Last updated: 18 October 2026
This policy explains what personal information Morgan’s Sweets Emporium collects when you visit our website, shop with us online or in store, or get in touch, and how we look after it. We keep it as short and plain as we can. If anything is unclear, please ask us.
Who we are
Morgan’s Sweets Emporium is a traditional sweet shop at 16 Boroughgate, Appleby-in-Westmorland, Cumbria CA16 6XB. Our website is morganssweetsemporium.com. Victoria Grassick, trading as Morgan’s Sweets Emporium, is the “data controller” responsible for your personal information.
For anything to do with your personal information, email us at info@morganssweetsemporium.com or write to us at the address above.
What we collect and why
When you place an order
We collect your name, billing and delivery address, email address, phone number, what you ordered and how much you paid, and any notes you add (for example a gift message). We use this to take payment, prepare and send or hand over your order, send you order and delivery emails, deal with any problems or refunds, and keep the records the law requires. Our legal basis is that we need it to carry out our contract with you, and to meet our legal (tax and accounting) obligations.
We do not see or store your full card details. Payments are handled securely by our payment providers (see “Who we share your information with”).
Click & collect
If you choose to collect from the shop, we use your name and contact details to let you know when your order is ready and to hand it to the right person.
If you create an account
You can shop as a guest, or create an account to save your details and see your past orders. Your account holds your name, email address, password (stored encrypted, so we cannot see it), saved addresses and order history. You can update your details or ask us to close your account at any time. Our legal basis is our contract with you.
Our newsletter
If you sign up to our newsletter, we collect your email address (and your name if you give it) and send you a confirmation email first. You will only receive the newsletter once you confirm. We send no more than about one email a month with shop news, new jars and what has come back into stock.
Our newsletter emails record whether they are opened and which links are clicked, so we can see what people find useful. Our legal basis for the newsletter is your consent. You can unsubscribe at any time using the link at the bottom of every email, from the “Newsletter” tab in your account, or by emailing us.
Contact, party and business enquiry forms
When you send us a message through one of our forms, we collect what you enter, such as your name, email address, phone number, event or business details and your message. The form is emailed to us so we can reply, and a copy is kept privately on our website so we can keep track of enquiries. Our legal basis is our legitimate interest in answering your enquiry, or taking steps you have asked for before entering into a contract (for example quoting for a business order).
Managing our customer records
When you browse our website
Like most websites, our web server records basic technical information such as your IP address, browser type and the pages you visit, to keep the site working and secure. Our security tools also record failed login attempts, including the IP address used, to protect accounts from being broken into. Our legal basis is our legitimate interest in running a secure, working website.
Cookies
Cookies are small files stored by your browser. We use the following:
| Cookie | What it does | How long |
|---|---|---|
| woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* | Remember what is in your basket. Essential for the shop to work. | Up to 2 days |
| wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie | Keep you logged in to your account. Essential. | Session, or up to 2 weeks if you tick “Remember me” |
| __stripe_mid, __stripe_sid | Set by Stripe, which processes our card payments, to help prevent fraud. | 30 minutes to 1 year |
| PayPal cookies | Set by PayPal if you choose to pay with PayPal. | Varies (set by PayPal) |
| mailpoet_page_view | Set by our newsletter tool to recognise newsletter subscribers who visit the site. | Up to 10 years |
| Google cookies (for example NID) | Set by Google when the Google Maps map on our Contact and About pages loads. | Up to 6 months |
You can block or delete cookies in your browser settings. If you block the essential cookies, the basket and checkout will not work.
Embedded content from other websites
Google Maps
Our Contact and About pages include an embedded map from Google Maps (provided by Google Ireland Limited and Google LLC) to show where our shop is. When you view a page with the map, your browser connects to Google’s servers, which receive information such as your IP address and the page you are on, and Google may set or read cookies on your device. We do not control the data Google collects. Please see Google’s Privacy Policy and how Google uses cookies for more information.
The map loads automatically when you open those pages. Our “Get directions” button only opens Google Maps in a new tab if you click it.
Who we share your information with
We never sell your personal information. We only share it with trusted companies that help us run the shop, and only what they need:
- Payment providers: WooPayments (powered by Stripe) for card, Apple Pay, Google Pay and Amazon Pay payments, and PayPal if you pay with PayPal. They process your payment details and may run fraud checks.
- Delivery: Parcel2Go, which we use to book postage, and Royal Mail, which delivers your parcel, receive your name, delivery address and contact details.
- Website and email hosting: IONOS hosts our website and email.
- Shop software: WooCommerce (Automattic) runs our online shop.
- Newsletter: MailPoet sends our newsletter emails.
- Google: we list our products on Google Shopping through Google Merchant Center. This shares product information only, not customer details. Google also provides the map on our Contact and About pages.
- Professional advisers and authorities: our accountant, and HMRC or other authorities where the law requires it.
Some of these companies store data outside the UK, including in the United States. Where they do, they use legal safeguards approved under UK data protection law, such as the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum.
How long we keep your information
- Orders: 6 years from the end of the financial year of the order, as required for tax and accounting records.
- Unpaid or failed orders: deleted after 3 months, as no sale took place.
- Accounts: until you ask us to close your account. Your order records are then kept for the period above.
- Newsletter: until you unsubscribe.
- Enquiries: up to 2 years after our last contact, unless they lead to an order.
- Security logs: a short period, normally no more than a few months.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct anything that is wrong or incomplete;
- ask us to delete your information, where we no longer have a reason to keep it;
- object to, or ask us to restrict, how we use your information;
- ask us to send your information to you or another organisation in a common format;
- withdraw your consent at any time, for example by unsubscribing from the newsletter.
To use any of these rights, email info@morganssweetsemporium.com. It is free, and we will reply within one month.
If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
Keeping your information safe
Our website uses a secure (HTTPS) connection, passwords are stored encrypted, logins are protected by limits on failed login attempts, and only the people who run the shop can see your details.
Children
Our website is not aimed at children, and we do not knowingly collect information from anyone under 13. Orders should be placed by an adult.
Changes to this policy
We may update this policy from time to time, for example if we start using a new service. The date at the top shows when it was last changed.