Privacy notice

Who is responsible

Stephen Meredith, trading as Pond & Pump Co., is responsible for the personal information described here. Write to The Grange, Berrington, Shrewsbury, Shropshire, SY5 6HB, email info@pondandpump.co.uk about privacy questions or to exercise your rights.

Information we use

When you contact us or place an order, we use the details you provide, such as your name, email, telephone number, billing and delivery addresses, chosen products, order history, equipment details, photographs and support messages. Our website and service providers may also process technical and security information needed to run the service, such as IP addresses, browser information and service logs. Please do not email payment card details or unrelated sensitive information.

Purposes and lawful bases

• Contract and steps you request before a contract: answering product or compatibility questions, taking payment, processing orders, sharing delivery instructions, arranging returns and providing order support.
• Legal obligations: maintaining required accounting records and meeting applicable consumer, tax and other legal duties.
• Legitimate interests: protecting our customers and service from fraud or misuse, handling complaints and legal claims, and maintaining a secure, reliable shop. We must assess those interests against your rights and use no more information than needed.

We do not plan to send optional marketing messages or use advertising tracking at launch. If this changes, we will explain the purpose and legal basis, provide the appropriate choice and update this notice first. We do not plan to make decisions about you with legal or similarly significant effects solely by automated means.

Optional analytics and consent

With your consent, we use Google Analytics to understand visits, product interest and completed sales. Google processes technical connection and browser information and the measured events. Purchase events include an order reference, product identifiers, quantities and value; we exclude contact and delivery details and private receipt-access tokens. Consent is the basis for this optional measurement. You can refuse it or withdraw it using Cookie settings without affecting your ability to shop. Google may process information internationally under the arrangements described in its privacy policy. See our cookies and storage page for lifetimes and controls.

Payments and fulfilment

We use Stripe for secure online payments. We receive the information needed to identify and reconcile a transaction, including payment status and reference. We do not store your full card number or security code. Stripe processes your payment information under its own privacy policy.

To fulfil your order, we share the necessary recipient, delivery address, contact and product details with the UK retailer or supplier dispatching it and with delivery services. They may have their own responsibilities for this information. We share only what is needed to provide the service.

Our shop uses Cloudflare for website hosting and order storage, Resend for transactional order emails, and Google Workspace for support email. Necessary recipients may also include professional advisers and authorities where disclosure is legally required. We do not sell customer information.

International processing

A supplier being based in the UK does not mean all payment, hosting or support processing takes place here. Before using a provider that transfers personal information outside the UK, we must check the destination and applicable lawful transfer arrangements, such as adequacy regulations or appropriate contractual safeguards. Contact info@pondandpump.co.uk for information about the arrangements that apply to your data.

How long information is kept

We keep information only for as long as needed for the purpose collected, taking account of outstanding orders, warranties or complaints, applicable accounting and tax obligations, legal claim periods and security needs. Different records may therefore have different retention periods. Enquiry information that is no longer needed should be deleted or anonymised. Contact us for the retention criteria relevant to your information.

Your rights

Depending on the circumstances and lawful basis, you can request access to your information, correction, deletion, restriction or a portable copy. You can object to processing based on legitimate interests. For processing based on consent, you can withdraw that consent without affecting earlier lawful processing. These rights have legal conditions and exceptions. We may need proportionate information to verify your identity.

Contact info@pondandpump.co.uk to make a request. You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint/. We would also welcome the chance to address your concern directly.

Browser storage and order status access

The basket uses localStorage. To retrieve your order status, the shop also keeps an order identifier and a sensitive access token in sessionStorage under pond-pump-live-order. The token acts as an access key to your order status. It is sent in an authorisation header for the status lookup and must not be put into a URL or shared publicly. Treat it as private; clearing this browser storage removes the saved lookup access.

Our Cookies & browser storage page explains the storage purposes and lifetimes. We update this notice when our service, providers or uses of information materially change.