Privacy policy.

Who we are

Culm is operated by Tom Proffitt, a sole trader registered in England and Wales. Our website is getculm.co.uk. When this policy refers to "Culm", "we", "us" or "our", it means Tom Proffitt trading as Culm.

We are the data controller for the personal information we collect through this website. If you have any questions about this policy or how we handle your data, contact us at hello@getculm.co.uk.

What data we collect and why

We only collect what we need. At this stage — pre-launch, waitlist only — that is very little.

When the shop launches, we will also collect the information needed to process an order: name, delivery address, and payment details. Payment is handled by a third-party processor (Stripe) — we never see or store your full card number.

We do not collect data you haven't given us directly. We do not buy marketing lists. We do not share your email address with any third party for their marketing purposes.

Legal basis for processing

Under UK GDPR, we need a lawful basis to process your personal data. We rely on the following:

• Consent — when you submit your email address via the waitlist form, you are consenting to receive Culm updates. You can withdraw this consent at any time by clicking unsubscribe in any email we send, or by emailing us directly.
• Contract — when you place an order, we process your data because it is necessary to fulfil that contract (i.e. to send you what you bought).
• Legitimate interests — we may use anonymised, aggregated data (such as which pages are visited most) to improve the website. This does not identify you personally.

How long we keep your data

Waitlist email addresses are held until you unsubscribe or ask us to delete them. We do not keep them indefinitely — once Culm has launched and the waitlist period has passed, we will contact all waitlist subscribers and give them the option to move to our regular customer list or be removed entirely.

Order data is kept for seven years in line with HMRC requirements for financial records. After that, it is deleted.

Third-party services

We use a small number of third-party services to run the website and communicate with customers. Each has its own privacy policy.

• Email marketing platform (e.g. Mailchimp or equivalent) — used to send waitlist and customer emails. Your email address is stored on their servers. We will name the specific platform here once selected.
• Stripe — payment processing when the shop is live. Stripe is PCI-DSS compliant. We do not store card details.
• Website hosting provider — may log basic access data (IP addresses, page requests) for security and uptime purposes. This is standard practice and not used for marketing.

We do not use Google Analytics or any behavioural tracking tool at this stage. If we introduce any analytics in future, we will update this policy and add appropriate cookie consent before doing so.

Cookies

At present, this website does not use tracking or analytics cookies. We may use a functional session cookie to remember your waitlist submission so you don't see the form again. This cookie contains no personal data and expires when you close your browser.

If we introduce analytics or marketing cookies in future, we will ask for your consent before setting them.

Your rights

Under UK GDPR, you have the following rights regarding your personal data. To exercise any of them, email hello@getculm.co.uk and we will respond within 30 days.

• Right to access — you can ask what personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate data.
• Right to erasure — you can ask us to delete your data. We will do so promptly unless we are legally required to retain it (e.g. financial records).
• Right to restrict processing — you can ask us to stop using your data in certain ways.
• Right to data portability — you can ask for a copy of your data in a machine-readable format.
• Right to object — you can object to us processing your data for direct marketing at any time.
• Right to withdraw consent — where we rely on consent, you can withdraw it at any time. The simplest way is to click unsubscribe in any email we send you.

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Changes to this policy

We will update this policy when our data practices change — for example, when we launch the shop, introduce analytics, or change email providers. The "last updated" date at the top of this page will always reflect the most recent version. If we make significant changes we will notify waitlist subscribers by email.

Contact

Questions, requests, or concerns: hello@getculm.co.uk. We read everything and reply to everything.