Privacy Policy

Last updated: 2026

We are committed to protecting the privacy of our customers and the children who receive our personalised postal adventures. This Privacy Policy explains what personal information we collect, how we use it, the legal basis for processing it and how we keep it secure.

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable UK data protection legislation.

1. Who we are

My Pirate Pen Pal is a UK-based business providing personalised children's postal adventures through subscriptions and gift purchases.

My Pirate Pen Pal is operated as a sole trader and is the data controller responsible for the personal information processed by the business.

Website: https://mypiratepenpal.co.uk

Email: admin@mypiratepenpal.co.uk

2. Information we collect

We collect only the information reasonably necessary to process purchases, personalise our products and deliver subscriptions.

This may include:

• Parent, guardian or purchaser's name and email address.
• Billing and postal delivery addresses.
• Child's first name and age or age category.
• Subscription details and purchase history.
• Information voluntarily provided in customer enquiries.
• Relevant nursery contact information where we communicate with nurseries about our services.

We do not require children's surnames, dates of birth or other unnecessary identifying information for personalisation.

We do not intentionally collect special category personal data.

3. How we collect information

Customer information is primarily collected through Stripe, our third-party payment and checkout provider.

When purchasing a subscription, customers may provide their payment details, contact information, delivery address and personalisation details through Stripe's secure checkout environment.

We receive the information necessary to administer orders and prepare personalised postal deliveries.

We may also receive information directly when customers contact us by email or make an enquiry.

Nursery business contact information may be obtained through direct enquiries, publicly available business contact details or professional communications.

4. Our lawful bases for processing

We process personal information only where an appropriate lawful basis applies under Article 6 of the UK GDPR.

Performance of a contract — Article 6(1)(b)

This is our primary lawful basis for processing personal information relating to customers purchasing our services.

It includes processing necessary to:

• Administer orders and subscriptions.
• Personalise and prepare letters and activities.
• Arrange postal delivery.
• Communicate about purchases and subscriptions.
• Manage customer service requests and subscription changes.

Legitimate interests — Article 6(1)(f)

Where a parent or guardian purchases a subscription for a child, we process the child's limited personal information, such as their first name and age category, where necessary for our legitimate interests in delivering the personalised service requested by the purchasing adult.

We take particular care to consider children's privacy rights and minimise the information collected.

We may also rely on legitimate interests for proportionate business-to-business communications with nurseries, where permitted by applicable electronic marketing laws.

Legal obligation — Article 6(1)(c)

We may retain or process information where necessary to meet applicable tax, accounting or other legal obligations.

Where consent is legally required for optional marketing or website technologies, we will obtain it before carrying out the relevant processing.

5. Third-party payment processing — Stripe

My Pirate Pen Pal uses Stripe to securely process payments and manage subscription billing.

Stripe collects and processes payment information through its own systems in accordance with its applicable privacy notices, security measures and legal obligations.

My Pirate Pen Pal does not directly collect or store full payment card numbers or card security codes.

Depending on the processing activity, Stripe may act as a data processor on our behalf or as an independent data controller.

Stripe is responsible for meeting its own applicable data protection obligations, including those relating to its independent processing activities and the security of its systems.

My Pirate Pen Pal remains responsible for its own processing activities and for complying with its obligations when using third-party service providers.

For further information, please refer to Stripe's Privacy Policy:

https://stripe.com/gb/privacy

6. How we store and protect information

Customer information required for subscription fulfilment is maintained and locally managed offline rather than a third-party online customer relationship management (CRM) system.

We use this information to prepare personalised letters, manage deliveries and print postal address labels.

Labels are prepared and printed by us and used solely for the purpose of delivering orders.

We take reasonable technical and organisational precautions to protect personal information, including restricting access to authorised individuals and taking appropriate measures to prevent unauthorised disclosure, loss or misuse.

Payment and subscription information may continue to be stored electronically within Stripe's systems.

We do not sell customer information or make children's personal information available to third parties for advertising purposes.

7. Children's privacy

My Pirate Pen Pal is designed for children, but subscriptions and purchases are made by adults.

We do not knowingly enter into contracts directly with children.

The information collected about a child is limited to what is reasonably necessary to personalise their postal adventure, generally their first name and age or age category.

We do not use children's personal information for behavioural advertising, profiling or direct marketing.

Parents and guardians may contact us to request access to, correction of or deletion of their child's personal information, subject to applicable legal requirements and appropriate verification.

8. Sharing personal information

We do not sell or rent personal information.

Information may be shared where necessary with:

• Stripe, for payment processing and subscription administration.
• Postal and delivery providers, to fulfil orders.
• Website hosting and technical service providers, where necessary.
• Professional advisers, regulators or public authorities where required by law.

We seek to ensure that service providers processing personal information on our behalf are subject to appropriate data protection safeguards.

9. International data transfers

Some third-party providers, including Stripe, may process personal information outside the United Kingdom.

Where international transfers are subject to UK data protection requirements, appropriate safeguards must be in place, such as recognised adequacy arrangements or approved contractual protections.

10. How long we keep information

We retain customer personal information only for as long as reasonably necessary for subscription administration, fulfilment and applicable legal requirements.

Customer fulfilment records

Customer fulfilment records, including personalisation information and delivery details held in our own spreadsheet, are retained for up to 12 months after the customer's most recent purchase or the end of their subscription, whichever occurs later.

Where an additional purchase is made or a subscription continues, the retention period is calculated from the most recent relevant transaction or subscription end date.

After this period, information that is no longer required is securely deleted or disposed of.

Certain financial and transaction records may be retained for longer where necessary to comply with tax, accounting or other legal obligations.

Information held by Stripe is also subject to Stripe's applicable retention practices and legal obligations.

11. Marketing communications

My Pirate Pen Pal does not currently operate a general promotional mailing list for individual customers.

We may contact customers where necessary about their orders, deliveries, subscriptions or related customer service matters.

We may separately communicate with nurseries and educational settings about our services.

Such communications are undertaken in accordance with applicable UK data protection and electronic marketing legislation.

Where consent is required, we will obtain it before sending promotional communications.

Recipients may object to direct marketing or request that we stop contacting them at any time by emailing admin@mypiratepenpal.co.uk.

We do not use children's personal information for marketing.

12. Website analytics and cookies

My Pirate Pen Pal uses anonymised website analytics to understand general website usage and improve our services.

We do not intentionally use analytics to identify individual visitors or create personal advertising profiles.

Where analytics information is genuinely anonymous and individuals cannot reasonably be identified, it falls outside the scope of UK GDPR.

However, cookies and similar technologies may be subject to separate requirements under the Privacy and Electronic Communications Regulations (PECR).

Where consent is required for non-essential cookies or similar technologies, we will obtain it before using them.

Essential technologies may be used where necessary for website operation, functionality and security.

13. Your data protection rights

Under UK data protection law, individuals have rights concerning their personal information, subject to applicable conditions and exemptions.

These include:

• The right to be informed.
• The right of access.
• The right of rectification.
• The right to erasure in certain circumstances.
• The right to restrict processing.
• The right to object to processing based on legitimate interests.
• The right to data portability where applicable.
• Rights relating to certain automated decision-making activities.

To exercise your rights, contact admin@mypiratepenpal.co.uk.

We will respond within the timescales required by law, normally within one calendar month.

14. Complaints

If you have concerns about how your information is handled, please contact us so that we can investigate.

You also have the right to complain to the Information Commissioner's Office (ICO).

Website: https://ico.org.uk

Telephone: 0303 123 1113

15. Changes to this policy

We may update this Privacy Policy to reflect changes in our business practices, services or legal obligations.

The latest version will be published on our website with the date of the most recent update.

Where significant changes affect how personal information is processed, we will take appropriate steps to inform affected individuals.

16. Contact

For questions about this Privacy Policy or our use of personal information, please contact:

My Pirate Pen Pal

Email: admin@mypiratepenpal.co.uk

Website: https://mypiratepenpal.co.uk