Privacy Policy

Last updated: 17 September 2026

1. Who we are

Good Latch ("we", "our", "us") is the data controller for personal data collected through this website. Our contact details are: [email protected].

2. What data we collect

We may collect: your name, email address, phone number, and any information you provide via our contact form. We also collect technical data such as your IP address and browser type for security purposes.

3. How we use your data

• To respond to your enquiries (lawful basis: legitimate interest, Art. 6(1)(f) UK GDPR)
• To improve our website (lawful basis: legitimate interest)
• To comply with legal obligations (lawful basis: legal obligation, Art. 6(1)(c))

4. Who we share your data with

We share personal data only with service providers who help us run this website and our business, under contracts that require them to protect it:

• Website platform, hosting and database providers — who build, host and maintain this website on our behalf (United Kingdom, EU and United States).
• Content delivery and security providers — who serve this website quickly and protect it from attacks (global).
• Email delivery providers — who deliver the emails this website sends (EU and United States).
• Payment providers — when you pay online, your payment details go directly to our payment provider (you will see them named at checkout and on your statement); they never touch this website's servers.
• Advertising and analytics vendors — only if we have enabled them and only with your consent through the cookie banner. See our Cookie Policy.

Our service providers page keeps this list up to date. Where a provider processes data outside the UK, the transfer is protected by safeguards recognised under UK law, such as the UK International Data Transfer Agreement or UK adequacy regulations. We do not sell your personal data.

5. How long we keep your data

Contact form submissions are retained for 12 months after our last communication. Technical logs, such as IP addresses, are kept only for as long as we need them to keep this website secure, and are then deleted.

If you buy from us, we keep a record of your orders for 7 years so we can meet our tax and accounting obligations (lawful basis: legal obligation). We remove the contact details attached to an order sooner, once we no longer need them to support you. Baskets you leave without checking out are deleted within about 90 days, and if you hold an account we remove your details after a long period without any activity. Gift-card records are kept while a card still holds value and then for our accounting obligations.

Deleting data from the live website does not remove it from our backups at the same moment. This website's database is backed up daily so it can be recovered after an outage or a mistake. If you ask us to erase your data, it is removed from the live site straight away and then remains in those backup copies for up to 30 days before they expire and are deleted automatically. While it is there it is put beyond use — not accessed and not used for any purpose — and if we ever had to restore from a backup taken before your request, your erasure is re-applied to the restored data before the site goes back into use.

If you unsubscribe from our marketing emails, we keep a minimal record of your contact details on a suppression list so that we do not contact you again. We hold this record to comply with our legal obligations around direct marketing (lawful basis: legal obligation), and it is kept separate from our marketing lists. There is no automatic right to have a suppression record deleted, because deleting it would allow you to be contacted again.

Sometimes we receive your contact details from someone else rather than from you directly — for example if a friend refers you to us, or if another customer buys you a gift card and asks us to email it to you. When that happens we use your email address only to send you that referral or gift, on the basis of our legitimate interest in running those features (Art. 6(1)(f) UK GDPR); we do not add you to any marketing list. You have the same rights over this information as set out below, and you can ask us to erase it at any time using our privacy request form.

6. Your rights

Under UK GDPR, you have the right to: access your data, rectify inaccurate data, erase your data, restrict processing, data portability, and object to processing. To exercise any of these rights, use our privacy request form or contact us at [email protected].

7. Cookies

See our Cookie Policy for details on what cookies we use and how to manage your preferences.

8. Complaints

If you are unhappy with how we handle your data, you can submit a complaint or contact the Information Commissioner's Office (ICO) at ico.org.uk.

9. Changes to this policy

We may update this policy from time to time. The date at the top of this page indicates the last revision.