0 Basket

Privacy Policy

Last Updated: 17-Jun-2026

This privacy policy explains how What Katy Did Next collects, uses, stores, and protects your personal data when you visit our website (https://what-katy-did-next.co.uk) or place an order. Our data practices comply strictly with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (collectively, “the Data Protection Legislation”).

1. Who We Are & Geographic Sales Boundaries

What Katy Did Next operates as the data controller for your personal information. Please note that our e-commerce services, order processing, and product shipping are strictly restricted to customers residing within Great Britain (England, Scotland, and Wales). We do not sell or ship to Northern Ireland or the European Union. Consequently, cross-border EU consumer regulations do not apply to purchases made through this website.

2. Information We Collect

To fulfill your order and provide a seamless shopping experience, we must collect the following personal data:

  • Your name, email address, and phone number.
  • Your billing and delivery address.
  • Payment information relative to your transaction.
  • The specific details of the products you are ordering.
  • Any additional personal information you choose to provide directly to us (e.g., custom jewellery specifications or measurements).
  • Statistical and technical data via cookies (e.g., browser type, general location, and site interactions).

3. How Your Data Is Used & Our Lawful Basis

Under UK data protection law, we process your information under the lawful basis of Contract (to fulfill your orders) and Legitimate Interests (for secure business reporting, analytics, and customer support).

  • Names & Addresses: Used to securely pack and deliver your physical order.
  • Email Addresses: Used to send automated updates regarding your order status and tracking details.
  • Phone Numbers: Utilized only if we need to contact you urgently regarding a live order query.
  • Payment Details: Handled securely to process your transaction. All payments are processed through encrypted external payment gateways. What Katy Did Next never views or stores your credit or debit card numbers on our servers.

4. Who We Share Your Data With

We will never share, sell, or rent your personal data to third parties for marketing purposes. We only share personal data with trusted partners strictly necessary to fulfill your order, such as delivery and courier services, secure payment gateways, and regulatory authorities or accountants if legally required.

5. How Long We Retain Your Data

We retain your personal information only for as long as necessary to provide you with our services and resolve any disputes. Importantly, to comply with UK HMRC tax and accounting audit requirements, all financial transaction records (including names, addresses, and order details) are strictly retained for 6 years following the end of the financial year in which the transaction occurred.

6. Your Rights & Subject Access Requests (SARs)

As a UK consumer, you possess comprehensive legal rights over your personal data. You have the right to view, amend, restrict, or request the deletion of the personal data we hold on record.

To submit a formal “Subject Access Request” (SAR) for a copy of your records, please contact us. We will conduct a reasonable and proportionate search and respond to your request without undue delay, strictly within one calendar month of receipt. Note: In accordance with the Data (Use and Access) Act 2025, if your request is broad and we require further clarification to process it, the statutory one-month clock will be paused until we receive the necessary details from you.

7. Cookies & Embedded Content

Pages on this site may include embedded content (e.g., videos or images). Embedded content from other websites behaves exactly as if you visited the other website directly, and those sites may use their own tracking technologies.

In accordance with the Data (Use and Access) Act 2025, our website may utilize low-risk statistical and analytics cookies to monitor website performance without requiring explicit prior consent. However, you maintain the right to opt out of these statistical cookies at any time via your browser settings or our cookie management tools.

8. Mandatory Data Protection Complaints Procedure

What Katy Did Next is committed to handling data protection queries fairly and promptly. In accordance with the new statutory obligations under the Data (Use and Access) Act 2025, you have a formal right to lodge a complaint regarding how your data is handled.

Under UK law, you are required to submit your complaint directly to us in the first instance to allow for an internal investigation. We will formally acknowledge receipt of your complaint within 30 days of submission, conduct an investigation without undue delay, and provide you with a resolution outcome.

If you remain completely dissatisfied following our internal review process, you retain the legal right to escalate your complaint to the Information Commissioner’s Office (ICO) at www.ico.org.uk.

9. Contact Us

To exercise your data rights, submit a Subject Access Request, or file a data protection complaint, please contact us using the details below: