Privacy Policy

GrailVault — a trading name of Dan Alexander Ltd
Last updated: 22 October 2026

1. Who we are

GrailVault (https://grailvault.co.uk) is operated by Dan Alexander Ltd, registered in England and Wales (company number 15912169). Dan Alexander Ltd is the data controller for personal information we process in running GrailVault, except where another organisation acts as an independent controller. Our online shop is powered by Shopify, which processes information to operate and support the store and may act independently for certain services, as explained below.

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and applicable UK privacy and electronic communications law.

2. Information we collect

Depending on how you interact with GrailVault, we may collect:

• Identity and contact details: name, email address, telephone number, billing and delivery addresses.
• Order and payment information: products ordered, amounts paid, payment status, transaction references, delivery information, returns and order history. Payment providers process card details; we do not intentionally store full card numbers or security codes in our own systems.
• Account information: account identifiers, preferences and relevant account activity, if you create or use a customer account.
• Enquiries and correspondence: messages, customer service requests and related records.
• Technical and browsing information: IP address, browser and device details, cookie identifiers, pages viewed, basket activity, referring websites and interactions with the store.
• Marketing preferences: subscription choices and records of consent or opt-outs.

We obtain information from you, automatically through our website, and where relevant from Shopify, payment providers, delivery partners and other service providers. We may receive order or fulfilment information from connected marketplaces where an integration is enabled.

3. How and why we use information

Under UK GDPR, we rely on an appropriate lawful basis for each purpose:

We may send service messages about purchases, dispatch, returns or account security even if you have opted out of promotional messages.

4. Shopify and payment processing

Our store is hosted by Shopify. Shopify processes information required to deliver the website, checkout, customer accounts, transactions, security and related services. Depending on the Shopify features enabled, Shopify may also process information to improve its services and provide enhanced features, including advertising-related features. Shopify may act as an independent controller for some of these activities. See Shopify's consumer privacy information and its privacy portal.

Payments are processed by Shopify Payments and/or other payment methods shown at checkout. The relevant payment provider processes payment details under its own applicable terms and privacy notices. We receive transaction confirmations and information needed to manage orders, rather than full card security details.

5. Cookies, analytics and advertising

Our website uses essential technologies for functions such as basket management, checkout, security and remembering necessary settings. If enabled, analytics and advertising technologies may help us understand website performance, measure promotions or show relevant advertising.

Where UK law requires consent for non-essential cookies or similar tracking, we will seek it before using them. You can manage available choices through the site's cookie/privacy preferences and can also adjust your browser settings. Rejecting non-essential cookies should not prevent you from using essential shopping functions.

Before publishing: confirm Shopify's customer privacy settings and consent banner are configured to match the cookies, pixels and advertising features actually enabled.

6. Marketing

If you subscribe to GrailVault updates, or where otherwise lawfully permitted, we may send news about new collectables, special offers and releases. Each marketing email will provide an unsubscribe option. You can also contact us to withdraw consent or object to direct marketing. We will continue to send necessary transactional messages.

7. Who we share information with

We may disclose relevant information to:

• Shopify and enabled e-commerce applications that support store operation;
• payment and fraud-prevention providers;
• delivery companies and postal operators;
• email, customer support, hosting, IT and analytics providers where used;
• connected sales marketplaces, such as eBay or Whatnot, only where integrations are enabled and relevant to order or stock management;
• professional advisers, regulators, law enforcement or other recipients where legally required or justified.

We share only information reasonably necessary for the relevant purpose. Third parties may act as processors on our instructions or as independent controllers. Their own privacy notices may apply. We do not sell customer contact lists. Some advertising-related data sharing may be treated differently under overseas privacy laws; the relevant Shopify disclosures and customer choices apply where required.

8. International transfers

Shopify and other providers may process information outside the UK. Where UK data protection law requires safeguards for restricted international transfers, we rely on applicable adequacy regulations or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or UK Addendum, as relevant.

9. How long we keep information

We retain information only as long as necessary for the purposes described, including fulfilment, customer service, disputes and legal obligations. Accounting and transaction records are generally retained for the period required by applicable tax and company record-keeping rules, commonly six years, subject to the type of record and any longer legal requirement. Marketing records are retained while relevant and lawful, including suppression records needed to honour opt-outs. Information no longer required is deleted or anonymised where reasonably practicable.

10. Security

We use appropriate technical and organisational measures to protect personal information, including secure website connections and access controls. Payment information is handled by authorised payment providers. No electronic system can be guaranteed completely secure; please avoid sending full payment card details by email or contact form.

11. Your rights

Subject to applicable exceptions, you may have rights to access your personal information, correct inaccuracies, request erasure, restrict or object to processing, receive portable data in relevant circumstances and withdraw consent where consent is the lawful basis. You have an absolute right to object to processing for direct marketing.

You may exercise your rights by contacting privacy@danalexanderltd.co.uk. We may need to verify your identity and will respond within the time limits required by law, generally one month, subject to permitted extensions. For personal information processed independently by Shopify, you may also use Shopify's privacy portal.

12. Children

Our collectables may appeal to customers of different ages, but online purchases are intended for people legally able to enter into a contract, or those acting with appropriate parental or guardian involvement. We do not knowingly seek personal information from children for independent purchasing. Contact us if you believe a child's information has been provided inappropriately.

13. External websites

Our website may link to third-party services and marketplaces. Their privacy practices are governed by their own notices. Please review those notices when leaving our website or using a third-party service.

14. Complaints

If you have concerns about our handling of personal information, please contact us first so we can investigate. You may also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: https://ico.org.uk or 0303 123 1113.

15. Changes to this policy

We may update this policy when our services, suppliers or legal obligations change. We will publish the updated version here with a revised date and provide additional notice where required by law.

16. Contact and business details

GrailVault is a trading name of Dan Alexander Ltd.
Company number: 15912169
Registered office: 82A James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE
VAT registration number: GB497621254
Website: https://grailvault.co.uk
Customer enquiries: hello@danalexanderltd.co.uk
Privacy enquiries: privacy@danalexanderltd.co.uk