Privacy Policy

• Order & contact details: name, email, shipping and billing address, phone number (if provided) and the contents of your order.
• Payment information: processed directly by our payment providers. We receive confirmation of payment and limited details (such as the last four digits of a card) but never store full card numbers.
• Messages: information you send through our contact or bulk-enquiry forms.
• Technical & usage data: IP address, browser type and basic analytics about how the site is used.

• To process, fulfil and deliver your orders and handle returns and refunds.
• To respond to enquiries and provide customer support.
• To prevent fraud and keep the store and your account secure.
• To meet legal, tax and accounting obligations.
• To improve our products and website.

Our lawful bases are performance of a contract (fulfilling your order), our legitimate interests (security and improving our service), consent (where required, such as non-essential cookies) and legal obligation.

We share data only with service providers who help us run the store:

• Payment processors (Stripe and PayPal) to take payment securely.
• Shipping carriers to deliver your order.
• Hosting and analytics providers to operate and maintain the site.

We do not sell your personal data. We may disclose information where required by law or to protect our rights.

We use essential cookies to run the cart and checkout, and may use limited analytics cookies to understand site usage. You can control cookies through your browser settings; disabling essential cookies may stop checkout from working.

We keep order and transaction records for as long as needed to fulfil orders and to meet legal, tax and accounting requirements (generally up to 6 years), then delete or anonymise them. Enquiry messages are kept only as long as needed to resolve your request.

Some providers may process data outside your country. Where this happens we rely on appropriate safeguards such as standard contractual clauses to protect your data.

Depending on where you live, you may have the right to access, correct, delete or port your data, to object to or restrict processing, and to withdraw consent. Under the GDPR you may also lodge a complaint with a supervisory authority (in the UK, the Information Commissioner's Office). Under the California CCPA you may request access to or deletion of your personal information and are entitled not to be discriminated against for exercising those rights; we do not sell personal information.

To exercise any right, email support@johnstonesons.shop. We respond within applicable legal time limits.

Our store is intended for adults. We do not knowingly collect personal data from children under 16.

Data controller: W. JOHNSTONE & SONS LIMITED (Company No. SC251742), 23 George Street, Dumfries, United Kingdom, DG1 1EA. Email support@johnstonesons.shop · Phone +44 7307166449.