Privacy policy
Last updated: 28 July 2026
Who we are
Purl is a trading name of Jayraj Rathod, a sole trader based at 25A Chichester Way, Feltham, London TW14 0DF, United Kingdom. We are the data controller for the personal information described in this policy. You can reach us at any time at jairajaiservices@gmail.com.
What we collect
When you place an order: your name, email address, delivery and billing address, phone number if you provide one, and details of what you ordered. Payment card details are handled directly by our payment provider. We never see or store your full card number.
When you contact us: your email address and whatever you tell us in your message.
When you sign up for marketing emails: your email address.
When you leave a review: your name (or the display name you choose) and your review content.
When you browse the site: your IP address, device and browser type, pages viewed, and how you arrived. Some of this is collected through cookies and similar technologies, and only with your consent where the law requires it.
Why we use it, and our lawful basis
To process and deliver your order, send order confirmations and tracking, and handle returns or refunds. Lawful basis: performance of our contract with you.
To answer your questions and provide support. Lawful basis: performance of our contract, or our legitimate interest in running a responsive business.
To keep accounting and tax records. Lawful basis: legal obligation.
To detect and prevent fraudulent orders. Lawful basis: our legitimate interest in protecting the business, and legal obligation.
To send marketing emails about products and offers. Lawful basis: your consent, or the soft opt in where you have bought from us before. You can withdraw this at any time using the unsubscribe link in any email, or by emailing us.
To measure how our website and adverts perform, and to show relevant adverts. Lawful basis: your consent, given through our cookie banner.
Who we share it with
We only share what is necessary, and only with organisations that process data on our behalf under contract:
Shopify, which hosts our store and processes payments and orders.
CJdropshipping, our fulfilment partner, who receive your name, delivery address and contact details so they can pack and ship your order.
Judge.me, which collects and publishes product reviews and sends review request emails.
Essential Upsell, which powers product recommendations on our site.
TikTok, which provides advertising measurement through a tracking pixel, where you have consented to it.
Our email provider, which sends order notifications and marketing emails.
We may also disclose information where we are legally required to, for example to HMRC or to law enforcement acting under proper authority.
We do not sell your personal information.
International transfers
Our fulfilment partner CJdropshipping operates warehouses outside the United Kingdom, including in China. To deliver your order we transfer your name, delivery address and contact details to them. This transfer is necessary to perform our contract with you. Where a transfer is made to a country without a UK adequacy decision, we rely on appropriate safeguards such as standard contractual clauses.
Shopify and some of our other providers also process data outside the UK, subject to equivalent safeguards.
How long we keep it
Order and transaction records: six years after the end of the relevant tax year, because HMRC requires us to keep business records for that period.
Customer support emails: up to two years after the matter is resolved.
Marketing list: until you unsubscribe, and then we keep a minimal suppression record so we do not email you again by mistake.
Reviews: for as long as the review is published, unless you ask us to remove it.
Website analytics data: as set by each provider, typically no more than 26 months.
Your rights
Under UK data protection law you have the right to:
Ask for a copy of the personal data we hold about you.
Ask us to correct anything that is wrong.
Ask us to delete your data, where we have no ongoing lawful reason to keep it. Note that we cannot delete order records we are legally required to retain for tax purposes.
Ask us to restrict how we use your data, or object to processing based on legitimate interests.
Ask us to transfer your data to you or another provider in a machine readable format.
Withdraw consent at any time, where our processing is based on consent. This does not affect anything we did before you withdrew it.
To exercise any of these, email jairajaiservices@gmail.com. We will respond within one month. There is no charge.
Cookies
We use cookies that are strictly necessary for the site to work, such as remembering what is in your basket. These do not require consent.
We also use analytics and advertising cookies, including the TikTok pixel, which we only set if you accept them through our cookie banner. You can change your choice at any time using the Cookie preferences link in the footer.
Marketing
If you have consented, or if you have bought from us before, we may email you about products, offers and filter refill reminders. Every email has an unsubscribe link, and we act on it immediately. You can also email us to opt out.
Security
Payments are processed over encrypted connections by our payment provider, and we never store your full card details. We limit access to personal information to what is needed to run the business. No system is perfectly secure, but if a breach ever put your rights at risk we would tell you and the Information Commissioner's Office as required.
Children
Our products are not aimed at children and we do not knowingly collect data from anyone under 16. If you believe a child has given us their data, email us and we will delete it.
Complaints
If you are unhappy with how we have handled your personal data, please tell us first at jairajaiservices@gmail.com and we will try to put it right.
You also have the right to complain to the Information Commissioner's Office:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk
Changes to this policy
We may update this policy as our business or the law changes. The version published on this page is the one that applies. This version is dated 28 July 2026.