We use your details to process your order
When you buy from us, we use your contact, billing, delivery and order details to take payment, prepare the order and keep you updated.
Privacy policy
How we look after your information
This page explains how Lisa Morris trading as Wye Knot collects, uses and protects personal information when you shop online, contact us, create an account or use our website.
We use personal information to run the shop, process orders, reply to messages, deliver parcels, manage returns and improve the website. We only keep it for as long as needed.
Last updated: 4 September 2026
At a glance
- Controller Lisa Morris trading as Wye Knot
- Orders Used to process and deliver orders
- Marketing Only where you have agreed or can opt out
- Cookies Some need consent
- Contact info@wye-knot.co.uk
Messages help us reply properly
Contact form messages, order numbers and optional photos or files are used to reply to your enquiry, return, damage report or product question.
Cookies support the shop and analytics
Some cookies are needed for basket, checkout and account features. Others may help us understand site performance or marketing where permitted.
Who we are
Lisa Morris trading as Wye Knot
Wye Knot is an independent gift shop in Builth Wells. The data controller for this website is Lisa Morris trading as Wye Knot.
We do not have a formal Data Protection Officer. If you have a privacy question, please contact us using the details on this page.
BusinessLisa Morris trading as Wye Knot
AddressWye Knot, 27 High Street, Builth Wells, Powys, LD2 3DL
General emailinfo@wye-knot.co.uk
Returns emailreturns@wye-knot.co.uk
Information you give us
- Name, email address, billing address, delivery address and phone number.
- Order details, delivery or click & collect details, returns and customer-service notes.
- Account login details and saved addresses where you create an account.
- Messages sent through the contact form, including optional photos or files.
- Marketing consent preferences where you choose to receive marketing.
- For authorised administrators, connected business social-media account identifiers, board details, access permissions, connection tokens and publishing records.
Information collected automatically
When you use the website, cookies and similar technologies may collect information such as your IP address, browser, device, pages visited, shopping basket activity and how you found the site.
Some cookies are needed for the shop to work. Others may help us understand site performance, marketing or how customers use the website.
Used for clear shop purposes
We usually use your information because it is needed to process your order, reply to you, meet legal or accounting duties, protect the website, or because you have agreed to receive marketing.
This keeps the privacy notice practical: we only ask for details that help us run the shop, support customers, deliver orders, handle returns or keep the website working safely.
Orders, records, consent and security
- Order details are used because they are needed to provide what you bought.
- Some records are kept because accounting or legal rules require them.
- Marketing and non-essential cookies rely on consent or a lawful opt-out route where allowed.
- Security and fraud checks help protect customers, payments and the website.
- Authorised social-media connections are used for our legitimate interests in managing and promoting Wye Knot’s own business presence.
Orders, payment and delivery
How we use order information
We use order information to process purchases, take payment, send order updates, arrange delivery or click & collect, deal with returns and keep accounting records.
WooCommerce stores order and customer details. Payment information is handled securely by payment providers such as Stripe and Klarna where selected. We do not store full card numbers on our website.
Couriers such as Royal Mail, Evri, DPD or Parcelforce may receive the details needed to deliver your order. Where a product is sent directly by an approved fulfilment partner, we may also provide that partner with the minimum order and delivery details needed to pick, pack, despatch, track and, where necessary, arrange delivery or a return.
CheckoutWooCommerce
PaymentsStripe / Klarna where selected
DeliveryCourier / fulfilment details where needed
RecordsAccounting and customer service
Messages and uploaded files
If you use the contact form, we use your message and any optional upload to reply and help with your enquiry. Uploaded files are sent as email attachments rather than intentionally stored as media library files.
General enquiries go to shop email addresses. Returns or damage messages may go to returns@wye-knot.co.uk. Accepted uploads include JPG, PNG, WebP and PDF files up to 6MB.
Please do not upload unnecessary sensitive information. Only send photos or files that help us answer your question, check a product, or handle a return or damage issue.
We keep contact enquiries for as long as needed to deal with the enquiry, order, return, damage report, dispute or any related legal/accounting record-keeping need.
Service emails and optional marketing
We send transactional emails such as order confirmations, payment updates, despatch or collection updates, refunds, cancellations, account emails and customer-service replies.
We may also send WooCommerce email marketing, newsletters, promotional emails, abandoned basket emails and review requests where you have opted in, where you have bought from us and the law allows, or where you can opt out.
You can unsubscribe from marketing emails at any time using the unsubscribe link in the email or by contacting us. Order, payment, account and delivery emails are service messages, not marketing.
Google Business Profile
Google Business Profile connection and publishing
Wye Knot uses its private WordPress administration tool, Wye Knot Social Studio, to connect Wye Knot’s own Google Business Profile and publish approved shop, product and Journal updates. Only authorised WordPress administrators can start or manage this connection.
The connection uses Google OAuth and requests the business.manage permission so Social Studio can identify the Wye Knot business account and location and publish approved Business Profile updates. Wye Knot does not receive or store the Google account password.
Social Studio may store the connected Google business account and location identifiers, location details needed for publishing, OAuth access and refresh tokens, token-expiry information, Google post identifiers or URLs, and publishing logs. These details are stored within the Wye Knot WordPress administration system and are restricted to authorised administrators.
This information is used only to manage Wye Knot’s own Google Business Profile and publish approved Wye Knot content. It is not used to access or manage customers’ Google accounts, and Google account information obtained through the connection is not sold. Data returned through the Business Profile APIs is used and retained only as needed to operate the Wye Knot connection and in accordance with Google’s applicable API policies.
When the Google Business Profile connection is removed, the saved OAuth connection credentials and cached connection details can be cleared. Related publishing records may be retained only where reasonably needed for administration, troubleshooting and duplicate-post prevention. Wye Knot’s use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
ConnectionGoogle OAuth
Permissionbusiness.manage
Business dataAccount and location identifiers
PurposeWye Knot profile management and approved posts
DisconnectingClears saved connection credentials
YouTube API Services
Wye Knot Social Studio and YouTube Shorts
Wye Knot uses a private WordPress administration tool called Wye Knot Social Studio to connect Wye Knot’s own YouTube channel and upload administrator-reviewed YouTube Shorts. The YouTube features are available only to authorised Wye Knot administrators; customers are not asked to connect their own YouTube or Google accounts.
Social Studio uses YouTube API Services and Google OAuth. It requests the youtube.readonly permission to identify and check the authorised YouTube account and channel, and the youtube.upload permission to upload reviewed videos. Wye Knot does not receive or store the Google or YouTube account password.
The tool may access or store the connected YouTube channel ID and channel name, OAuth access and refresh tokens and expiry information, and YouTube video IDs, URLs, visibility or publishing status returned after an authorised upload. This information is stored within the Wye Knot WordPress administration system and is restricted to authorised administrators.
We use this YouTube API information only to identify the correct Wye Knot channel, maintain the authorised connection, upload administrator-reviewed Shorts, show publishing status and help prevent accidental duplicate uploads. We do not use the integration to access customer YouTube accounts, viewing histories or unrelated YouTube information, and we do not sell YouTube API data.
Authorisation tokens are kept only while needed for the active connection and permitted purpose. Other stored YouTube API Data is deleted or refreshed within 30 calendar days where required by YouTube’s developer policies. Social Studio periodically checks that the connection remains authorised.
An authorised administrator can revoke and clear the YouTube connection in Social Studio or revoke access through Google’s security settings. Following revocation or a valid deletion request, authorised YouTube API Data held by Social Studio is deleted as soon as possible and within seven calendar days. Deleting data from Social Studio does not delete videos or other information stored by YouTube; YouTube-hosted content must be managed through YouTube or another authorised client that supports deletion.
ConnectionGoogle OAuth / YouTube API Services
Permissionsyoutube.readonly and youtube.upload
ChannelWye Knot’s authorised YouTube channel only
API dataChannel, token and publishing identifiers
RevocationSocial Studio or Google security settings
Trusted services that help us run the shop
We may share personal information with service providers and approved fulfilment partners where needed to run the website, process orders, take payment, pick and pack goods, deliver parcels, arrange specialist delivery or returns, keep records, protect the site, send emails or provide customer service.
For direct-delivery orders this can include your name, delivery address, telephone number, email address where needed for tracking or delivery contact, the products ordered and delivery instructions. We provide only the information reasonably needed for fulfilment, delivery, returns and related customer service, not for Wye Knot to authorise unrelated marketing.
Other recipients may include our WordPress hosting provider, WooCommerce/WordPress services, Stripe, Klarna, Royal Mail, Evri, DPD, Parcelforce, email providers, Rank Math, Google and YouTube services, Pinterest and other connected social-media services, accounting/bookkeeping software, and security or backup plugins.
Some providers may process data outside the UK
Some services we use, such as payment, analytics, advertising, email or technology providers, may process personal data outside the UK.
Where this happens, we rely on the safeguards used by those providers, such as contractual protections, approved transfer mechanisms or other measures required by data protection law.
How long we keep information
We keep information only for as long as needed
We keep order and accounting records for up to 6 years where needed for tax, accounting, legal and customer-service reasons.
Account information is kept while the account remains open. Contact enquiries are kept for as long as needed to handle the enquiry, order, return, damage report, dispute or legal/accounting record-keeping need.
Returns or damage photos are kept only for as long as needed to deal with the issue and any related records. Marketing preferences may be kept while you are subscribed and for a reasonable period after you unsubscribe.
Connected social-media account details and tokens are normally kept while the connection remains active. They are removed when an authorised administrator clears the connection, subject to any shorter platform-specific deletion requirement. YouTube API Data is deleted or refreshed within the periods described in the YouTube API section above.
OrdersUp to 6 years
AccountsWhile open
EnquiriesAs long as needed
MarketingUntil unsubscribed or no longer needed
Social connectionsWhile connected or needed
You can ask about your personal information
Depending on the situation, you may have rights to access your personal information, ask us to correct it, request deletion, restrict or object to some uses, receive a copy of certain information, or withdraw consent where consent is the basis for using it.
Some rights may be limited where we need to keep information for legal, accounting, order, dispute or security reasons.
If you are unhappy with how we handle personal information, you can contact us first. You also have the right to complain to the Information Commissioner’s Office.
Our website is not aimed at children
Our website is not aimed at children, and we do not knowingly collect personal information from children.
We use reasonable technical and organisational measures to protect personal information, but no website, email system or internet transmission can be guaranteed to be completely secure.
Helpful answers about your data
Do you store my full card details?
No. Payments are handled securely by payment providers such as Stripe and Klarna where selected. We do not store full card numbers on our website.
Can I shop without an account?
Yes. You can checkout as a guest. You can also create an account during checkout or through My Account if you prefer.
What happens to photos I send?
Photos or files sent through the contact form are used to help with your enquiry, return, damage report or product question. They are kept only for as long as needed.
How do I stop marketing emails?
Use the unsubscribe link where available or contact us and we will help. Transactional order emails will still be sent where needed to process your order.
What happens when Pinterest is connected?
An authorised administrator approves the connection through Pinterest OAuth. Social Studio can then read the Wye Knot Pinterest account and boards and publish approved Pins. Clearing the connection removes the saved tokens, account details and board list from the plugin settings.
What happens when Google Business Profile is connected?
An authorised administrator approves the connection through Google OAuth. Social Studio can then identify Wye Knot’s authorised Business Profile location and publish approved Wye Knot updates. Removing the connection clears the saved OAuth credentials and cached connection details from the plugin settings.
Questions about privacy?
Send us a message if you have a question about your personal information, account, order, marketing preferences or contact form enquiry.
- General privacy enquiries: info@wye-knot.co.uk
- Returns or damage: returns@wye-knot.co.uk
Other useful pages
Plain-language policies, kept clear
You may save or print this page for your records. We may update this policy if our website, services or legal requirements change.