Privacy Policy
Privacy Policy
Last updated: 30/9/2026
Who we are
Zero Bonsai ZERO BONSAI LTD,
Flat 84 Allestree Lane Allestree Derby DE22 2HT Reg 13360652
We are the data controller for the personal information described here.
Contact: shop@zerobonsai.com
What this covers
Our website at zerobonsai.com, our shop, and the customer accounts and rewards scheme that run alongside them.
Our website and our checkout are two different systems. Browsing, your account and your points are on our own website. Paying is handled by Shopify. Both are described below.
What we collect, and why
When you buy something
What: your name, email address, delivery and billing address, phone number if you give one, what you ordered, and the amount paid. Card details are handled by Shopify and its payment providers, and we never see or store them.
Why: to take payment, send you the order, and keep records we are required to keep.
Our lawful basis: performing our contract with you, and our legal obligation to keep sales records.
When you create an account
What: your email address, your name, a scrambled version of your password that cannot be reversed, and a record of when you signed in and from where.
Why: so you can sign in, see your orders, save delivery addresses and take part in the rewards scheme. The sign-in record is there so you can tell if somebody else has been using your account.
Our lawful basis: performing our contract with you, and our legitimate interest in keeping accounts secure.
The rewards scheme
What: a record of every order that earned or spent points, the amount, the date, and the star rating it contributes to.
Why: to work out your points balance and your star rating, and to show you how they were arrived at.
Our lawful basis: performing our contract with you.
What: your email address, which emails we sent you and when, and whether they arrived.
Why: to send you things about your account, and marketing if you have asked for it.
Our lawful basis: performing our contract for account email such as confirming your address or resetting your password, which we send whatever your preferences, because they are how you would find out if somebody else were using your account. Marketing email is sent only with your consent, and you can withdraw it at any time.
When you use the website
What: pages you visited, your IP address, and your browser.
Why: to keep the site working, to stop abuse such as repeated sign-in attempts, and to understand how the shop is used.
Our lawful basis: our legitimate interest in running and protecting the site.
Cookies
We use as few as we can.
| Cookie | What it does | How long |
|---|---|---|
| Your basket | Remembers what is in your basket | Until It Expires |
| Signed in | Keeps you signed in | Up to 30 days, or 14 days without use |
Shopify sets its own cookies when you reach checkout. Shopify's own privacy policy covers those.
Who else handles your information
We use these companies to run the shop. Each is bound by a contract that limits what they may do with it.
| Who | What they handle | Where |
|---|---|---|
| Shopify | Orders, payment, checkout, customer records, our shop's admin | Canada and the United States, under approved safeguards |
| Neon | Our own database: accounts, sign-in records, points | London, United Kingdom |
| Vercel | Hosting the website, and its logs | London, United Kingdom |
| Resend | Sending account and marketing email | |
| Sanity | Our articles and guides. No customer information. |
Some of these are outside the UK. Where that is the case, transfers are covered by the UK's approved safeguards, such as the International Data Transfer Addendum.
We do not sell your information, and we do not share it for anyone else's advertising.
How long we keep it
| What | How long |
|---|---|
| Orders and sales records | SIX YEARS, the usual period for tax records. |
| Your account | Until you ask us to delete it |
| Sign-in records | Alongside your account |
| Points records | Alongside your account. Individual points expire twelve months after you earn them. |
| A record of emails we sent you | Twelve months |
| Anti-abuse counters | About a day |
Your rights
Under UK data protection law you can ask us to:
- Tell you what we hold about you, and give you a copy
- Correct anything that is wrong
- Delete your information. We have a tested process for this; see below
- Give you your information in a form you can take elsewhere
- Stop using it for certain things, or object to how we use it
- Stop sending you marketing, at any time, with no reason needed
Email shop@zerobonsai.com and we will reply within one month.
If you ask us to delete your information
Being straight about what that reaches, because no shop can delete everything everywhere:
We remove your email address, name and addresses from our database, and your customer record from Shopify. Where you have placed orders, Shopify keeps the order itself with the personal details stripped out, because we are required to keep sales records.
What remains is a record that orders happened, with the amounts, but nothing identifying you.
What we cannot reach: emails already sent to you; copies held by the companies above within their own retention periods; and our database's own backups, until those age out, which takes up to 1 year.
Complaints
If you are unhappy with how we have handled your information, please tell us.
Keeping your information safe
Passwords are stored scrambled using a method designed to resist being cracked, and we never store the password itself. Information is encrypted while it travels to us and while it is stored. Access to customer information is limited to the people who run the shop.
Children
Our shop is not aimed at children, and we do not knowingly collect information about anyone under 16. If you believe we hold information about a child, please tell us and we will remove it.
Changes
If we change this policy we will update the date at the top. If a change matters to you, we will tell you.