Privacy Policy

1.1 We are pleased that you are visiting our website and thank you for your interest. Below we inform you about how we handle your personal data when you use our website. Personal data is any data with which you could be personally identified.

1.2 The controller responsible for data processing on this website, within the meaning of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, is Flávio André Dantas de Sousa, trading as Maddison Cambridge, contactable at info@maddisoncambridge.uk. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

1.3 This website uses SSL/TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the controller). You can recognise an encrypted connection by the ‘https://’ prefix and the padlock symbol in your browser bar.

When you use our website for informational purposes only — i.e. if you do not register or otherwise send us information — we only collect the data your browser transmits to our server (‘server log files’). When you visit our website, we collect the following data, which is technically necessary to display the website to you:

● The page visited

● Date and time of access

● Amount of data sent, in bytes

● Source/referral from which you reached the page

● Browser and operating system used

● IP address used (anonymised where applicable)

Processing is carried out in accordance with Art. 6(1)(f) UK GDPR, on the basis of our legitimate interest in improving the stability and functionality of our website. This data is not passed on or otherwise used, except that we reserve the right to retrospectively check server log files if there are concrete indications of unlawful use.

To make visiting our website attractive and to enable the use of certain functions, we use cookies on various pages. These are small text files stored on your device. Some cookies are deleted after your browser session ends (session cookies); others remain on your device and allow us, or our partner companies, to recognise your browser on your next visit (persistent cookies).

Where cookies collect personal information, this is processed in accordance with Art. 6(1)(b) UK GDPR, for the performance of a contract, or Art. 6(1)(f) UK GDPR, to safeguard our legitimate interest in the functionality of the website and a customer-friendly browsing experience.

We may work with advertising partners who help make our website more relevant to you. For this purpose, cookies from partner companies may also be stored on your device (third-party cookies).

Note: you can set your browser to inform you about cookies and decide individually on their acceptance, or exclude cookies in certain cases or altogether. Please note the functionality of our website may be limited if cookies are not accepted.

When you contact us (e.g. via a contact form or email), personal data is collected. The data collected via a contact form can be seen from the respective form. This data is stored and used solely to respond to your request and for related administration.

The legal basis for processing is our legitimate interest in responding to your request (Art. 6(1)(f) UK GDPR). Where your contact aims at the conclusion of a contract, the additional legal basis is Art. 6(1)(b) UK GDPR. Your data will be deleted once your request has been fully processed, unless a legal retention obligation applies.

In accordance with Art. 6(1)(b) UK GDPR, personal data is collected and processed when you provide it to us for the performance of a contract or when opening a customer account. The data collected can be seen from the relevant input forms.

You may delete your customer account at any time by sending a message to the controller’s contact address above. We store and use the data you provide for contract processing. After the contract is fully processed or your account is deleted, your data will be blocked with regard to tax and commercial retention periods and deleted after these periods expire, unless you have expressly consented to further use.

If you register for our email newsletter, we will regularly send you information about our offers. The only mandatory information is your email address. We use a double opt-in procedure, meaning we will only send you newsletters once you have expressly confirmed your consent.

By activating the confirmation link, you give us your consent under Art. 6(1)(a) UK GDPR. We store your IP address and the date and time of registration. You can unsubscribe at any time via the link in the newsletter, after which your email address is deleted from our distribution list.

If you have provided your email address when purchasing goods or services, we may send you offers for similar goods or services by email, on the basis of our legitimate interest in personalised direct advertising under Art. 6(1)(f) UK GDPR, without needing separate consent. You may object to the use of your email address for advertising purposes at any time, with future effect.

7.1 Your personal data is passed to the delivery company commissioned with delivery, where necessary for delivery of the goods, and to the relevant payment institution, where necessary for payment processing. The legal basis for this transfer is Art. 6(1)(b) UK GDPR. As our products are shipped from suppliers based outside the United Kingdom, your data may be transferred internationally as part of order fulfilment — see Section 15 below.

Payments are processed by Shopify Payments, provided by Shopify International Limited, and by the wallet providers you may choose at checkout (Apple Pay, Google Pay, Shop Pay). Your payment data is passed to these providers under Art. 6(1)(b) UK GDPR, only to the extent necessary to process your payment. We do not store your full card details.

We use your email address for a one-off reminder to leave a review of your order via the review system we use, provided you gave express consent under Art. 6(1)(a) UK GDPR during or after your order. You can withdraw your consent at any time by contacting the controller.