Privacy
Privacy notice
How Lapetto uses personal data, under the UK GDPR and the Data Protection Act 2018. Last updated: 12 November 2026.
Who we are
Lapetto Organic, a UK brand trading as Lapetto, is the data controller for this site. Contact: hi@lapetto.com.
What this site does today
This shop has no active accounts, and online payments are paused, so no payment or card details are collected on this site. Your bag is kept only in your own browser. If you email us to reserve a piece, we use the details in your email to reply and hold the piece for you. The newsletter and contact forms are not connected, so nothing typed into them is sent or stored.
What we collect and why
| Data | Purpose | Lawful basis |
|---|---|---|
| Name, email, delivery address, phone (if given), the pieces you order | Answering an order request, taking payment, delivering, handling returns | Contract, or steps before a contract at your request |
| Emails you send us | Answering questions, complaints and returns | Legitimate interests (customer service); contract where it is about an order |
| Order and payment records | Tax and accounting | Legal obligation |
| IP address and browser details in server logs | Serving the site securely and preventing abuse | Legitimate interests (security) |
| Bot-check signals (Cloudflare Turnstile), only when a form loads its check | Stopping automated abuse of forms | Legitimate interests (security) |
| Email address for the newsletter (when it is switched on) | Sending new colours and restocks | Consent, which you can withdraw at any time |
Cookies and browser storage
We do not use advertising or analytics cookies. Your bag is kept in your browser’s local storage (key lapetto-bag) so it survives a page reload. It stays on your device and is never sent to us; you can clear it from the bag page or your browser settings. This is strictly necessary for the bag you asked for, so no consent banner is needed. Cloudflare Turnstile may use strictly necessary storage to run its bot check.
Who we share data with
- Google (Firebase Hosting), which serves this website.
- Cloudflare, for the Turnstile bot check on forms.
- Our email provider, which handles messages sent to our lapetto.com addresses.
- Royal Mail (UK) and DHL (US and Asia), to deliver orders.
- Stripe, which will process card payments when online payments open.
We do not sell personal data and do not share it for advertising.
International transfers
Some of these providers process data in the United States or elsewhere outside the UK. Where they do, we rely on UK adequacy regulations (including the UK–US data bridge, where the provider is certified) or the UK International Data Transfer Addendum to standard contractual clauses.
How long we keep data
- Order and payment records: six years after the end of the financial year they relate to, for tax.
- Emails not linked to an order: up to two years.
- Server logs: kept by our hosting provider under its own retention schedule, typically up to 30 days.
- Newsletter: until you unsubscribe.
Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to our use of it, to data portability, and to withdraw consent at any time where we rely on consent. Email hello@lapetto.com; we reply within one month.
You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to deal with your concern first.
Other points
We do not make decisions about you by automated means alone. Our products are not aimed at children under 13. If we change this notice, we will update the date at the top.