Privacy Policy

Type of website: Ecommerce Website
Effective date: 1st day of July, 2026

www.benjaminjohnco.com (the “Site”) is owned and operated by Benjamin John Co.
Benjamin John Co is the data controller and can be contacted at:
data@benjaminjohnco.com
33 Swan Drive, Staverton, Trowbridge, Wiltshire, BA14 8UW

Purpose
This privacy notice tells you what to expect us to do with your personal information.

  1. Contact details
  2. What information we collect, use, and why
  3. Lawful bases and data protection rights
  4. Where we get personal information from
  5. How long we keep information
  6. Who we share information with
  7. Sharing information outside the UK
  8. How to complain


What information we collect, use, and why
We collect or use the following information to provide services and goods, including delivery:

  • Names and contact details
  • Addresses
  • Purchase or account history
  • Payment details (including card or bank information for transfers and direct debits)
  • Account information
  • Website user information (including user journeys and cookie tracking)
  • Information relating to compliments or complaints


We collect or use the following information for the operation of customer accounts and guarantees:

  • Names and contact details
  • Addresses
  • Payment details (including card or bank information for transfers and direct debits)
  • Purchase history
  • Account information, including registration details
  • Information used for security purposes
  • Marketing preferences


We collect or use the following information to prevent, detect, investigate or prosecute crimes:

  • Names and contact information
  • Customer or client accounts and records
  • Financial transaction information


We collect or use the following information for service updates or marketing purposes:

  • Names and contact details
  • Addresses
  • Marketing preferences
  • IP addresses
  • Website and app user journey information
  • Records of consent, where appropriate


We collect or use the following information to comply with legal requirements:

  • Name
  • Contact information
  • Financial transaction information
  • Any other personal information required to comply with legal obligations


We collect or use the following personal information for dealing with queries, complaints or claims:

  • Names and contact details
  • Address
  • Account information
  • Purchase or service history
  • Financial transaction information
  • Correspondence


Lawful bases and data protection rights
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.


Our lawful bases for the collection and use of your data
Our lawful bases for collecting or using personal information to provide services and goods are:

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

We have a legitimate interest in processing customer data to operate our online store efficiently, manage customer relationships, and ensure the smooth dispatch and delivery of orders. Processing this information is necessary for maintaining business operations, verifying transactions, and communicating essential order updates. The impact on individuals is minimal as the information collected is limited strictly to what is necessary for fulfilling purchases and providing support, and it is handled with appropriate safeguards without overriding individual privacy rights.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for the operation of customer accounts and guarantees are:

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

We have a legitimate interest in maintaining and securing customer accounts to provide a convenient, seamless shopping experience. This includes enabling customers to easily manage saved delivery details, view past orders, and access product guarantees or return requests. Using this information is necessary for account administration, user authentication, and website security, and the data processed is limited strictly to what registered users expect for account management without infringing on their privacy rights.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information to prevent, detect, investigate or prosecute crimes are:

  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

We have a legitimate interest in safeguarding our website, protecting our customers, and defending our business against fraud, cyber threats, and illegal activity. This includes screening online transactions for suspicious activity, verifying billing details to prevent unauthorised payment card use, investigating chargeback disputes, and logging network data to prevent brute-force attacks and bot abuse. Processing this data is strictly necessary to maintain a secure shopping environment, posing minimal risk to legitimate customers while ensuring store security and transaction integrity.
For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.


Our lawful bases for collecting or using personal information for service updates or marketing purposes are:

  • Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

We have a legitimate interest in promoting our products, growing our business, and keeping our existing customers informed about relevant products, special offers, and essential store service updates. We only contact existing customers with direct marketing where permitted by law (such as under soft opt-in rules for similar goods and services), and we ensure an easy, immediate option to unsubscribe or opt out is included in every marketing communication. Processing this information poses minimal risk to individuals and respects their rights and reasonable expectations.
For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.


Our lawful bases for collecting or using personal information for legal requirements are:

  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.


Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

We have a legitimate interest in resolving customer inquiries, managing returns or complaints, and providing responsive customer care. Processing this communication is necessary to address user questions, improve our service quality, investigate damaged or missing items, and handle or defend against potential disputes or claims. We only retain the information required to effectively resolve the query or dispute, ensuring data processing remains proportionate and respectful of individual privacy.
For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.


Where we get personal information from

  • Directly from you
  • Third parties:

Payment gateways and processors (such as Stripe or PayPal) providing transaction and fraud verification details; social media and social commerce platforms (such as TikTok, Instagram/Meta, or YouTube) when you place orders through social shops, interact with our direct messaging channels, or engage with our advertisements; and analytics/security providers assisting with website monitoring and threat prevention.


Where we get personal information from

  • Order, Financial & Accounting Records: Retained for 6 years following the end of the relevant financial year in compliance with statutory UK tax (HMRC) and accounting obligations.
  • Registered Customer Account Information: Retained for as long as the account remains active, or erased within 30 days following an account deletion or closure request.
  • Customer Service & Support Communications: Retained for up to 2 years following the resolution of the query or dispute to handle potential follow-ups, warranty claims, or chargeback defence.
  • Marketing & Newsletter Subscriptions: Retained until consent is withdrawn (unsubscribed) or following 24 months of continuous subscriber inactivity.
  • Website Security Logs & IP Records: Retained for 30 to 90 days for firewall monitoring, brute-force prevention, and threat detection before automated deletion.
  • Inactive Guest Checkout & Abandoned Cart Data: Retained for up to 60 days to support cart recovery before automated clearance.

For more information on how long we store your personal information or the criteria we use to determine this please contact us using the details provided above.


Who we share information with
Data processors
Website Hosting, Technical Infrastructure, Email Delivery, Analytics, and Delivery Services
This data processor does the following activities for us: These third-party service providers support our online operations by securely hosting website data and files, managing database backups and site security, transmitting transactional order confirmation and customer service emails, providing website traffic analytics to monitor site performance, and generating shipping labels for order delivery.


Others we share personal information with

  • Organisations we need to share information with for safeguarding reasons
  • Professional or legal advisors
  • Publicly on our website, social media or other marketing and information media


Sharing information outside the UK
Where necessary, we will transfer personal information outside of the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place.

  • Organisations: Third-party technical infrastructure and cloud service providers (e.g., Google LLC, Stripe Inc., automated email\/backup services)
  • Category of recipient: Cloud hosting, website analytics, email transmission, and online payment processing services
  • Country the personal information is sent to: United States and European Economic Area (EEA)
  • How the transfer complies with UK data protection law: The country or sector has been assessed as providing adequate protection to data subjects (also known as Adequacy Regulations or UK data bridge)


Where necessary, our data processors may share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.

  • Organisations: Sub-processors, cloud hosting nodes, and international infrastructure providers (e.g., Spaceship\/Namecheap Inc., Google LLC, SMTP relay infrastructure)
  • Category of recipient: Cloud database hosting, server infrastructure, analytics routing, and email transmission services
  • Country the personal information is sent to: United States and European Economic Area (EEA)
  • How the transfer complies with UK data protection law: The country or sector has been assessed as providing adequate protection to data subjects (also known as Adequacy Regulations or UK data bridge)


How to complain
If you have any concerns about our use of your personal information, you can make a data protection complaint to us:
Online: https://benjaminjohnco.com/contact-us/
Email: data@benjaminjohnco.com

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint