Last updated: 27 October 2026
This policy explains how Raythex Ltd, trading as PeckBuy, collects and uses personal information when you visit peckbuy.com, place an order or contact us.
1. Who we are
The controller responsible for your personal information is Raythex Ltd, trading as PeckBuy, a company registered in England and Wales (company number 15042401). Registered office: 17-19 St. Georges Street, Norwich, England, NR3 1AB.
How to contact us about privacy:
- Email: contact@peckbuy.com, with “Privacy” in the subject line.
- Post: Raythex Ltd, 17-19 St. Georges Street, Norwich, England, NR3 1AB.
2. Information we collect
Information you provide
| Category | Examples |
|---|---|
| Identity and contact details | Name, email address and, if you choose to give it, telephone number |
| Addresses | Billing address and delivery address |
| Order details | Items purchased, prices, delivery charge, and any order notes you add |
| Account details | If you create an account: email address, password (stored only in hashed form), saved addresses and order history |
| Correspondence | Emails you send us and their contents, such as photographs of a damaged item; if you phone us, your telephone number and any voicemail message you leave |
| Product reviews | If you review a product you have bought: the name you give with your review, your review text and any rating, and your email address (which is not published). We use our order records to confirm that you bought the item. Our website also records the IP address and browser details used to submit the review. |
| Marketing preferences | Whether you have agreed to receive marketing emails, or marketing texts and WhatsApp messages, the wording you were shown and when |
| Privacy requests and complaints | The request or complaint and how we dealt with it |
Ordering for someone else. If you send an order to another person, for example as a gift, you give us their name and address. We use them to deliver the order, and they form part of our order records.
Information collected automatically
| Category | Collected by | Purpose |
|---|---|---|
| IP address, browser and device type, date and time, pages requested | Our web server, and Cloudflare, our security and content-delivery provider | To deliver the website and protect it from attack and abuse |
| Aggregated statistics, such as numbers of requests and visitors and the countries they come from | Cloudflare, from the traffic it handles, without cookies | To understand, in aggregate, how the website is used |
| Bot-check signals from your browser | Cloudflare (Turnstile), on our sign-in, registration and password-reset forms | Telling people from automated abuse |
| Device and browser details, IP address and how the payment form is used | Stripe, on our product, basket and checkout pages | Payment security and fraud prevention (see section 4) |
| IP address and browser details | Our supplier’s image server, from which the product images on our website are loaded | Displaying product images |
| Your IP address when the checkout page opens, and the postcode or part of an address you type into the address finder | Our address-lookup provider | Suggesting your full address so that it is complete and accurate for delivery |
| Cookies and similar technologies | Our website and the providers listed in our Cookie Policy | Strictly necessary cookies make the shop work. Optional cookies (preferences, statistics and marketing) are set only with your consent. We do not currently use statistics cookies; any further analytics will run only if you consent under Statistics. |
| Order source, only if you consent | Our website | To record which channel (for example a search engine or another website) led to an order |
Information we receive from others
| Source | Information |
|---|---|
| Stripe | Whether your payment succeeded, the card brand, the last four digits and expiry date of the card, the issuing country, the outcome of fraud screening, and any refund or chargeback |
| Apple Pay, Google Pay or Link (Stripe’s saved-payment service), if you use them | The payment details, and the billing and contact details, you choose to share |
| Our fulfilment partner | Dispatch confirmation and tracking information for your order |
Do you have to give us your information?
We need your name, email address, billing address and delivery address to accept and deliver your order and to send the order emails required by law. Without them we cannot sell to you. Your telephone number is optional. Creating an account is optional; you can check out as a guest.
3. How we use your information and our lawful bases
We rely on these lawful bases:
- Contract — the use is necessary to perform our contract with you or to take steps you have asked for before entering into it;
- Legal obligation — the use is necessary to comply with the law;
- Legitimate interests — the use is necessary for a genuine business purpose that is not overridden by your rights and interests (you can object, see section 8); and
- Consent — you have given clear permission, which you can withdraw at any time.
| Purpose | Information used | Lawful basis |
|---|---|---|
| Processing and delivering your order | Identity, contact, address and order details | Contract |
| Taking payment and making refunds | Identity, contact, billing address, order details; payment details held by Stripe | Contract |
| Passing your order to our fulfilment partner and Royal Mail for dispatch and delivery | Your name, delivery address and the items you have ordered (Royal Mail receives only your name and delivery address) | Contract |
| Contacting you about your order, by email or, if you have given it, by telephone | Contact and order details | Contract |
| Suggesting your address at checkout | Your IP address, and the postcode or part of an address you type | Legitimate interests (making sure delivery addresses are complete and accurate) |
| Sending service emails (order received, dispatch, account and password emails) | Name, email address, order details | Contract |
| Operating your customer account | Account details and order history | Contract |
| Publishing product reviews and checking that each review comes from someone who bought the item | Product review details (section 2) and our order records | Legitimate interests (helping customers choose and keeping reviews genuine) |
| Answering your questions and dealing with order problems | Contact details, correspondence, order details | Contract (order-related); legitimate interests (other enquiries) |
| Handling cancellations, returns and faulty-goods claims | Contact, order and payment details, correspondence | Legal obligation; contract |
| Contacting you about a product safety notice or recall affecting a product you bought | Contact and order details | Legitimate interests (product safety); legal obligation where the law requires us to take part in a recall |
| Screening payments for fraud | See section 4 | Legitimate interests (preventing fraud and crime) |
| Keeping records of unpaid, failed and cancelled orders to help detect and prevent fraud | The contact, address and order details of those orders | Legitimate interests (preventing fraud) |
| Keeping the website secure and functioning | IP address, device and request information | Legitimate interests (security of our systems and our customers’ data) |
| Understanding, in aggregate, how the website is used | Aggregated statistics from Cloudflare | Legitimate interests (running and improving the website) |
| Keeping encrypted backups so we can recover from faults or incidents | All information held on our systems | Legitimate interests (business continuity and data security) |
| Accounting and tax records | Name, billing address, order and payment details | Legal obligation |
| Establishing or defending legal claims, chargebacks and disputes | Relevant order, payment and correspondence records | Legitimate interests |
| Handling privacy requests and complaints, and keeping records of them | The request and our response | Legal obligation |
| Recording your cookie choices | Your choices, stored in your browser | Legal obligation (to demonstrate consent) |
| Recording which channel led to an order | Order-source information | Consent |
| Remembering products you have recently viewed | Product details stored in your browser | Consent |
| Marketing emails | Email address and consent record | Consent |
| Marketing texts and WhatsApp messages | Telephone number and consent record | Consent |
We do not use your information to make decisions about you based on profiling, other than the payment screening described in section 4.
Marketing messages. We send marketing emails, or marketing texts and WhatsApp messages, only if you have opted in by ticking the relevant unticked box at checkout. You can withdraw consent at any time using the unsubscribe option in any marketing message or by emailing contact@peckbuy.com. We then keep a brief suppression record so that we do not contact you again in error.
4. Payment fraud screening
When you pay, Stripe’s fraud-screening service automatically assesses the payment using information such as the card and payment method, your email address, IP address, device and browser, and patterns Stripe has observed across its network. Payments assessed as high risk may be declined automatically, and some may be held for our review.
This assessment concerns that single payment only. It is not a credit check. Separately, your card issuer decides whether to authorise a payment.
Your safeguards. If your payment was declined and you believe this was wrong, email contact@peckbuy.com. You can ask for a person to review the decision, explain your circumstances and contest the outcome.
Our legitimate interest is preventing the use of stolen payment details.
Stripe also uses payment information as a controller for its own purposes, including monitoring, preventing and detecting fraudulent activity on its platform. See Stripe’s privacy policy at stripe.com/gb/privacy.
5. Who we share your information with
We share only the information each recipient needs.
| Recipient | Purpose and information |
|---|---|
| Stripe and its group companies | Card and wallet payments, refunds and fraud screening (see section 4) |
| Apple (Apple Pay), Google (Google Pay) and Stripe (Link), if you choose to pay with them | Providing the payment method you select, under their own terms |
| Our address-lookup provider | The address finder at checkout. It receives your IP address when the checkout page opens and the postcode or part of an address you type, and returns matching addresses. Its terms allow it to keep and analyse address searches to improve its service, detect misuse and produce statistics. |
| Our fulfilment partner (a UK-based wholesale supplier) and the order platform it uses | Picking, packing and dispatching your order. They receive your name, delivery address and the items you have ordered. |
| Our supplier’s image server | Product images on our website are currently loaded from our supplier’s server, so it receives your IP address and browser details when you view them. |
| Royal Mail | Delivering your parcel. Royal Mail receives your name and delivery address. |
| Cloudflare | Content delivery, website security, the bot check on our sign-in, registration and password-reset forms, and aggregated website statistics. All traffic to and from the website passes through its network. |
| Google (Google Workspace) | Our business email, including the order and service emails we send you |
| Our mobile network provider | Carrying calls to our customer telephone line and storing any voicemail message you leave |
| Our cloud backup storage provider | Storing backups of our systems. Backups are encrypted before they leave our server. |
| Our email marketing service provider, if you opt in to marketing emails | Sending our marketing emails |
| Our messaging service provider, if you opt in to marketing texts or WhatsApp messages | Sending those messages |
| Our accountants and other professional advisers | Accounting, tax and professional advice |
| Visitors to our website, if you write a product review | Your review, any rating and the name you give with it are published on the product page. Your email address and order details are never published. |
| HMRC, police, courts and regulators | Where required by law, or to prevent or detect crime |
| A purchaser of our business | If the business or its assets are sold |
Our website and customer database are hosted on our own server in the United Kingdom. Product images are currently loaded from our supplier’s image server.
6. International transfers
Some of our providers are based in, or use staff or data centres in, countries outside the UK. Where personal information is transferred outside the UK, it is protected as follows:
| Provider | Where data may be processed | Safeguard |
|---|---|---|
| Stripe | The USA and other countries where Stripe operates | UK Extension to the EU-U.S. Data Privacy Framework; the UK Addendum to the EU standard contractual clauses where that does not apply |
| Cloudflare | Cloudflare’s global network | UK Extension to the EU-U.S. Data Privacy Framework; the EU standard contractual clauses with the UK Addendum where that does not apply |
| Google (Workspace) | Google data centres in several countries, including the USA | UK Extension to the EU-U.S. Data Privacy Framework; standard contractual clauses where that does not apply |
| Our address-lookup provider | Hosting in the UK and EU; some of its own service providers are in the USA | As set out in the provider’s data-processing terms. Ask us for details at contact@peckbuy.com |
| Cloud backup storage | Stored in the Netherlands (EU); the provider is headquartered in the USA | The UK recognises the EEA as providing adequate protection; the provider complies with the UK Extension to the EU-U.S. Data Privacy Framework. Backups are encrypted before they leave our server. |
You can ask us for more information about these safeguards at contact@peckbuy.com.
7. How long we keep your information
| Information | Retention period | Reason |
|---|---|---|
| Orders and sales records, including refunded orders (name, addresses, email, items, payment record, and order source where you consented) | Six years after the end of the financial year in which the order was placed, then anonymised within the following 12 months; longer only where a tax enquiry or legal claim requires it | Company and tax law; limitation period for contract claims |
| Unpaid, failed and cancelled orders | 84 months, then moved to our website’s deleted items and permanently deleted within 12 months | Detecting and preventing fraud |
| Stripe customer and payment-method references stored on our website | 84 months | Dealing with refunds, chargebacks and disputes |
| Product reviews | While the review is published on our website. You can ask us to remove your review at any time. If a review is removed, it is kept in our website’s deleted items for up to 12 months and then permanently deleted | Displaying genuine reviews |
| What you type into the address finder at checkout | The address you choose becomes part of your order record. The address-lookup provider may keep and analyse address searches under its own terms | Providing the address finder |
| Customer accounts | Until you ask us to close your account, or until 84 months after your last sign-in or order, when inactive accounts are deleted automatically. Past orders are then retained as sales records | Operating your account |
| Emails between you and us, and copies of emails we send you | Six years after the end of the financial year in which they were sent, then deleted | Customer service, accounting records and legal claims |
| Voicemail messages and notes of telephone calls | Voicemail messages are deleted once we have dealt with your call. If a call is about an order, we keep a short note of it with that order’s records | Customer service |
| Website and security logs | Our web server keeps technical logs (including IP addresses and pages requested) for security and troubleshooting. These logs are overwritten automatically on a rolling basis, usually within days. Copies may remain in our encrypted backups until those backups are deleted (see “Backups”) | Security and troubleshooting |
| Marketing consent and suppression records | While your consent is active; afterwards as a suppression record so we do not contact you again | Evidence of consent |
| Cookie choices | Up to 365 days, stored in your browser (see our Cookie Policy) | Evidence of consent |
| Privacy requests and complaints | For as long as needed to show we handled them correctly, including any limitation period for legal claims | Demonstrating that we handled them correctly |
| Backups | 90 days, then deleted | Recovery from faults and incidents |
8. Your rights
Subject to certain conditions and exceptions, you have the right to:
- be informed about how we use your information (this policy);
- access your information and receive a copy of it;
- have inaccurate or incomplete information corrected — account holders can also update their details directly;
- have your information erased — this right is not absolute; for example, we must keep sales records for tax purposes;
- restrict our use of your information, for example while its accuracy is checked;
- object to our use of your information based on legitimate interests, including fraud screening;
- data portability — receive information you provided to us in a structured, machine-readable format, or have it transmitted to another organisation where technically feasible;
- safeguards for automated decisions — obtain information about them, make representations, request human review and contest the decision (see section 4); and
- withdraw consent at any time where we rely on consent, including for optional cookies (use the “Manage consent” button shown on every page) and marketing messages. Withdrawal does not affect processing carried out before it.
How to exercise your rights. Email contact@peckbuy.com or write to the address in section 1. No particular form of words is needed.
- Verification. We may need to confirm your identity, usually by replying to the email address on your order or account or by asking for your order number.
9. Complaints
If you are unhappy with how we have handled your personal information, you can complain to us by emailing contact@peckbuy.com or by writing to the address in section 1.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: ico.org.uk/make-a-complaint.
10. Cookies
Our use of cookies and similar technologies is explained in our Cookie Policy.
11. Changes to this policy
We may update this policy. The date at the top shows when it was last revised.