Privacy policy

Last updated: 11 November 2026

BOWLDER is run by a sole trader based in Watford, United Kingdom. Contact: hello@bowlder.co.uk.

What we collect and why

• Enquiry and service request forms: your name, email, phone (if given), your message and any photos or 3D files you upload. We use them to reply and quote for your job. The forms are handled by our website host, Netlify.
• Payments: card payments are processed by Stripe. We never see or store your full card details. Stripe shares your name, email, phone, billing address and order details with us so we can fulfil your order.
• Delivery: your name, contact details and chosen InPost locker or DPD Pickup shop are passed to InPost or DPD to deliver your parcel.
• Order emails: order and enquiry details are emailed to our business inbox so we can process them.

Our legal basis

Under UK GDPR we use your data to perform a contract with you (quotes, orders and delivery), to meet legal obligations (for example keeping sales records for tax), and for our legitimate interest in answering enquiries. We do not send marketing unless you ask us to.

Cookies and local storage

We do not use tracking or advertising cookies. Your cart and delivery choice are saved in your browser's local storage so they survive a page refresh. They stay on your device. The locker map loads map tiles from OpenStreetMap and locker data from InPost, which means those services see your IP address. Stripe sets its own cookies on its checkout page for fraud prevention. If you sign in to a MY BOWLDER account we also set an httpOnly session cookie named my_s. It is not used for advertising.

Who we share data with

Only the services needed to run the shop: Netlify (website and forms), Stripe (payments), InPost and DPD (delivery), and our email provider. Some of them may process data outside the UK under appropriate safeguards. We never sell your data.

How long we keep it

Enquiries that don't lead to an order are deleted within 12 months. Order records are kept for 6 years, as UK tax rules require. Uploaded files are deleted once your job is finished, unless you ask us to keep them for repeat orders.

Customer accounts (MY BOWLDER)

If you create a MY BOWLDER account at bowlder.co.uk/account we store your name, email address, and phone or company if you provide them. Your password is stored only as a PBKDF2 hash. We never store the password itself. The account is used to show you your orders, bespoke projects and files.

While you are signed in, the site sets an httpOnly cookie named my_s. It holds a signed session identifier, not your password, and it is separate from any staff session. It lasts up to 12 hours.

You can request account deletion from the account page. BOWLDER processes that request manually within 30 days. The account is not erased automatically. Order records we must keep for tax may be retained as described above, with account access removed.

Your rights

You can ask to see, correct or delete your data, or object to how we use it, by emailing hello@bowlder.co.uk. If you are unhappy with our answer you can complain to the Information Commissioner's Office (ico.org.uk).