Privacy Policy

Last updated: August 2026

Fledglings Online CIC respects your privacy and is committed to protecting your personal information. This privacy notice explains what information we collect, why we collect it, how we use and protect it, who we may share it with, how long we keep it and your rights under UK data protection law.

1. Who we are

Fledglings Online CIC is the data controller responsible for the personal information described in this notice.

If you have questions about this privacy notice, wish to exercise your data protection rights or wish to make a complaint about how we have handled your personal information, please contact us at enquiries@fledglings.org.uk.

2. Personal information we collect

Depending on how you use our website and services, we may collect:

your name;
billing and delivery addresses;
email address;
telephone number;
customer account and login information;
order and transaction information;
products you have purchased, returned or enquired about;
correspondence and information you provide when contacting us;
marketing preferences;
subscription information where relevant;
information provided when submitting a product review;
information used to prevent and investigate fraud;
technical information about your device, browser and use of our website;
cookie, analytics and advertising information where the relevant technology is used and the required consent has been given;
information provided when using Poppy Helper; and
information provided when claiming VAT relief.

We do not receive or store your full payment card details. Payments are processed through the payment services made available through our ecommerce platform and payment providers.

3. VAT relief and disability information

Some products supplied by Fledglings may qualify for VAT relief when the relevant conditions are met. When VAT relief is claimed, we may collect the eligible person's name and address, order details, condition or disability, details of the person making the declaration, contact information, and the declaration and date.

Information about a person's condition or disability is special category health information under UK data protection law and receives additional protection.

We use this information to assess, administer and record eligibility for VAT relief and to maintain appropriate evidence supporting the VAT treatment of eligible supplies. For the condition or disability information, we rely on explicit consent as our Article 9 condition. Our processing and retention of the associated VAT records may also be necessary to comply with legal and taxation obligations.

VAT eligibility information is stored within our Shopify environment. Access is limited to authorised Fledglings staff who require access to customer records as part of their work. All current Fledglings staff undertake customer service duties and are required to treat health and disability information as confidential.

We do not use VAT disability information for marketing and do not routinely disclose it to delivery companies or direct-dispatch suppliers.

VAT eligibility records are retained in line with applicable VAT record-keeping requirements and our retention arrangements. If you withdraw explicit consent, we will stop processing that continues to depend solely on consent, but we may still need to retain information where the law requires or permits us to do so.

4. How we use personal information and our lawful bases

Orders and customer accounts

We use your information to process and fulfil orders, administer payments, arrange delivery, manage customer accounts, handle returns and refunds, and provide customer service. We generally rely on contract, including steps taken at your request before entering into a contract.

Legal and regulatory requirements

We may process and retain information where necessary to comply with our legal obligations, including accounting, taxation, VAT and applicable product or regulatory requirements.

Customer enquiries

We use information submitted through our contact form, email or other communications to respond to you. Depending on the circumstances, we rely on steps before entering into a contract or our legitimate interests in responding to customers and operating our service.

Please avoid including unnecessary medical or other sensitive information in a general enquiry.

Business administration, security and fraud

Where appropriate, we rely on our legitimate interests to operate and protect our business, maintain security, prevent and investigate fraud, resolve disputes, improve customer service and maintain appropriate business records.

Marketing

Where required, we rely on consent to send electronic marketing. Our marketing sign-up is not pre-ticked. You can unsubscribe at any time using the unsubscribe link in a marketing email or by contacting us.

We may retain limited information on a suppression list after you unsubscribe so that we continue to respect your choice and do not accidentally add you back to marketing communications.

5. Cookies, analytics and advertising

Our website uses cookies and similar storage and access technologies. Strictly necessary technologies may be used without consent where permitted by law. For technologies requiring consent, our cookie controls allow visitors to accept, decline or manage their preferences.

We use Google Analytics to help us understand how visitors use our website and Google Ads to help us measure and manage online advertising. Where consent is required, these technologies should not be used until the relevant consent has been given.

You can change your cookie choices using the cookie preference controls available on our website.

6. Poppy Helper and artificial intelligence

Our website includes Poppy Helper, an AI-assisted service designed to help visitors find information and guidance about Fledglings products and services.

When you use Poppy Helper, we may process your IP address and the text of your question. Your question and Poppy's response are retained within our UK-hosted system for up to 30 days.

Poppy does not ask you to provide your name, email address, postal address or other information that directly identifies you. Please do not include unnecessary personal information in your question.

Because Poppy uses a free-text question box, you may choose to include information about yourself or another person. This could include information concerning health, disability or other sensitive matters. Please provide only information that is reasonably necessary for your question.

Poppy uses the OpenAI API to generate its response. Only the text of your question is sent to OpenAI for this purpose. Your IP address is not sent to OpenAI.

Poppy is developed internally by Fledglings Online CIC and is hosted on UK-based servers provided by our hosting provider. Authorised Fledglings staff may access stored questions and responses where reasonably necessary for support, administration, security or improvement of the service.

We do not use information submitted through Poppy for direct marketing.

7. Who we share information with

We do not sell your personal information.

We may share the minimum information reasonably necessary with organisations that help us provide our services. These include:

Shopify for our online shop, checkout and customer accounts;
Omnisend for email marketing;
Google for analytics and advertising where the relevant consent has been given;
OpenAI for processing the text of questions submitted through Poppy Helper;
our UK hosting provider for hosting internally developed Fledglings systems;
Royal Mail and DPD for deliveries;
direct-dispatch suppliers where a supplier sends an order directly to you; and
providers of relevant ecommerce functions such as reviews, subscriptions, digital products, fraud prevention, backups and shipping.

For direct-dispatch orders, we normally provide the supplier with the customer's name, delivery address and telephone number where required for delivery. We do not routinely provide direct-dispatch suppliers with customer email addresses.

We may also disclose information where necessary to professional advisers, insurers, regulators, HM Revenue & Customs, law enforcement agencies, courts or other authorities where required or permitted by law.

8. International transfers

Some technology providers we use operate internationally or use systems outside the United Kingdom. Where personal information is transferred outside the UK, we take steps to ensure that the transfer complies with UK data protection law, for example through UK adequacy regulations or appropriate contractual or other recognised safeguards.

We do not treat your acceptance or use of this privacy notice as consent to international transfers.

9. How long we keep information

We do not keep personal information for longer than reasonably necessary. Retention periods depend on why information was collected, legal and taxation requirements, customer service needs, product safety, disputes and legal claims.

Order and transaction records are generally retained in accordance with applicable accounting and VAT requirements and are then reviewed for deletion or anonymisation where no longer needed. VAT eligibility declarations are retained in accordance with applicable VAT record-keeping requirements.

Customer accounts are retained while active and are subject to periodic review. Marketing information is retained while you remain subscribed; limited suppression information may be retained after an unsubscribe to ensure that your preference continues to be respected.

Poppy Helper questions and responses are retained within our UK-hosted system for up to 30 days.

We maintain an internal data retention schedule and review information that is no longer required.

10. Security

We take appropriate technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, loss or destruction. Access to customer information is limited to authorised staff who require it for their work.

We maintain procedures for responding to suspected personal data breaches. No internet-based system can be guaranteed to be completely secure, but we take reasonable and proportionate measures to protect information entrusted to us.

11. Children and information provided for others

Our products include products intended for children and young people, but our website is an online retail service. Parents, carers and other responsible people may purchase products or provide information on behalf of a child or another person.

Where you provide personal information about another person, please provide only information reasonably necessary for the relevant purpose and ensure you are entitled to provide it.

We do not knowingly use children's personal information for behavioural advertising or similar profiling.

12. Your data protection rights

Depending on the circumstances, you may have rights to:

ask for a copy of the personal information we hold about you;
ask us to correct inaccurate or incomplete information;
ask us to erase your information in certain circumstances;
ask us to restrict how we use your information in certain circumstances;
object to certain processing, including direct marketing;
receive certain information in a portable format where the right to data portability applies; and
withdraw consent where we rely on consent.

These rights are not absolute. For example, we may need to retain transaction or VAT information despite a deletion request where we have a legal requirement or other lawful reason to retain it.

To exercise a right, email enquiries@fledglings.org.uk. We may need to verify your identity before fulfilling a request.

13. Data protection complaints

If you are concerned about how Fledglings has collected, used, stored, shared or protected your personal information, please email enquiries@fledglings.org.uk. Please tell us what you believe has gone wrong and provide enough information for us to investigate.

We will acknowledge a data protection complaint within 30 days of receiving it. We will take appropriate steps to investigate without undue delay, keep you informed where appropriate, and communicate the outcome without undue delay.

You also have the right to raise a concern with the Information Commissioner's Office (ICO), the UK's data protection regulator. You do not have to complain to Fledglings before contacting the ICO.

14. Changes to this notice

We may update this privacy notice when our services, systems, suppliers or legal obligations change. The date at the top shows when it was last updated. Where a change is significant, we will take reasonable steps to bring it to the attention of affected people where appropriate.

15. Contact us

Fledglings Online CIC
Email: enquiries@fledglings.org.uk