Privacy and cookies
Updated 3 October 2026
Who is responsible for your information?
Daemon Bull trading as Badboosts bargains is the controller for shop customer information. Contact: Daemon@badboostsbargains.co.uk. Business address supplied: Badboosts Bargains, Langley River Centre, Ferry Road, Norwich, NR14 6DH.
Information we use and why
| Information / purpose | Lawful basis |
|---|---|
| Name, email, delivery address, items and payment references to take and deliver orders, manage returns and answer order queries | Contract and steps requested before a contract |
| Invoices and transaction records for accounting and legal requirements | Legal obligation |
| Security logs, fraud checks, complaints and legal claims | Legitimate interests in protecting the shop and customers and resolving disputes |
| Optional Google Analytics information about site use | Your consent |
You provide order/contact information directly. Stripe supplies payment status and references. We do not receive your full card number or card security code. Required order information is needed to process and deliver your purchase. We do not use shop order details to send unsolicited marketing.
Who receives information?
Stripe handles payments, receipts and invoices. It also uses information for its own payment-security, fraud-prevention and legal responsibilities, as explained in its privacy notice. OpenAI provides ChatGPT Sites hosting, with Cloudflare infrastructure, to serve the shop and store order records. Our email service is provided by names.co.uk (Team Blue Internet Services UK Limited). Delivery providers receive the contact and address details needed to deliver your order. Professional advisers and authorities receive information where necessary. Optional Google Analytics receives usage information only when you consent. Links to Whatnot take you to a separate service with its own privacy notice.
Stripe privacy notice · Cloudflare privacy notice · OpenAI privacy notice · Google privacy notice
Overseas processing
Our providers may process information outside the UK, including in the United States and Europe. For website data, OpenAI’s ChatGPT Sites agreement includes approved standard contractual clauses and the UK international-transfer addendum. Stripe and Google describe their use of recognised adequacy arrangements, including the UK Extension to the EU–US Data Privacy Framework for covered US transfers, and approved contractual safeguards where required. Names.co.uk is a UK provider; its data-processing agreement requires protections when its service providers process information overseas. We keep a record of the safeguards for the services we use. You can contact us for information or a copy of the applicable safeguards.
Website hosting safeguards · Stripe transfer safeguards · Google transfer safeguards · Names.co.uk data-processing agreement
How long we keep it
As a sole trader, we keep order, invoice, expense and refund records for at least five years after the 31 January tax-return submission deadline for the relevant tax year. We keep records longer where required by law or needed for an unresolved complaint or legal claim. Ordinary customer enquiries are normally deleted 12 months after resolution, unless needed for an order, warranty, complaint or dispute. Within the business, access to customer details is limited to Daemon Bull and Darren Bull, who assist with running the shop. Service providers receive only the information needed for their services. Google Analytics is configured for two-month retention of individual user and event data, with reset on new activity switched off. Standard aggregated reports follow separate retention rules. Optional analytics consent is renewed after six months; Google Analytics cookies are configured with a maximum six-month lifetime.
Your rights
Depending on the circumstances, you may request access, correction, deletion, restriction or portability, and object to processing based on legitimate interests. You can withdraw analytics consent at any time without affecting earlier lawful processing. Email Daemon@badboostsbargains.co.uk. You can complain to the Information Commissioner’s Office.
Cookies and device storage
Essential local storage remembers your shared basket; session storage remembers where you were when opening checkout. Consent storage remembers your cookie choice for six months. Security and Stripe checkout may use storage necessary for the requested service. These functions do not need optional analytics consent.
Google Analytics is optional. It loads only after you choose Accept analytics. Rejecting is as easy as accepting. We do not enable advertising signals or advertising personalisation. Analytics cookies generally have names beginning _ga; their expiry is capped by the remaining six-month consent period. Google Analytics runs on our bundle-box shopping page, not on the private order-confirmation page. We exclude query strings, URL fragments and referring-page details from our configured page-view data. Rejecting or withdrawing clears our analytics cookies and stops the tag in other open tabs. You can change your choice below using the Cookie settings link on any page.
Cookie settings
Request deletion of earlier analytics data
Withdrawing consent stops future analytics and clears cookies on this browser. It does not itself delete earlier data held by Google. To request deletion, email Daemon@badboostsbargains.co.uk and include your analytics reference below if available. Different browsers and devices can have different references. You can save the reference before clearing cookies; we also display it when you withdraw here. The reference is shown only on this page and is not saved by this feature.
If you have already cleared cookies, or the reference is unavailable, contact us so we can assess whether the earlier data can be identified. We do not require you to accept analytics again. Google processes user-deletion requests separately; anonymised aggregate reports may remain.