Last updated: 05/11/2026
1. Who we are and how to contact us
Mumfy's Models is operated by Mr J Mumford ("we", "us", "our"), sole trader, of 19 Stockwell Grove, Knaresborough, HG5 0LN. We are the "controller" of the personal data described here, which means we decide how and why it is used.
For anything about your data, including using any of the rights in section 8, contact us at sales@mumfysmodels.co.uk, by phone on +447799036667, or by post at the address above.
2. What we collect, why, and our legal basis
What we collect | Why we use it | Legal basis |
Order details: name, delivery and billing address, email, phone number, items ordered | To take and fulfil your order, deliver it, and handle returns, refunds and customer service | Contract |
Account details (if you sign up): name, email, password (stored encrypted), saved addresses, wishlist | To let you log in, view orders and check out faster | Contract |
Payment details: taken by PayPal / Stripe / Square. We never see or store your full card number. | To process payments and help prevent fraud | Contract; legitimate interests (fraud prevention) |
Contact form, email and phone enquiries: whatever you tell us | To reply to you and keep a record in case of follow-up | Legitimate interests (answering enquiries) |
Live chat: your messages, any name or contact details you give, plus technical data such as IP address and browser. Provided Zoho SalesIQ. | To answer your questions in real time and improve our service | Legitimate interests; consent where the chat sets non-essential cookies |
Newsletter: your email address (and name if given) | To send news and offers about our products. You can unsubscribe at any time. | Consent |
Website analytics: pages viewed, time on site, device, browser, approximate location, how you found us. We use Google Analytics. | To understand how the Website is used and improve it | Consent |
Advertising and measurement: the Meta (Facebook and Instagram) pixel records visits and actions on our Website, such as viewing a product or adding to basket, and can match them to your Facebook or Instagram account if you have one. | To measure our adverts and show relevant adverts to people who have visited the Website | Consent |
Site testing and behaviour: we use Zoho PageSense to test versions of pages and see how visitors use them, clicks, scrolling and heatmaps / session recordings. | To improve the Website and shopping experience | Consent |
Business records: invoices and transaction records | To meet tax and accounting obligations | Legal obligation |
We do not knowingly collect data from children. We do not make decisions about you using solely automated processes that have legal or similarly significant effects.
3. Cookies and similar technologies
Cookies are small text files stored on your device. Essential cookies (for example, to keep items in your basket and keep you signed in) are always on because the Website cannot work without them. Non-essential cookies (analytics, advertising and testing, listed below) are only set if you choose "Accept" on our cookie banner. You can change your choice at any time using, and you can also block or delete cookies in your browser settings. Blocking essential cookies may stop parts of the Website working.
Tool | Provider | Purpose | Typical duration |
Zoho Chat | Zoho | Live chat | session |
Essential cookies from Zoho Commerce | Zoho | Basket, sign-in, security | Session |
4. Who we share your data with
We share data only where needed, with:
•Service providers who work for us: Zoho (our website and shop platform), PayPal, Stripe, SquareUP, Royal Mail, Evri.
•Google, Meta and Zoho, for the analytics, advertising and testing described above, but only if you accept the relevant cookies. They may also use the data for their own purposes under their own policies: Google, Meta, Zoho.
•Authorities such as HMRC, the police or courts, where the law requires.
We do not sell your personal data. We do not share your newsletter email address with third parties for their own marketing.
5. Transfers outside the UK
Some of these providers (for example Google, Meta and Zoho) process data outside the UK, including in the USA. Where this happens we rely on a lawful safeguard, such as the UK Extension to the EU–US Data Privacy Framework (UK–US Data Bridge) for certified US companies, or the UK International Data Transfer Agreement or Addendum.
6. How long we keep your data
Data | Kept for |
Order and invoice records | 6 years after the end of the financial year they relate to (tax and accounting rules) |
Account details | Until you ask us to delete your account. |
Enquiries (form, email, phone) | 2 yearsafter the last contact |
Chat transcripts | 12 months |
Newsletter subscription | Until you unsubscribe |
Analytics, advertising and testing data | As set out in section 3, or the retention period set in each tool |
After these periods we delete or anonymise the data.
7. Security
All payments are handled by PCI-compliant payment providers, and card details are not stored on our systems. The Website uses SSL/TLS encryption. Access to personal data is limited to people who need it and who are required to keep it confidential. No system is completely secure, but we take appropriate technical and organizational steps to protect your data.
8. Your rights
Under UK data protection law you can ask us to:
•give you a copy of the personal data we hold about you
•correct anything that is inaccurate
•delete your data (in some circumstances)
•restrict or object to how we use it, including objecting to marketing at any time
•provide your data in a portable format, where you gave it to us and we process it by consent or contract
•withdraw consent at any time, for example through cookie settings or the "Unsubscribe" link in any newsletter. This does not affect what we did before you withdrew.
To use any of these rights, contact us using the details in section 1. We will respond within one month. There is normally no charge.
9. Complaints
If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.
10. Links to other sites
The Website links to other sites, such as our Facebook and Instagram pages. We are not responsible for their privacy practices, so please read their policies.
11. Changes to this policy
We may update this policy from time to time. The "last updated" date above shows the latest version. If we make significant changes, we will tell you clearly on the Website.