Privacy policy

Last updated: 4 November 2026 This policy explains how Daughter of Danu collects, uses and stores your personal data, why we do so, and what rights you have.

Who we are Daughter of Danu ("we", "our", "us") offers oracle decks, artwork, women's circles, ceremonies, retreats, creative offerings, newsletters and related events.

For the purposes of UK data protection law, Daughter of Danu is the data controller responsible for your personal information. Daughter of Danu is a trading name of Michael Buchanan. Contact: info@daughterofdanu.co.uk

Information we collect Information you give us

• Name and email address

• Phone number (if you choose to give it)

• Billing and delivery addresses

• Order and booking details

• Payment information (handled by our payment providers; see below)

• Marketing preferences

• Anything you tell us through contact forms, enquiries, bookings or event registrations Information collected automatically

When you visit our website we, and the providers we use, may collect your IP address, browser and device information, pages viewed, items added to your basket, and similar usage data, using cookies and similar technologies (see Cookies below).

How we use your information

• To process, pay for and deliver your orders, including shipping updates and returns

 • To manage event bookings and registrations, and to run circles, workshops, retreats and ceremonies

• To respond to enquiries and provide customer service

• To prevent fraud and keep our website secure

• To keep the financial records we are legally required to keep

• To understand how our website is used and improve it

• To send you marketing emails, where you have agreed to receive them

Our lawful bases for using your information

Contract: where we need your information to fulfil an order, booking or service you have asked for.

Legal obligation: where we must keep information, for example sales and tax records required by HMRC. Legitimate interests: for essential administration, customer service, fraud prevention, website security and improving our offerings, where these interests are not outweighed by your rights.

Consent: for marketing emails, and for non-essential cookies such as analytics and advertising cookies.

You can withdraw consent at any time.

Email marketing

If you subscribe to our newsletter or tick the box to receive emails at checkout, we may send you news about Daughter of Danu, new products and offerings, and event announcements. Every email includes an unsubscribe link, or you can email info@daughterofdanu.co.uk to unsubscribe or change your preferences.

Event bookings

When you book an event through Bookwhen or Eventbrite, we collect what we need to manage your booking and participation, such as contact details, booking history and, where relevant, an emergency contact. Some events may ask whether you have any health considerations we should know about. Health information is "special category" data under UK GDPR.

We will only collect it with your explicit consent, use it solely to keep you safe and support your participation, share it only with the facilitators who need it, and delete it after the event unless we are legally required to keep it.

Payments

Online shop payments are processed by Shopify Payments and, where offered, PayPal, Klarna or other payment providers shown at checkout. Event payments are processed by the providers integrated with Bookwhen, such as Stripe or PayPal. We never see or store your full card details. Who we share your information with We do not sell your personal information. We share it only with trusted providers who help us run Daughter of Danu, and only as far as they need it:

• Shopify: hosts our online shop and processes orders and payments

• Royal Mail and other delivery companies: to deliver your order (your name, address and, where needed for tracking, email)

• Mailchimp: email marketing

• Judge.me: product reviews. After you buy from us, Judge.me may email you to ask for a review. If you leave one, your name (as you choose to show it), rating, review and any photos are published on our website.

• Xero: accounting and bookkeeping

• Bookwhen: event bookings

• PayPal, Klarna, Stripe and other payment processors

• Advertising and analytics partners such as Meta (Facebook and Instagram) and Google, only where you have accepted the relevant cookies

• Professional advisers and authorities, such as our accountant or HMRC, where required by law About Shopify: our shop runs on Shopify, which processes personal information on our behalf to provide the shop. Shopify may also use information about your interactions with our shop for its own purposes, such as Shop Pay and fraud prevention. For those purposes Shopify is responsible for your information; see the Shopify Consumer Privacy Policy. You can exercise your rights over that information through the Shopify Privacy Portal.

International transfers Some of our providers, including Shopify, Mailchimp, Judge.me, Meta, Google and PayPal, may store or process your information outside the UK, for example in the United States, Canada or the European Economic Area. Where this happens, we rely on a UK adequacy decision (including the UK and US Data Bridge) or approved safeguards such as the UK International Data Transfer Agreement or Addendum, so your information stays protected.

How long we keep your information 

• Orders and financial records: 6 years from the end of the relevant tax year, as required by HMRC

• Event booking records: up to 2 years after the event (health information: deleted after the event)

• Customer service emails: up to 2 years after our last contact

• Marketing: until you unsubscribe. We then keep a minimal record so we don't email you again.

• Cookies: as set out in our cookie banner Your rights Under UK data protection law you have the right to:

• Be informed about how we use your information (this policy)

• Access a copy of the personal information we hold about you

• Rectification: have inaccurate or incomplete information corrected

• Erasure: ask us to delete your information. We may need to keep some, such as financial records we are legally required to retain.

• Restrict processing: ask us to keep but not use your information

• Data portability: receive information you gave us in a commonly used format, or have it sent to another organisation

• Object to processing based on legitimate interests, including an absolute right to object to direct marketing

• Withdraw consent at any time where we rely on consent We do not make decisions about you based solely on automated processing. To exercise any of these rights, email info@daughterofdanu.co.uk. We may need to confirm your identity first. We will respond within one month.

Cookies

We use cookies and similar technologies that are essential for the website and checkout to work. With your consent, we also use analytics cookies to understand how visitors use the site, and advertising cookies to measure and personalise our ads. When you first visit, our cookie banner lets you accept or decline non-essential cookies. You can change your choice at any time using the "Cookie preferences" link at the bottom of every page, or through your browser settings.

Children

Our offerings are intended for adults aged 18 and over. We do not knowingly collect personal information from children.

Security

We take appropriate technical and organisational measures to protect your information, and we use reputable providers with strong security. No method of transmission over the internet is completely secure, so please avoid sending sensitive information to us by ordinary email.

Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with a new "last updated" date. Complaints If you have concerns about how we handle your personal information, please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113.