Privacy Policy

Two categories of information are collected: technical information generated by visiting the site, and information supplied when an order is placed or an enquiry is sent.

Technical information comprises the device and browser type, an approximate location derived from the IP address, the pages viewed and the path taken between them. It does not identify an individual by name.

Order information comprises the name, email address, delivery and billing addresses, a contact telephone number where the carrier requires one, the items purchased and the payment result returned by the processor.

Correspondence sent to Thread & Tweed is filed against the relevant order so that a later enquiry can be answered without the customer repeating the history.

No special category information, such as health data or biometric data, is collected, and no information is collected about a customer's ethnicity, religion or political opinions.

Where a field is marked as optional at checkout, it may be left blank without affecting the order. Fields that are required are marked as such.

Order information is used to take payment, dispatch the order, provide delivery updates, handle returns and meet accounting obligations.

Technical information is used to operate the site, detect unusual activity that may indicate fraud and understand, in aggregate, which pages are read.

Correspondence is used to answer the enquiry and, where it relates to an order, to maintain a record of what was agreed.

Information is not used to build advertising profiles, and it is not sold. Each category is held against one of the purposes listed above rather than retained on the chance that it becomes useful.

Where information is used on the basis of consent rather than on the basis of performing a contract, that consent may be withdrawn at any time, and the withdrawal applies to future use rather than to anything already done.

A written record is kept of the purpose for which each category of information is held, so that a specific answer can be given if the question is asked.

The site sets a small number of cookies and equivalent browser storage keys. These fall into two categories.

The analytics identifier is a random value rather than a name or email address, and it is not joined to an order record. Campaign visits are recorded in aggregate without building a profile that follows a customer to other websites.

Blocking cookies in the browser is possible. Doing so does not prevent the site from being read, but the basket will not survive navigation between pages, and the checkout cannot be completed without essential storage.

Where a customer returns to the site, the analytics identifier may recognise the browser as a previous visitor. That recognition is statistical rather than personal, and it is not used to serve advertising or to alter prices.

Information is disclosed only to parties required to complete a transaction, and only to the extent required.

The recipients are the payment processor that authorises the card, the delivery carrier that transports the consignment, the hosting provider that serves the site and the service that sends confirmation emails.

Each recipient is given the minimum necessary for its role. The carrier receives the delivery address and a contact number, not payment details; the processor receives payment information, not order history beyond the amount.

Where a supplier is replaced, the replacement is subject to the same restriction. Information is released to a public authority only where legally compelled, and the customer is informed unless prohibited from doing so.

Before appointing any supplier that receives order data, Thread & Tweed establishes what that supplier does with the data and how long it is kept, and records the answer. A supplier that cannot meet the required standard is not appointed.

Suppliers are bound by contract to process information only on instruction and to apply appropriate security measures.

Order records, including the delivery address and the items purchased, are retained for seven years to satisfy tax and accounting requirements.

Support correspondence is retained for two years, which allows a repeated question to be answered without keeping a permanent record of every message.

Analytics data is retained in aggregate form with no route back to an individual, and a basket that is never ordered is cleared automatically after a short period.

When a retention period expires the record is deleted rather than hidden, and it is not left in a secondary system that is no longer reviewed.

Where an account is closed, the order records that accounting rules require are separated from everything else, so that the retained portion contains only what the law demands.

Retention periods are reviewed periodically to confirm that the periods stated here remain accurate.

Where a legal claim is ongoing, the records relevant to that claim are retained until it concludes, and the customer is informed if that affects the deletion of information they have asked to be removed.

Traffic to the site is encrypted in transit, so information entered by the customer cannot be read on the network between the browser and the server.

Card details are entered on the processor's hosted page and never reach Thread & Tweed systems or log files.

Access to order data is restricted to the small team that packs and supports orders, each using an individual account rather than a shared credential. Access is removed on the day a person ceases to work with Thread & Tweed.

Backups are encrypted and are not reachable from the public internet. No system is perfect, and any breach affecting customer data would be reported to the individuals concerned with an explanation of what occurred.

Unusual patterns, such as numerous failed payments from a single address, are monitored because they usually indicate card testing rather than genuine customer activity.

Security measures are reviewed periodically, and any incident affecting customer information would be investigated and, where required, reported to the relevant authority as well as to the individuals concerned.

The following rights may be exercised without charge:

No reason needs to be given for exercising any of these rights, and a request will not be treated as a complaint or result in any reduction in service.

Where a request cannot be granted in full, the rule that prevents it will be identified and the options available will be explained, rather than a bare refusal being issued.

Requests may be submitted by email to support@yvetteus.shop. Identity may be verified before information is released or deleted, in order to prevent disclosure to an unauthorised third party.

Requests are handled by the same small team that answers order enquiries, so a question about data is dealt with by someone who can already see the relevant order record rather than being passed between departments.

The site is intended for adults. Information is not knowingly collected from a child under 13, and advertising is not directed at children.

Where an item is purchased for a child, the order is placed by an adult and the contact details held are those of that adult.

A parent or guardian may exercise any of the rights set out above on a child's behalf, and any information found to have been supplied by a child will be deleted on request.

Photographs supplied in connection with a sizing or fitting enquiry are used only to answer that enquiry. They are not published, used in advertising or disclosed to any other party.

No competitions, newsletters or accounts directed at children are operated, and no age is requested during checkout.

Where a product page states an age range, that guidance concerns the safe use of the item rather than who may purchase it.

Requests and questions concerning this policy should be sent to support@yvetteus.shop with the word privacy in the subject line, together with a statement of what is being requested.

A response is provided within one working day, and formal requests are answered within 30 days. Where a request is complex, the customer is told why it is taking longer rather than the deadline passing in silence.

Identity may be verified before information is released or deleted, in order to prevent a third party obtaining it by impersonating the customer.

Where a request cannot be granted, the rule preventing it is identified and the available options are explained.

A request does not need to be phrased in any particular way. A short email stating what is wanted is sufficient, and any further detail required will be requested in reply.

Where a customer is dissatisfied with the response, they may ask for the matter to be reviewed, and will be told who considered the original decision.