Privacy notice
ISHTAR JEWELLERY LIMITED is the data controller for personal data collected through this website. This notice explains what we collect, why, on what legal basis, how long we keep it and what you can require us to do about it.
Last updated 12 August 2026
Who we are
ISHTAR JEWELLERY LIMITED, a private limited company registered in England and Wales, trading as Ishtar Stones. Registered office and trading address: 346 Kilburn Lane, London, W9 3EF, United Kingdom. For any question about this notice or about the data we hold, write to support@ishtarjewellery.shop or to the postal address above, marked for the attention of the data protection contact.
What we collect and why
| Data | Why we hold it | Legal basis | Kept for |
|---|---|---|---|
| Name, email, phone, delivery address | To take, fulfil and deliver your order and to contact you about it | Performance of a contract | 6 years from the end of the tax year of the order, for accounting and tax |
| Order contents, prices, consents recorded at checkout | Order record, VAT record, and evidence of what was disclosed to you and when | Legal obligation and legitimate interests | 6 years from the end of the tax year of the order |
| Contact form and stone enquiry submissions | To answer you and keep a record of the exchange | Consent, and legitimate interests in responding to enquiries | 24 months from the last contact |
| Email address for the mailing list | To send occasional emails about new pieces and care advice | Consent | Until you unsubscribe, then 12 months to prove the unsubscribe was honoured |
| Review text and display name | To publish reviews and to moderate them before publication | Consent | 3 years from submission, or until you ask us to remove it |
| Basket contents held in your browser | To remember what you put in your basket between pages | Strictly necessary for a service you asked for | Held in your browser only, until you clear it |
| Analytics, if you agree to it | To count visits and see which pages are used | Consent | 14 months |
We do not collect or store card details on this website. When a payment step is in operation, card details are entered on the payment provider’s own hosted page and are never transmitted to or stored by us. We may hold the last four digits and the card type as part of the order record so that a refund can be matched to the right payment.
We do not collect special category data. We do not ask about health, beliefs or anything of that kind, and we would ask you not to volunteer it. If you send us something in that category in a message, we will delete it once your enquiry is closed.
Children
This shop is for adults. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, tell us and we will delete it.
Who we share it with
- Delivery carriers — name, address and phone number, so the parcel can be delivered.
- Our payment provider — where a payment step is in operation, to take payment and process refunds and disputes. They act as a controller in their own right for fraud prevention.
- Our hosting and database providers — as processors, under written terms that restrict them to acting on our instructions.
- Our accountant, and HMRC — for tax and VAT records.
- Professional advisers, regulators or a court — where we are required to, or need to establish or defend a legal claim.
We do not sell personal data, and we do not share it for anyone else’s marketing.
Transfers outside the UK
Some of our processors operate infrastructure outside the United Kingdom. Where personal data is transferred outside the UK it is protected either by UK adequacy regulations for the destination country, or by the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. Ask us and we will tell you which mechanism applies to a particular processor.
How we protect it
The site is served over HTTPS. Access to order and enquiry records is restricted to the people who need it, protected by individual accounts and multi-factor authentication. Databases are encrypted at rest and backups are encrypted. We review access periodically and remove it when it is no longer needed. Where a personal data breach is likely to result in a risk to your rights and freedoms we will report it to the Information Commissioner within 72 hours, and tell you directly where the risk is high.
Your rights
Under the UK GDPR and the Data Protection Act 2018 you have the right to:
- be told what we hold about you and get a copy of it — a subject access request;
- have inaccurate data corrected;
- have data erased, where we no longer have a reason to hold it;
- restrict how we use it while a dispute about accuracy or our grounds is resolved;
- receive data you gave us in a portable, machine-readable form, and have it sent to another controller;
- object to processing based on our legitimate interests;
- object to direct marketing at any time, with no exceptions and no need to give a reason;
- withdraw consent at any time, where consent is the basis we rely on — which does not affect processing carried out before you withdrew it.
Write to support@ishtarjewellery.shop. We respond within one month, and there is no charge. We may ask you to confirm your identity before we release personal data.
Note that some data cannot be erased on request while we still need it — most obviously, order and VAT records that we are required to keep for six years. Where that applies we will tell you which records are affected and why.
Automated decision-making
We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you. The month finder and the enquiry form apply fixed rules about hardness and treatment to our own catalogue; they make no assessment of you.
Complaining to the ICO
If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You also have the right to complain to the UK supervisory authority at any time:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline 0303 123 1113. ico.org.uk/make-a-complaint.
Cookies
Cookies and similar technologies are covered separately in the cookie policy, which lists every cookie we set, what it does and how long it lasts, and lets you change your choice at any time.
Changes to this notice
We update this notice when what we do changes. The date at the top of the page is the date of the current version. Where a change materially affects how we use data you have already given us, we will tell you directly.