Privacy Policy

Last Updated: December 2025

Mystic Fantasy (“we”, “our”, or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website or make a purchase from us.

1. Information We Collect

Personal Information You Provide

We collect information you voluntarily provide when you:

Create an account or place an order (name, email address, postal address, phone number)
Make a payment (payment card details are processed securely by our payment providers)
Subscribe to our newsletter (email address)
Contact us with enquiries (name, email, message content)
Leave product reviews (name, email, review content)

Information Collected Automatically

When you visit our website, we automatically collect certain information, including:

IP address and browser type
Device information and operating system
Pages visited and time spent on our site
Referring website addresses
Cookie data (see our Cookie Policy for details)

2. How We Use Your Information

We use your personal information to:

Process and fulfil your orders
Communicate with you about your orders, account, or enquiries
Send marketing communications (with your consent)
Improve our website and customer experience
Detect and prevent fraud
Comply with legal obligations
Personalise your shopping experience

3. Legal Basis for Processing (UK GDPR)

We process your personal data on the following legal bases:

Contract: Processing necessary to fulfil orders and provide our services
Legitimate Interests: To improve our services, prevent fraud, and market our products
Consent: For marketing communications and non-essential cookies
Legal Obligation: To comply with tax, accounting, and other legal requirements

4. How We Share Your Information

We may share your information with:

Service Providers: Companies that help us operate our business (payment processors, shipping carriers, email service providers, website hosting)
Legal Requirements: When required by law, court order, or government request
Business Transfers: In connection with a merger, acquisition, or sale of assets

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

5. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These include:

SSL encryption for data transmission
Secure payment processing through PCI-compliant providers
Regular security assessments
Access controls for staff handling personal data

While we strive to protect your information, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as necessary to:

Fulfil the purposes for which it was collected
Comply with legal, accounting, or reporting requirements
Resolve disputes and enforce our agreements

Order information is typically retained for 7 years for tax and accounting purposes. Marketing preferences are retained until you unsubscribe or request deletion.

7. Your Rights (UK GDPR)

Under UK data protection law, you have the right to:

Access: Request a copy of the personal data we hold about you
Rectification: Request correction of inaccurate or incomplete data
Erasure: Request deletion of your personal data in certain circumstances
Restriction: Request restriction of processing in certain circumstances
Data Portability: Receive your data in a structured, machine-readable format
Object: Object to processing based on legitimate interests or for direct marketing
Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us using the details below.

8. Marketing Communications

With your consent, we may send you marketing emails about our products, promotions, and news. You can opt out at any time by:

Clicking the “unsubscribe” link in any marketing email
Updating your preferences in your account settings
Contacting us directly

9. International Transfers

Your information may be transferred to and processed in countries outside the UK. When we transfer data internationally, we ensure appropriate safeguards are in place to protect your information in accordance with UK data protection law.

10. Children’s Privacy

Our website is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us immediately.

11. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these websites. We encourage you to read the privacy policies of any third-party sites you visit.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:

Email: info@mysticfantasy.co.uk
Website: www.mysticfantasy.co.uk

14. Supervisory Authority

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe your data protection rights have been violated:

Information Commissioner’s Office
Website: ico.org.uk
Helpline: 0303 123 1113