has been changed to prevent a recurrence.

What the customer can expect: the following rights may be exercised free of charge, without giving a reason, and without any reduction in service.

Access: obtain a copy of the personal information held. Rectification: have inaccurate information corrected. Erasure: request deletion of information not legally required to be retained.

Objection: object to a particular use, such as marketing email. Portability: receive information in a structured, commonly used format.

What Trail Forge undertakes to do: answer a request within 30 days, and explain why if a request is complex and takes longer.

Where a request cannot be granted in full, the rule that prevents it is identified and the options available are explained rather than a bare refusal being issued.

Requests are handled by the same team that answers order enquiries, so a data question is dealt with by someone who can already see the relevant order record.

No reason needs to be given when exercising a right, and a request is not treated as a complaint or recorded against the customer.

What Trail Forge undertakes to do: operate the site for adults, avoid targeting advertising at children, and delete any information found to have been supplied by a child.

What the customer can expect: no account, mailing list or prize draw aimed at children is operated, and the checkout does not ask anyone to state an age.

When a purchase is made for a child, the buyer is an adult and the contact information on file belongs to that adult.

A parent or guardian may exercise any of the rights above on a child's behalf, and requests of that kind are handled in the same way as any other.

Photographs sent in connection with a sizing or fitting enquiry are used only to answer that enquiry and are never published or passed on.

Age guidance on a product page speaks to safe use of the item, not to who is entitled to buy it.

A parent or guardian may request deletion on a child's behalf, and the request is handled within the same 30-day period as any other.

What Trail Forge undertakes to do: provide a direct route for privacy questions, answer within one working day, and answer formal requests within 30 days.

Write to support@elowenonline.shop with the word privacy in the subject line, together with a statement of what is being requested. No particular form of words is required, and a short email is sufficient.

What the customer can expect: identity may be verified before information is released or deleted, so that it cannot be obtained by someone impersonating the customer.

A customer unhappy with an answer may request a review, and will be told which member of staff dealt with it the first time.

Where the way personal information is handled changes materially, the revised text is published on this page with the revision date shown at the top.

Where a request cannot be granted, the rule preventing it is identified and the available options are explained, so the customer is not left without a route forward.