Privacy Policy
1. Who we are
Car Aerial Shop (caraerialshop.co.uk) is run by incarkits, sole trader.
Address: 49 Chambers Place, Endmoor, LA8 0BQ
We are the controller of the personal data described in this policy.
For any question about your data, or to exercise your rights, email admin@caraerialshop.co.uk or write to us at the address above.
2. The personal data we collect
We collect most of this directly from you when you place an order, create an account or contact us.
- Order details: name, billing and delivery address, email address, phone number, the products you buy, order value and order history.
- Payment details: payments are handled by Stripe. We do not see or store your full card number; we receive only a payment reference, the card type and the last four digits.
- Account details: if you create an account, your username, password (stored encrypted) and saved addresses.
- Communications: emails and messages you send us, including returns and support queries.
- Reviews: if you leave a review through Trustpilot, the review and the name you choose to show with it.
- Website usage: your IP address, browser type and the pages you visit, collected through cookies and similar technologies (see section 7).
- Comments: if you comment on the site, your name, email address, comment, IP address and browser user agent (used for spam detection).
3. How we use your data and our lawful basis
UK data protection law requires us to have a lawful basis for each use of your data.
| What we use it for | Lawful basis |
|---|---|
| Processing and delivering your order, taking payment, handling returns and refunds | Contract |
| Sending order confirmations and delivery updates | Contract |
| Answering your enquiries | Contract or legitimate interests (helping customers) |
| Keeping sales and accounting records | Legal obligation (tax law) |
| Preventing fraud and keeping the website secure | Legitimate interests |
| Inviting you to review your purchase on Trustpilot | Legitimate interests (improving our service and showing genuine feedback) |
| Sending marketing emails about similar products | Legitimate interests for existing customers, or consent; you can opt out at any time |
| Analytics and non-essential cookies | Consent |
We do not make decisions about you using solely automated processing that has legal or similarly significant effects. Stripe uses automated fraud checks on payments, which may occasionally block a transaction; if this happens, contact us and we will review it.
4. Who we share your data with
We never sell your personal data. We share it only with the following organisations, and only as much as they need:
| Recipient | What they receive | Why |
|---|---|---|
| Stripe Payments UK Ltd | Name, billing address, email, card details you enter at checkout | Processing payments and preventing fraud |
| Royal Mail Group Ltd | Name, delivery address, email and phone number | Delivering your order and sending tracking updates |
| HubSpot, Inc. | Name, email address, order history and website activity | Managing customer records and sending emails |
| Trustpilot A/S | Name, email address, order reference | Sending review invitations and displaying reviews |
| Our web hosting provider | All data stored on our website | Hosting the website and its database |
| Automattic (Gravatar / Akismet) | A hashed email address and comment data | Showing profile pictures and filtering spam comments |
| Our accountant and website developer | Order and sales records; website access for maintenance | Bookkeeping and tax returns; maintaining the website |
We may also share data if required by law, for example with HMRC, the police or a court.
5. International transfers
Some of the organisations above store or process data outside the UK. HubSpot and Stripe may process data in the United States, and Trustpilot is based in Denmark (EU).
Where data leaves the UK, it is protected either by a UK adequacy decision (which covers the EU, and US companies certified under the UK Extension to the EU-US Data Privacy Framework) or by the UK International Data Transfer Agreement or Addendum included in the provider’s terms. Contact us if you would like more detail.
6. How long we keep your data
| Data | How long |
|---|---|
| Orders, invoices and payment records | 6 years from the end of the financial year of the order (tax law) |
| Customer account | Until you close it, or 3 years after your last login or order |
| Marketing email list | Until you unsubscribe |
| Support emails and messages | 2 years after the query is resolved |
| Website comments | Until removed, or on request |
| Cookie data | As listed in our cookie settings (see section 7) |
When the period ends, we delete the data or anonymise it so it can no longer identify you.
7. Cookies
Cookies are small files stored on your device. We use two kinds:
- Strictly necessary cookies keep your basket, checkout and login working, and let Stripe detect payment fraud. These do not need your consent.
- Optional cookies include analytics, HubSpot tracking and the Trustpilot review widget. We only set these if you accept them in our cookie banner.
You can change your choice at any time using the “Cookie settings” link at the bottom of every page. Our cookie settings panel lists each cookie, who sets it and how long it lasts.
If you leave a comment, you can choose to save your name and email in a cookie for one year so you don’t have to retype them.
8. Marketing and review invitations
If you have bought from us, we may email you about similar products, unless you opted out at checkout. Every marketing email has an unsubscribe link, and you can also email us to stop them.
After an order, we may ask you to review your purchase on Trustpilot. To do this we share your name, email address and order reference with Trustpilot, which sends the invitation. You don’t have to leave a review. To stop review invitations, tell us or use the opt-out link in the invitation. Trustpilot’s own privacy policy explains how it handles reviews you post.
9. Your rights
Under UK data protection law you have the right to:
- Access a copy of the personal data we hold about you
- Rectification of anything inaccurate or incomplete
- Erasure of your data, where we have no legal reason to keep it
- Restrict how we use your data in certain circumstances
- Object to processing based on legitimate interests, and to direct marketing at any time
- Data portability: receive data you gave us in a common electronic format
- Withdraw consent at any time, where we rely on consent
To use any of these rights, email admin@caraerialshop.co.uk. There is no charge in most cases. We will reply within one month. We may ask you to confirm your identity first, for example by replying from the email address on your order.
If you are unhappy with how we have handled your data, please contact us first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
10. Security, children and changes
Security. Our website uses HTTPS encryption, payments are handled by Stripe’s PCI-compliant systems, and access to customer data is limited to people who need it.
Children. Our shop is not aimed at children under 18, and we do not knowingly collect their data.
Changes. We may update this policy from time to time. The date below shows when it last changed.
Last updated: 11 October 2026