Privacy policy
Last updated: 13/10/2026
Introduction
Welcome to Pith and Stem. We value your privacy as much as you do. This policy explains how Pith & Stem Ltd (the “Data Controller”) handles your personal info on this website in line with UK data protection laws (UK GDPR). If you live in the European Union or the United States, the two extra sections near the end of this policy apply to you as well.
Please read it carefully. By using our website or giving us your personal data, you agree to this policy.
Who we are
Pith & Stem Ltd
Unit 8, Rawmec Industrial Park,
Plumpton Road, Hoddesdon, Hertfordshire
EN11 0EE, United Kingdom
Email: info@pithandstem.com
Phone: 020 4634 8810
How we use your data
By law, we must have a “lawful basis” to handle your data. We use:
- Contract: To get your orders to your door and provide your warranty.
- Legitimate Interests: To keep our website secure and improve our products.
- Consent: When you say “yes” to our marketing emails or non-essential cookies.
- Legal Duty: For things like tax and keeping records for the government.
What information we collect
We collect the basics to make things work: your name and contact info (address/email/phone number), the details of what you order, and technical info like your IP address and how you use our site. Payment information is processed securely by trusted third-party payment providers and is not stored directly on our systems.
If you upload your own picture to be printed as the artwork on your DropTop, we keep that picture with your order so that we can print it. It is deleted 30 days later.
Our website is run on Shopify
Our shop is hosted by Shopify, which stores your order and account details on our behalf and helps us take payments safely and prevent fraud. You can read how Shopify handles personal data at privacy.shopify.com.
International data transfers
Some of our tools (like Shopify, Google or Meta) are based outside the UK. We only send your data to them if they meet strict UK security standards or use approved UK International Data Transfer Agreements (IDTA) to keep your info safe. For data about customers in the European Union we rely on the European Commission’s Standard Contractual Clauses, or on a decision that the country receiving the data gives adequate protection.
How long we keep your data
- Order Records: We keep these for 10 years. Why? Because our DropTop™ desks have long-term warranties, and we need to be able to help you if something happens years later.
- Marketing Data: We keep this until you unsubscribe or if we haven’t heard from you in 2 years.
Your rights
You are in control. You have the right to:
- See what data we have about you.
- Fix anything that is wrong.
- Ask us to delete your data or stop using it.
- Take your data to another service.
- Complain to the ICO (the UK’s data watchdog) if you aren’t happy with us.
- Withdraw consent at any time where we rely on your consent to process data.
To use any of these rights, email info@pithandstem.com. We may need to check who you are before we act on a request.
Cookies & your choice
Cookies help our site run smoothly. We categorise them so you can choose what you allow:
- Essential: Needed for the site to work (like your shopping cart).
- Analytics: Help us see what’s popular on our site.
- Marketing: Used to show you relevant ads on other sites.
Note: If you are in the UK or Europe, we will not use Analytics or Marketing cookies unless you click “Accept” on our banner. Wherever you are, you can also manage or disable cookies through your browser settings.
| Cookie | Provider | Category | Duration | Purpose |
|---|---|---|---|---|
| _tracking_consent | Shopify | Strictly Necessary | 1 year | Stores your cookie consent preferences. |
| cart / cart_currency / cart_sig | Shopify | Strictly Necessary | 2 weeks to 3 months | Enables shopping cart and checkout functionality. |
| localization | Shopify | Strictly Necessary | 1 year | Remembers your country and language. |
| secure_customer_sig / _shopify_essential / keep_alive | Shopify | Strictly Necessary | Session / 1 year | Keeps you signed in and keeps checkout secure. |
| shopify_client_id / _shopify_y / _shopify_s / _landing_page / _orig_referrer | Shopify | Analytics | 30 minutes to 1 year | Tracks visitor behaviour and how visitors arrived at the website. |
| _ga / _ga_* | Google Analytics | Analytics | 1 year | Tracks visitor behaviour and website performance. |
| __kla_id | Klaviyo | Marketing | 2 years | Links your visit to our emails, if you have signed up for them. |
| _fbp | Meta (Facebook) | Marketing | 3 months | Tracks conversions from Meta advertising campaigns. |
| _gcl_au | Google Ads | Marketing | 3 months | Measures ad conversions and campaign effectiveness. |
| IDE / test_cookie | Google DoubleClick | Marketing | 1 year / 15 minutes | Displays relevant advertisements and measures campaign performance. |
| _pin_unauth | Marketing | 1 year | Measures visits and purchases from Pinterest advertising. | |
| TW_* (stored in your browser, not a cookie) | Triple Whale | Marketing | Until you clear your browser data | Records the pages and products you view so we can see which adverts and channels lead to orders. |
Some third-party providers (including Shopify, Google, Meta, Pinterest, Triple Whale and Klaviyo) may process personal data outside the UK. Where this occurs, we ensure appropriate safeguards are in place in accordance with UK data protection laws.
Third-party providers
We may share limited personal data with trusted third parties including:
- Payment processors
- Delivery and logistics providers
- Website analytics providers
- Advertising and marketing platforms
- Customer support and hosting providers
These providers only process personal data on our behalf where necessary and under appropriate contractual safeguards.
Extra details
- Profiling: We use cookies to show you products you might like, but we don’t use “robots” to make legal decisions about you.
- Children: Our website and products are not intended for children, and we do not knowingly collect personal data from children.
- Data Breaches: If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify affected individuals and the ICO where legally required.
If you live in the European Union
The EU’s data protection law (the GDPR) gives you the same rights as the ones listed under “Your rights” above, and we treat your data to the same standard. As well as contacting us, you have the right to complain to the data protection authority in your own country. You can find yours on the European Data Protection Board’s list.
If you live in the United States
We do not sell your personal information for money. Like most online shops, we do share some information collected by cookies with advertising partners so that we can show you relevant ads on other sites. Some US state privacy laws call this a “sale” or “sharing” of personal information, or “targeted advertising”. Depending on the state you live in, you may have the right to opt out of it, as well as the right to see, correct and delete the information we hold about you.
You can opt out at any time on our Your Privacy Choices page. If your browser sends the Global Privacy Control signal, we treat that as an opt-out request automatically. For any other request, email info@pithandstem.com. We will never treat you differently for using these rights.
Changes to this policy
We may update this policy from time to time. Changes will be posted on this page. Please check back regularly.
Accessibility
We are committed to ensuring our website and Privacy Policy are accessible to all users, including individuals with disabilities.
If you have any trouble accessing our website or require this document in an alternative format, please contact us at info@pithandstem.com.
We continuously work to improve accessibility and welcome feedback from users. If you encounter any difficulties using our website, we will do our best to address them promptly.
Contact us
Got questions? Just email our Data Privacy Lead at info@pithandstem.com.