Privacy policy
Last updated: 3 October 2026 (draft)
This policy explains what personal information SpiritCrystals collects when you shop with us online or in our shops, why we collect it, who we share it with, how long we keep it and what your rights are. We have tried to keep it short and plain. If anything is unclear, just ask us.
1. Who we are
SpiritCrystals is a trading name of Cryptocrystals Limited, a company registered in England and Wales, company number 12685159, registered office at 167-169 Great Portland Street, 5th Floor, London W1W 5PF. We are the "controller" of your personal information, which means we decide how and why it is used.
[PLACEHOLDER: ICO registration number, once registered: "We are registered with the Information Commissioner's Office, registration number Z…"]
You can contact us about anything in this policy:
- Email: support@spiritcrystals.com
- Phone or WhatsApp: 07873 972723
- Post: SpiritCrystals, Unit SU9, ground floor, Highcross Shopping Centre, High Street, Leicester LE1 4AN
- In person at either of our shops: Unit SU117, ground floor, Derbion Shopping Centre, London Road, Derby DE1 2PL; or Unit SU9, ground floor, Highcross Shopping Centre, High Street, Leicester LE1 4AN.
The law that protects your information is the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), which cover cookies and marketing messages.
2. What we collect and why
The law says we must have a reason (a "lawful basis") for each way we use your information. The ones we rely on are:
- Contract: we need it to do what you have asked us to, such as sending your order.
- Legitimate interests: it is needed to run and protect our business in a way you would reasonably expect, and it does not override your own rights.
- Consent: you have said yes, and you can change your mind at any time.
- Legal obligation: the law requires it, for example tax records.
| What | Information | Why we use it | Lawful basis |
|---|---|---|---|
| Orders on our website | Name, email, phone number, billing and delivery addresses, what you bought, order notes, payment status (we never see or store your full card number) | To take payment, pack and send your order or have it ready for click & collect, send order and delivery updates, and handle returns, refunds and questions | Contract |
| Tax and accounting records | Order and payment details | To keep the records HMRC requires | Legal obligation |
| Your account | Name, email, password (stored encrypted), saved addresses, order history, saved crystals | So you can log in, check orders, reorder and keep a list of crystals you like | Contract |
| Rock Family loyalty | Name, email, phone (if given), stamps, lifetime spend, tier, rewards used, purchases online and in our shops, and your birthday (day and month only, if you choose to give it) | To run the loyalty scheme: count stamps, work out your tier, give you your free pet rocks and birthday gift | Contract (the scheme's terms). Birthday: consent, as it is optional |
| In-shop purchases | What you bought, when and where; your name, email or phone if you give them at the till (for example to collect stamps or have a receipt emailed) | To sell to you, give receipts, handle returns and add purchases to your Rock Family card | Contract; legal obligation for tax records |
| Marketing emails (the Rock Family newsletter) | Name, email, and which emails you open or click | To send news, new arrivals and offers you have asked for, and to see which emails are useful | Consent |
| Crystal quiz results | Email and your quiz answers | To email you your results (we need an email address to do this) | Contract (you asked for the results). We only add you to marketing if you tick the separate newsletter box |
| Mystery Box subscription | Name, email, delivery address, box size, billing history, tier | To pick, pack, send and bill your boxes | Contract |
| The Cave readings | Name, contact details, booking date and time, payment | To book your reading and let the reader know who is coming | Contract |
| Messages and enquiries | Whatever you tell us by email, phone, WhatsApp, the contact form or social media | To answer you and keep a record of what was agreed | Legitimate interests (helping customers); contract where it is about an order |
| Creator and affiliate applications | Name, email, platform, handle, follower band, what you would like to do, which shop, and anything you tell us about yourself | To consider your application and contact you about it | Legitimate interests (choosing who to work with); contract once you join |
| Creator partners | As above, plus your link or code, clicks and sales from it, commission and bank details for payouts | To track sales, pay commission and keep tax records | Contract; legal obligation for tax records |
| Website analytics | Pages visited, device and browser type, approximate location (town or region), how you reached us | To understand how the site is used and improve it | Consent (only set if you accept analytics cookies) |
| Security and fraud prevention | IP address, login attempts, payment checks run by our payment providers | To keep the site, your account and payments safe | Legitimate interests; legal obligation |
| Shop CCTV | Our shops have CCTV that we control, which records images of people in the shop. The shopping centres run their own CCTV in their common areas; they are responsible for that. | Safety and crime prevention | Legitimate interests |
If you do not give us information we need for an order (such as a delivery address), we will not be able to complete it.
3. Cookies and similar technology
Cookies are small files saved on your device by websites. We use two kinds:
- Essential cookies. These make the site work: your basket, checkout, logging in, remembering your cookie choices and keeping the site secure. The law allows these without consent, because the site cannot work without them.
- Analytics cookies (Google Analytics, loaded through Google Tag Manager). These tell us how people use the site. We only set them if you say yes in our cookie banner.
We do not use advertising cookies or pixels at the moment. If we add any (for example Meta Pixel, TikTok Pixel or Google Ads), we will list them here first and only use them if you choose "Accept all" or turn on marketing cookies in Cookie settings.
You can change your mind at any time using the "Cookie settings" link at the bottom of every page, or by clearing cookies in your browser.
Saved crystals. If you are not logged in, the crystals you save are kept in your own browser's local storage, not on our servers. They stay on that device until you clear them. If you log in, they are saved to your account so you can see them on any device.
Maps. The maps on our "Our shops" page show a still picture first. The live Google Map only loads when you tap it, so Google cannot set cookies or receive your information from that page unless you choose to open the map.
4. Marketing and how to unsubscribe
We only send marketing emails if you have asked for them, for example by ticking the optional Rock Family newsletter box (it is never ticked for you) or signing up on our site or in a shop.
You can unsubscribe at any time by clicking "unsubscribe" at the bottom of any of our emails, by changing your preferences in your account, or by telling us. Unsubscribing does not affect your orders, your account or your Rock Family stamps, and you will still get emails about your orders, bookings and loyalty rewards (these are service messages, not marketing).
We do not sell your information, and we do not let other businesses market to you.
5. Who we share your information with
We only share what each one needs to do their job. These companies act on our instructions ("processors") unless we say otherwise.
| Who | What for |
|---|---|
| UltaHost | Hosting our website and its database (servers in [PLACEHOLDER: server location]) |
| WooPayments, provided by Stripe | Taking card payments, and Apple Pay and Google Pay when offered. Stripe is also a controller for its own fraud-prevention and legal duties. |
| Klarna | If you choose to pay in 3. Klarna is a controller for its own credit checks and lending; see Klarna's privacy notice. |
| Our bank | If you pay by bank transfer |
| Royal Mail, and for some parcels abroad or heavy items, other couriers | Delivering your parcels (name, address, and email or phone for delivery updates) |
| Lightspeed | Our shop till system, which also holds Rock Family loyalty records and in-shop purchases |
| MailPoet | Sending our newsletter and other emails |
| WP Mail SMTP and [PLACEHOLDER: email sending service it connects to, e.g. Google Workspace / Brevo / SendLayer] | Delivering order and account emails |
| Google (Tag Manager, Analytics) | Website analytics, only with your consent |
| Google (Maps) | Only if you tap to load a map |
| YITH WooCommerce Affiliates (runs on our own website) | Tracking creator links and codes. If you arrive through a creator's link, we record that so we can pay them; the creator sees the sale and commission, not your name or contact details. |
| Independent readers in The Cave | Your first name and booking time, and anything you choose to tell them in your reading. Readers are independent and are responsible for keeping anything you share with them confidential. |
| Professional advisers, insurers, police, HMRC and other authorities | Only when needed to get advice, deal with a claim, or when the law requires it |
If our business, or part of it, is ever sold, your information may pass to the new owner, who would have to use it in line with this policy.
6. Information sent outside the UK
Some of our providers, such as Stripe, Google and Klarna, may store or access information outside the UK, including in the European Economic Area and the United States. When this happens, it is protected by one of the safeguards UK law allows:
- the country has been approved by the UK as having adequate protection (for example the EEA, or US companies signed up to the UK Extension to the EU–US Data Privacy Framework); or
- the provider has signed the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
You can ask us for more detail about the safeguard for any provider.
7. How long we keep it
| Information | How long |
|---|---|
| Orders, payments and refunds (online and in shop) | 6 years from the end of the tax year they fall in, as HMRC requires |
| Your account and saved crystals | Until you close your account, or after 3 years with no logins or orders, after which we will delete it (order records are still kept for tax as above) |
| Rock Family loyalty | While you are a member. If you leave, or there is no activity for 3 years, we delete your loyalty record |
| Marketing list | Until you unsubscribe. We then keep your email on a "do not contact" list so we never email you by mistake |
| Creator applications not taken forward | 12 months |
| Creator partners | While you are a partner, then 6 years for commission and tax records |
| Messages and enquiries | 2 years after the last contact, unless linked to an order |
| Analytics | [PLACEHOLDER: Google Analytics retention setting, e.g. 14 months] |
8. Your rights
You have the right to:
- Access: ask for a copy of the information we hold about you.
- Rectification: ask us to correct anything wrong or incomplete.
- Erasure: ask us to delete your information. We may have to keep some of it, such as order records for tax.
- Restriction: ask us to pause using your information, for example while we check it is correct.
- Objection: object to us using your information where we rely on legitimate interests. You can always object to marketing, and we will stop.
- Portability: ask for information you gave us, in a common digital format, to be sent to you or another business.
- Withdraw consent: where we rely on your consent (marketing, analytics cookies, your birthday), you can withdraw it at any time. This does not affect what we did before.
We do not make decisions about you using purely automated processes that have legal or similarly significant effects. Your Rock Family tier is worked out automatically from what you have spent, but it only ever gives you rewards.
To use any of these rights, contact us using the details in section 1. It is free, and we will reply within one month. We may need to check your identity first.
9. Children
Our website and services are not aimed at children. If you are under 18, please ask a parent or guardian before you order online or open an account. We do not knowingly collect information from children under 13. If you think a child has given us their information, please tell us and we will delete it.
There is no minimum age for a walk-in reading in The Cave or for joining Rock Family in a shop; under-16s should be with a parent or carer.
10. Keeping your information safe
We use sensible technical and organisational measures to protect your information, including an encrypted (HTTPS) connection on every page, encrypted passwords, payments handled by Stripe and Klarna so card details never touch our servers, limited staff access, and regular updates and backups. No system is completely secure, so please use a strong password that you do not use anywhere else.
If something goes wrong that puts your information at risk, we will tell you and the Information Commissioner's Office where the law requires.
11. Complaints
If you are unhappy with how we have used your information, please tell us first at support@spiritcrystals.com and we will do our best to put it right.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:
- Website: ico.org.uk
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
12. Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed. If we make a big change that affects you, we will tell you by email or on the website before it takes effect.
