Privacy policy

Who we are

Lewis & Palmer Limited, trading as Clementine (“we”, “us”), is the controller of your personal data. We’re registered in England and Wales (company number 10747975), at 55 Hersham Road, Walton-on-Thames, England, KT12 1LJ, and registered with the Information Commissioner’s Office under number ZA877979.

For anything about your data, email dpo@clementineapp.co.uk.

We follow UK data protection law: the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations.

What we collect

Depending on how you use Clementine, we collect:

• When you order: your name, email address, phone number, delivery address, what you ordered and paid, and any gift note.
• If you send a gift: the recipient’s name and address, used only to deliver it. Please let them know you’ve shared their details with us.
• If you order through a friend’s link: which customer’s link it was, so we can add your free card and post her one too. She only ever sees how many friends have ordered, never who.
• Payments: handled by Stripe. We see the last four digits and expiry of your card, never the full number. If you choose to save your card, Stripe keeps it.
• In the companion app: your name, email, sign-in details, the sessions you own and play, your communication preferences, and a device token so we can send notifications if you allow them.
• When you contact us: your messages and anything you choose to tell us.
• Surveys: your answers, if you choose to take part.
• On our website: basic technical information our hosting needs (like your IP address), and, only if you accept cookies, how you use the site and which ad brought you here. See our Cookies policy.

Why we use it, and our legal basis

• To take and deliver your order, including pre-order deposits and the final bill, and to handle returns and refunds: to perform our contract with you.
• To run the companion app and give you the sessions you own: contract.
• To keep records for tax and accounting: legal obligation.
• To answer your questions, prevent fraud and keep our systems secure: legitimate interests.
• To improve our products, for example through surveys and website analytics: consent for analytics cookies; legitimate interests for surveys you choose to answer.
• To send you marketing emails, texts or notifications: only if you’ve said yes, which you choose in the companion app (consent). You can change your mind at any time.
• To show you our ads on other sites and measure them (Meta, Pinterest and others): only if you accept marketing cookies (consent).

Who we share it with

We never sell your data. We share it only with the companies that help us run Clementine, who may use it only to provide their service to us:

• Stripe — card payments, saved cards and bills (UK, EU and US).
• Royal Mail (Click & Drop) — your name, delivery address and contact details, to deliver your parcel and send tracking updates (UK).
• Google Cloud — hosts our order and customer system and the companion app’s data (region to confirm).
• Google Workspace — our email, and spreadsheets we use to manage orders (US and EU).
• Mailchimp — marketing emails and texts, if you’ve opted in (US).
• Text message provider to confirm — texts about your order or, if you’ve opted in, marketing.
• Push notification provider to confirm — notifications from the companion app, if you allow them.
• Xero — our accounting: order totals and billing names (UK, US and elsewhere).
• Netlify — hosts this website (US).
• Typeform or Google Forms — surveys you choose to answer.
• Google Analytics — website usage, only with your consent (US).
• Meta (Facebook and Instagram) and Pinterest — to show and measure our ads, only with your consent (US and Ireland). We may also advertise with Google Ads and TikTok; we’ll only use their tracking with your consent.
• Our web and app developers and designer — who may see customer data only while building or fixing our systems, under confidentiality.
• We may also share data if the law requires it, or with a buyer of our business, who would have to protect it in the same way.

Data sent outside the UK

Some of these companies store data outside the UK, mainly in the US and EU. When they do, we make sure it’s protected, using the UK’s adequacy decisions (including the UK Extension to the EU–US Data Privacy Framework) or the UK’s approved contract terms.

How long we keep it

We keep personal data only as long as we need it, or as long as the law requires:

• Orders, payments and invoices: six years from the end of the financial year they belong to, as the Companies Act 2006 and HMRC (for VAT) require.
• Emails and messages about an order: six years, the time allowed for legal claims about a contract (Limitation Act 1980).
• Companion app account: while your account is open, then deleted within 30 days of you closing it, apart from the order records above.
• Other emails and enquiries: two years after the conversation ends.
• Website analytics: 14 months, the retention setting we use in Google Analytics.
• Marketing: until you unsubscribe. After that we keep only your email address on a “do not contact” list, so we never contact you by mistake.
• Survey answers: two years, or less if they’re anonymised sooner.

Your rights

You can ask us to see the data we hold about you, correct it, delete it, limit how we use it, or send it to you or another service. You can object to us using it on the basis of our legitimate interests, and withdraw consent at any time (for example by unsubscribing, or changing your cookie settings with the “Cookie settings” link at the bottom of every page).

Email dpo@clementineapp.co.uk and we’ll reply within one month. It’s free.

If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Keeping it safe

Your data is encrypted when it’s sent to us, and only people who need it can see it, using accounts protected with two-step sign-in. No system is perfectly secure, so if you think something’s wrong, email dpo@clementineapp.co.uk straight away.

Children

You must be 18 or over to buy from us. We don’t knowingly collect data about children; if you think we have, please tell us and we’ll delete it.

Changes to this policy

We’ll update this page when anything changes, with the date at the top. If a change affects you significantly, we’ll tell you by email or in the app.