1. Who we are
ISLANDER EDINBURGH LTD, trading as Islander UK, is the organisation responsible for the personal information covered by this policy, including our online shop and workshops. Our company number is SC731424. Our registered office is 11a Bankhead Crossway North, Edinburgh, Scotland, EH11 4DT, United Kingdom.
For privacy enquiries or to exercise your data protection rights, email service@islanderuk.com or write to us at our registered office, marked Privacy.
2. Information we collect
Contact and account information: your name, email, telephone number, billing and delivery addresses, account details and communication preferences.
Shopping and booking information: products, workshop location and date, participants, purchases, transaction references, payment status, delivery, returns and refunds.
Enquiries and applications: messages, order references, private-event requirements, preferred dates, group size, and business and contact details in stockist applications.
Information you choose to submit: newsletter and stock-alert requests, reviews, ratings, images and messages sent through email, forms or support chat.
Technical and interaction information: IP address, browser, device, language, approximate location, referring pages, searches, pages and products viewed, clicks, scrolling, form interactions, active engagement time and shopping or booking activity.
Identifiers and preferences: cookies, browser and session identifiers, workshop test assignments, consent choices and records used for security and error detection.
We collect information from you, from your use of the website and from providers involved in payments, bookings, delivery and support. The information collected depends on the service, its settings and your choices. Our online store uses Shopify, which receives order and customer information needed to provide the store and checkout.
Payments are processed by the payment providers available at checkout. Information handled depends on your chosen method. Please do not put payment-card details or unnecessary sensitive information in chat, reviews or enquiries.
3. Why we use information
Where UK or European data protection law applies, we need a legal basis for processing personal information. Our principal purposes and bases are:
Why we use your information
Scroll across the table to read all columns.
| Purpose | Legal basis |
|---|---|
| Process purchases, workshop bookings, delivery, returns and refunds | Performance of a contract, or steps you request before entering a contract. |
| Respond to enquiries and event or stockist applications | Steps requested before a contract; otherwise our legitimate interest in responding and providing support. |
| Provide accounts and requested website features or stock alerts | Performance of a contract or our legitimate interest in providing the requested service; consent where required. |
| Protect services, prevent fraud and investigate misuse | Our legitimate interests in protecting customers and our business; legal obligations where applicable. |
| Keep accounting records and meet legal requirements | Compliance with legal obligations. |
| Optional analytics, workshop outcome measurement and advertising | Consent where required by applicable law. |
| Send marketing emails | Consent or another basis permitted by applicable direct-marketing rules. |
Our legitimate interests include running a reliable and secure business and providing customer support. We balance those interests against your rights and reasonable expectations. Permission to store or access information on your device is a separate requirement from the legal basis for subsequent use of personal information. Section 5 describes the workshop assignment storage that currently operates separately from analytics consent.
Where information is needed to fulfil an order, booking or service you request, we may be unable to provide that service without it.
4. Analytics and advertising
Google services
We use Google Analytics to understand how people use our website and to improve it. Measurement covers browsing, searches, product and form interactions, cart and checkout activity, purchases and active engagement. We analyse permitted event data in Google Cloud BigQuery and use GrowthBook for workshop experiment analysis.
Our Google configuration includes Google Signals, advertising personalisation and connections to Google advertising and merchant services. Subject to relevant permissions and Google account settings, permitted activity can be combined with information from signed-in Google accounts for audience analysis, advertising measurement and personalised advertising. Google and other advertising providers may use their own cookies or identifiers alongside our first-party identifiers.
The configuration also enables Google’s user-provided data feature. Where permitted customer information is supplied, Google can use a hashed representation for matching and measurement. Hashing does not necessarily make the information anonymous.
Google information about data from partner sites
Google advertising choices in My Ad Center
Microsoft Clarity and TikTok
Microsoft Clarity supports interaction statistics, heatmaps and session playback. It processes interaction and technical information such as clicks, scrolling, navigation, page content, device and browser information. Its consent mode can send limited cookieless information when analytics storage is denied. With permission, identifiers can connect activity. Advertising permissions also affect Microsoft’s advertising-related use.
TikTok website measurement helps measure advertising and conversions. With the relevant permissions, it processes identifiers, device and browser information, pages viewed and shopping or conversion activity to measure campaigns and support advertising audiences.
Declining optional cookies does not stop every technical request. Website operation, security, external content and some provider consent modes can generate requests without the corresponding analytics or advertising cookies. Information without cookies is not automatically anonymous.
5. Workshop page testing and booking
We compare workshop page designs to understand how they affect exploration, use of booking tools and booking outcomes. A test may compare more than two versions.
The first-party islander_workshop_assignment cookie stores a random browser identifier and the assigned page version. It helps keep that version consistent on return visits in the same browser. The cookie itself does not contain your name or email address. It lasts for 30 days and is renewed on eligible visits to the main workshop page.
In the current setup, page assignment storage operates separately from analytics permission. It can be set before a cookie choice and remain after analytics is declined. This behaviour applies across countries. Use Page test preferences on the workshop page to turn off assignment storage. That removes the assignment cookie and remembers your setting in islander_workshop_optout for one year. The page and booking service remain available.
With analytics permission, we measure relevant workshop clicks, city selection, story or Skip Animation interactions, content and booking-tool views, active engagement and attributable booking and revenue outcomes. Valid experiment and page-version details can be added to interaction events. Date or time selections are measured only where reliable booking-service signals support them; a calendar view is not treated as a selection.
FareHarbor provides the workshop calendar and booking service and processes the booking details you submit. Booking links can carry a reference identifying the page version. Where analytics permission applies, browser, session, experiment and transaction identifiers can support attribution between the website and the booking journey. These records are not necessarily anonymous.
FareHarbor’s embedded tools use technical, diagnostic, feature-configuration and measurement services. Its booking flow also loads Stripe payment and security technology. Processing for which it is independently responsible is explained in its privacy notice. Page test preferences do not grant or withdraw analytics or advertising permission. Clearing storage, changing browsers or starting a new private-browsing session can remove saved assignments and choices.
6. Customer support and AI assistance
We use the contact details, messages and relevant order or booking information you provide to answer enquiries and resolve issues. OpenCX provides our AI-assisted support chat, alongside our support team. Technical requests can occur when the chat component loads, before a message is sent.
We do not use your chat conversations to train AI models. Routine AI chat transcripts are retained for six months under our retention schedule. If a conversation becomes part of a complaint, order issue or legal matter, the relevant record may need to be kept for the corresponding period in section 10.
An additional Microsoft Brand Agents component currently loads on the website and receives connection and technical information when it loads. OpenCX is the assistant we use for customer support.
Automated responses may be incomplete or incorrect. Please avoid unnecessary sensitive information. Email service@islanderuk.com if you want staff help or need to question an automated response. We do not make decisions with legal or similarly significant effects on you solely through automated processing without staff involvement.
7. Marketing and website features
We use our own internal platform to send marketing emails about products, workshops, news and offers, in line with your preferences and applicable marketing rules. Unsubscribe through a marketing email or contact service@islanderuk.com. Necessary order, booking or support messages are separate and can continue after a marketing unsubscribe. Requested stock alerts are separate from general marketing.
We do not currently send SMS marketing or abandoned-cart reminder emails. Judge.me and Trustpilot do not send email review invitations on our behalf. If we introduce new activities, we will update the relevant information and obtain permission where required.
Judge.me provides product review features and processes review content, ratings, widget interactions and relevant technical identifiers. We also link to Trustpilot and other external review sites. Information you publish in a review can be visible to others; external review services apply their own privacy notices when you visit or submit content there.
Shopify Forms and hCaptcha support enquiry and application forms and help prevent automated misuse. Shopify Forms also uses browser storage to manage form sessions and visit state. Judge.me uses local storage for review-widget interaction state. Store maps use OpenStreetMap; social content uses Instafeed or NFCube. External libraries, fonts and media services, including Uploadcare, can receive IP address, browser information and request context when content loads.
8. Who receives information
Recipients include Shopify and relevant Shop services, chosen payment providers, FareHarbor, Google Analytics and Google Cloud, GrowthBook, Google advertising services, TikTok, Microsoft Clarity and Brand Agents, OpenCX, Judge.me and the website feature and content providers described above. External review and social services receive information when you use their services or follow their links.
We also share information as needed with delivery, fulfilment, support, operational, accounting and professional-service providers. We may disclose information to authorities where legally required, to investigate misuse or handle claims, or in connection with a business transfer subject to appropriate protections.
Some providers process information on our instructions. Others also process information for their own purposes under their own privacy notices. Their role depends on the service and the processing involved.
9. International processing
Our providers may process information outside the United Kingdom or European Economic Area, including in the United States. Where transfer restrictions apply, appropriate protection is required. Depending on the provider and destination, this can be an applicable adequacy decision or approved contractual safeguards, such as standard contractual clauses with the relevant UK transfer terms.
Contact service@islanderuk.com for information about the arrangements relevant to your data and how to obtain a copy of applicable safeguards.
10. How long do we keep information
Our retention schedule uses the periods and criteria below. We retain only the information needed for the relevant purpose. Legal obligations, disputes, fraud investigations or preservation requirements can justify longer retention of relevant records.
Our retention schedule
Scroll across the table to read all columns.
| Information | Retention period or criterion |
|---|---|
| Necessary order, booking, invoice and accounting records | Six years after the end of the relevant financial year, or longer where legally required. |
| General support enquiries | Two years after the enquiry is closed. Relevant transaction or legal records follow their own period. |
| Routine AI chat transcripts | Six months, unless relevant material needs to be retained for a related support, transaction or legal matter. |
| Routine security logs | 90 days; relevant records may be retained longer for an incident or investigation. |
| Marketing subscriptions | Until you unsubscribe or we no longer need the subscription. Minimal suppression information is retained as needed to honour an opt-out. |
| Accounts, stock alerts, reviews and applications | While needed to provide the feature, fulfil the request or assess the application, and for relevant follow-up or claims. Published reviews may remain until removed. |
| Google Analytics detailed data | Event-level retention is two months and user-data retention is 14 months, with the user period resetting on new activity. Aggregated reports can remain longer. |
| BigQuery analytics export tables | Event and pseudonymous-user export tables have a 60-day expiry. Separate analysis results and legally required records follow their own purpose-based retention. |
Clarity ordinarily makes session recordings available for 30 days; favourites and sampled recordings can remain for up to nine months under Microsoft’s service rules. Providers can retain separate records for their own disclosed purposes or legal obligations. Browser-storage lifetimes are listed in our Cookie Policy and are different from server-side data retention.
11. Your choices and rights
Use the cookie banner to accept, decline or select available categories when it is displayed. Workshop Page test preferences control assignment storage separately. Browser settings also allow you to remove or block storage, although this can affect shopping, accounts and booking. Contact us if you need help changing a choice. These controls affect future processing and do not automatically delete information already collected.
Depending on applicable law and the circumstances, you may request access, correction, deletion, restriction or portability of your information; object to relevant processing, including direct marketing; withdraw consent; and exercise applicable rights concerning significant automated decisions. Rights have conditions and exceptions, including retention required by law. Withdrawal does not affect processing that was lawful before it.
Email service@islanderuk.com to make a request. We may need information to verify your identity and find the relevant records. Please do not send identity documents unless we request them through an appropriate process. We respond within the timescales required by applicable law.
12. Security and complaints
We use technical and organisational measures to protect information against unauthorised access, misuse, loss and disclosure. No method of storage or transmission is completely secure. External services have their own notices for processing they control.
Please contact service@islanderuk.com with privacy concerns.
13. Changes to this policy
We update this policy when our services, processing or legal requirements change. The date above identifies this version. Where required, we provide additional notice of significant changes and obtain permission before introducing processing that requires it.