Free UK shipping over £30 · Shelf-ready or we replace it

Tsundoku Club
0 0

Privacy policy

Last updated: 21 August 2026

1. Who we are

Tsundoku Club is operated by Tsundoku Club Limited, a company registered in England and Wales (company no. 17218558), based in Doncaster, United Kingdom. We are not VAT registered. In this policy "we", "us" and "our" refer to that company. We are the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and we are registered with the UK Information Commissioner's Office where required.

Contact: hello@tsundokuclub.co.uk
Registered office and postal address: 53 Sheffield Road, Doncaster, DN4 9QR, United Kingdom

2. What we collect

  • Account data — name, email address, and login credentials when you create a customer account.
  • Order data — billing and shipping address, items purchased, and payment confirmation (we do not store full card details).
  • Gift card data — if you buy or redeem a gift card, we (via Shopify) store the unique gift card code, its issued and remaining balance, the email address it was issued to, and a record of orders it has been redeemed against. This is needed to issue, deliver, and honour the gift card, and to comply with our accounting obligations.
  • Guest order & returns data — if you order or request a return as a guest, we store the order number, email address, and return reason needed to process the request.
  • Cart & abandoned-cart data — if you start a checkout and provide an email but don't complete it, Shopify retains your cart contents and email so we can send up to two reminder emails and so you can resume the order.
  • Back-in-stock requests — the email address you give us on a sold-out title, the title and edition you asked about, and the date you asked. Used for one restock email for that title only.
  • Favourites — if you are signed in, the titles you heart are stored against your customer account (title, product handle, date) so they follow you across devices; you can remove any of them at any time. As a guest they are stored only in your own browser.
  • Newsletter subscribers — email address, sign-up source and consent timestamp, held on your Shopify customer record. Newsletters are sent through Shopify Email.
  • Review requests — a record of the single post-purchase review-request email we send you. Reviews themselves are collected independently on Trustpilot, not on this site (see our Review Policy).
  • Site analytics — Shopify's built-in storefront analytics record page views, sessions, device type, referrer, approximate country and conversion events (add-to-basket, checkout). If you accept analytics or marketing cookies in the cookie banner, Google may also receive measurement data through the Google & YouTube sales channel (see section 9 and our Cookie Policy).
  • Communications — messages you send us and a log of transactional emails we send you (delivery, bounce, and unsubscribe status) for deliverability and audit purposes.
  • Technical data (transient) — IP address and user agent are processed in memory by our hosting and edge providers for security, rate-limiting, and fraud prevention, but are not stored in our application database.
  • Cookie & session data — essential identifiers that keep you signed in, remember your basket, and record your cookie preferences. See our Cookie Policy for the full list.

We do not knowingly collect special category data (e.g. health, biometric, political) and we do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

3. How we use your data

We process your data to:

  • Process and ship your orders, manage subscriptions, and handle returns or refunds.
  • Provide customer support and respond to your enquiries.
  • Send order confirmations, shipping updates, return updates, and other transactional emails.
  • Send abandoned-cart reminders to existing or checking-out customers under the PECR "soft opt-in" (you can unsubscribe in any reminder).
  • Send post-purchase review-request emails (one per order, also unsubscribable).
  • Send back-in-stock alerts you have specifically requested.
  • Send newsletters and marketing emails where you have opted in, and honour any unsubscribe requests.
  • Where you have given analytics consent, measure page views, referrers, popular pages, marketing campaign attribution, new vs returning visitors, on-page engagement, scroll depth and the add-to-cart / checkout-initiated funnel, so we can improve the shop and identify conversion drop-offs.
  • Maintain account and site security, detect abuse, and prevent fraud.
  • Comply with our legal, tax, and regulatory obligations.

4. Legal basis

Under UK GDPR Article 6, we rely on the following lawful bases for each purpose:

  • Performance of a contract (Art. 6(1)(b)) — to take payment, fulfil and ship your orders, manage subscriptions and gift cards, handle returns, and operate your account.
  • Consent (Art. 6(1)(a)) — for newsletter / marketing emails, back-in-stock alerts you specifically request, and any non-essential cookies. You can withdraw consent at any time without affecting prior processing.
  • Legal obligation (Art. 6(1)(c)) — to retain order and tax records as required by HMRC and UK accounting law, and to action data-subject requests.
  • Legitimate interests (Art. 6(1)(f)) — to keep the site secure and prevent fraud; respond to customer enquiries; send abandoned-cart reminders, post-purchase review requests and similar-product messages to existing customers where permitted by PECR; and protect our legal rights. You can object to these at any time by emailing us or using the unsubscribe link in our emails.
  • Consent (Art. 6(1)(a)) — analytics and marketing cookies — page-view analytics, persistent visitor identifiers, engagement and scroll metrics, conversion-funnel events, Google Analytics measurement, Google Ads measurement, newsletters, back-in-stock alerts and other opt-in marketing are processed only when you accept or request them. Withdraw at any time via the banner, the Cookie Policy page, or the unsubscribe link in our emails.

5. Sharing your data

We share data only with the following sub-processors, each bound by written data-processing terms (email hello@tsundokuclub.co.uk to request a copy):

  • Shopify Inc. (Canada) — storefront hosting, checkout, order and customer account management, gift cards, and abandoned-cart functionality.
  • Shopify Payments / third-party card processors — to securely process card and digital wallet payments. We never see or store full card numbers.
  • Supabase (EU region) — backend database and serverless functions that power back-in-stock alerts, our order and delivery emails and review-request emails.
  • Cloudflare, Inc. (US) — our DNS provider: it answers the lookup that turns tsundokuclub.co.uk into the address of Shopify's servers. In that role it sees the DNS query (the domain name and the resolver's IP), not the pages you view, your basket or your order details.
  • Resend, Inc. (US) — sending transactional emails (order confirmations, shipping, returns, abandoned-cart and review-request emails) and, where consented, newsletter emails.
  • Royal Mail (UK) — to deliver your UK orders.
  • Google Ireland Ltd / Google LLC (Ireland & US) — only with your analytics and/or marketing consent, through Shopify's Google & YouTube channel: Google Analytics 4 measurement and Google Ads conversion measurement. Google signals and ads personalisation are not enabled by us.

We also link out to one independent third-party platform that operates as its own data controller rather than as our processor:

  • Trustpilot A/S (Denmark) — collects shop-level reviews about Tsundoku Club. We do not transfer your order or contact details to Trustpilot. If you choose to leave us a review, you submit it to Trustpilot directly under their User Terms and Privacy Terms; Trustpilot is the controller of any data you provide to them.

We may also disclose personal data where required by law, court order, or to protect our legal rights. We never sell your personal data and we do not share it with data brokers. The only advertising platform we share data with is Google Ads, and only after you have given consent via the cookie banner — see Section 9 and our Cookie Policy.

6. International transfers

Some of our sub-processors are based outside the UK (notably Shopify in Canada, Cloudflare and Resend in the US, and Google in the US when you have consented to analytics or marketing cookies). Where this is the case, we rely on one of the following safeguards approved under UK GDPR Article 46:

  • UK adequacy regulations (e.g. for Canada and the EU/EEA).
  • The UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses with the UK Addendum, for transfers to the United States and other non-adequate countries.
  • The UK Extension to the EU–US Data Privacy Framework where the recipient (e.g. Google LLC) is self-certified.

You can request a copy of the safeguards in place by emailing us.

7. How long we keep it

  • Order & transaction records — 7 years from the end of the tax year, to meet HMRC requirements.
  • Customer account data — for as long as your account is active. Inactive accounts may be deleted after 3 years of inactivity.
  • Abandoned-cart records — up to 30 days after the last activity, then deleted (or sooner if you ask).
  • Back-in-stock requests — until the alert is sent or you unsubscribe, whichever is sooner.
  • Guest return requests — up to 2 years after the request is closed, for accounting and dispute purposes.
  • Newsletter subscriptions — until you unsubscribe; once unsubscribed, your email is added to a suppression list (kept indefinitely) so we don't accidentally email you again.
  • Customer support correspondence — up to 3 years after the last contact.
  • Analytics — Shopify storefront analytics are retained under Shopify's own data-retention terms and are reported to us only in aggregate.
  • Google Analytics data — retained by Google for 14 months (our configured limit), then deleted. Only created if you have accepted analytics cookies.
  • Google Ads measurement data — retained by Google for up to 540 days (Google's default), or shorter where we have configured a lower limit. Only created if you have accepted marketing cookies.
  • Email send logs & suppression list — retained for deliverability, bounce-handling and audit; suppression entries kept indefinitely so we honour unsubscribes.
  • Server & security logs — up to 90 days.

You may request deletion at any time, subject to our legal retention obligations above.

8. Your rights

Under UK GDPR you have the right to:

  • Access a copy of the personal data we hold about you.
  • Request correction of inaccurate or incomplete data.
  • Request deletion of your data ("right to be forgotten").
  • Object to or restrict our processing of your data.
  • Request a portable copy of your data.
  • Withdraw consent for marketing at any time.
  • Object to direct marketing at any time, free of charge.

To exercise any of these rights, email hello@tsundokuclub.co.uk. We will respond within one calendar month. We may need to verify your identity before acting on a request.

If you are unhappy with how we have handled your data, you may lodge a complaint with the UK Information Commissioner's Office: ico.org.uk, or by post to: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline: 0303 123 1113.

9. Cookies & similar technologies

We use a small number of strictly essential cookies to keep your basket, your sign-in and your cookie choice working, plus one local-storage item for your favourites. Shopify's cookie banner offers Accept, Decline and granular preferences of equal prominence, in line with ICO guidance; analytics and marketing cookies are set only after you opt in, and you can change your choice at any time from the "Cookie preferences" link in the footer. The full list is in our Cookie Policy.

10. Children

Our shop is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Security

We protect your data using industry-standard measures including TLS encryption in transit, encrypted storage at rest, role-based access controls, row-level security on our database, and minimisation of who can access personal data. Card payments are handled entirely by Shopify Payments and the card networks; card numbers never reach our systems. Despite our efforts, no system is perfectly secure — please use a strong, unique password for your account.

12. Data breaches

In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, and will inform affected users without undue delay where the risk is high, in line with UK GDPR Articles 33 and 34.

13. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email or a notice on the shop. The "last updated" date above always reflects the current version.