Privacy policy

What we collect

Only what an order needs

When you buy from us we collect your name, email address, delivery address and what you bought. If you create an account we also hold your sign-in details (a password hash or passkey — never a plain password). If you email us, we keep the correspondence.

Payment is processed by Stripe, our payment processor. Card details are entered on and handled by Stripe's systems and never reach our servers.

Our web server records IP addresses in routine security logs, and we use your IP address once per visit to determine your country, so we can show the cookie choices your local law requires. The country lookup happens on our own server — your IP is not sent to anyone else for it. IP geolocation data is by DB-IP.

Why we may collect it

Lawful bases

• Contract — processing an order: your details are needed to take payment and deliver the goods.
• Legal obligation — keeping order and payment records for UK tax law.
• Legitimate interests — security logging, fraud prevention, and answering your messages.
• Consent — analytics and advertising cookies. These run only if you agree, and you can withdraw consent at any time via Cookie choices in the footer.

How long we keep it

Retention

• Order records — six years after the tax year of the order, as UK tax law requires.
• Account data — until you ask us to delete the account.
• Correspondence — up to two years after the matter is closed.
• Consent records — a log of each cookie-consent choice (timestamp, truncated IP, country, choices made, policy version) kept to demonstrate compliance. The IP is anonymised before storage and cannot identify you.
• Server logs — rotated and deleted automatically after a short period.

Who else sees it

Processors and transfers

We do not sell personal data. We share it only with the providers needed to run the shop: Stripe (payments) and our delivery carriers (name and address, to deliver your order). If you consent to advertising cookies, Google receives the ad-measurement data described in the cookies section.

Stripe and Google process some data in the United States. Those transfers are covered by the UK Extension to the EU–US Data Privacy Framework and/or standard contractual clauses.

Your rights

Access, correction, erasure

Under UK GDPR you can ask us for a copy of your data (access), to correct it (rectification), to delete it (erasure), to restrict or object to processing, and to receive it in a portable format (portability). Where processing is based on consent, you can withdraw that consent at any time.

Email sales@ironbond.co and we will respond within one month. Note that order records required by tax law must be retained for the statutory period even after an erasure request.

You also have the right to complain to the UK Information Commissioner's Office: ico.org.uk or 0303 123 1113.

Cookies

What this site sets

Cookie	Purpose	Duration
ib_session	Essential — runs your basket and sign-in. Set for every visitor; the site cannot work without it.	Ends when you close the browser
ib_consent	Essential — remembers your cookie choices so we do not ask again.	6 months
ib_click	Advertising — remembers the click identifier from a Google advert that brought you here, so we can tell Google which adverts led to sales. Set only with your consent to advertising cookies (or, in opt-out regions, until you opt out).	90 days
_ga, _ga_*	Analytics (Google) — how the site is used. Set only with your consent.	Up to 2 years
_gcl_au, and other Google Ads cookies	Advertising (Google) — measuring adverts and making them more relevant. Set only with your consent (or, in opt-out regions, until you opt out).	Up to 90 days

Change your mind at any time via Cookie choices in the footer of every page.

California & other US states

Notice for US residents

In the last 12 months we have collected these categories of personal information: identifiers (name, email, address, IP), commercial information (orders), and — where cookies are permitted — internet activity (pages visited, ad interactions).

We do not sell personal information for money. Advertising cookies involve disclosing identifiers and activity data to Google, which counts as “sharing” for cross-context behavioural advertising under the CPRA. You can opt out at any time via the “Do Not Sell or Share My Personal Information” link in the footer, or via Cookie choices — switch off Advertising. No account is needed and we do not discriminate against anyone who opts out.

We honour the Global Privacy Control (GPC) signal: if your browser sends it, we treat it as an opt-out of sharing automatically.

You may also request access to, or deletion of, your personal information by emailing sales@ironbond.co. We verify requests against the order details we hold.

Questions

How to reach us

Anything unclear, or a request about your data: sales@ironbond.co, or write to District 11 Limited, 1 Rosemont Road, London, NW3 6NG.

If we change this policy materially we will update the date at the top and, where the change affects cookies, ask for your consent again.