Privacy Policy
Last updated: October 2026
Surprise Me HQ ("we", "us", "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your information when you visit our website or place an order with us.
We operate as a UK-based sole trader and process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who We Are
Surprise Me HQ is a UK-based small business selling mystery gift bundles and related add-on services online.
For data protection enquiries, please contact us at: admin@surprisemehq.co.uk
What Personal Data We Collect
When you place an order or interact with our website, we may collect the following personal data:
- Identity data: your name
- Contact data: email address, delivery address, phone number
- Transaction data: details of products purchased and payment information (processed securely via Shopify Payments — we do not store card details)
- Special instructions: any preferences, requests, gift messages, preferred upload dates, or social media handles you provide at checkout
- Technical data: IP address, browser type, and website usage data collected via cookies
How We Use Your Personal Data
We use your personal data for the following purposes:
- To process and fulfil your order
- To communicate with you about your order, including dispatch and delivery updates
- To create and deliver your Social Media Video Add-On, including tagging your social media handle if provided
- To respond to enquiries and customer service requests
- To comply with our legal obligations
- To improve our website and services
Social Media Handles
If you choose to provide your social media handle as part of the Special Instructions at checkout (for example, when purchasing our Social Media Video Add-On), we will use this solely for the purpose of tagging you on our social media platforms when your video is published. We will not use your handle for any other purpose or share it with third parties.
Legal Basis for Processing
We process your personal data on the following legal bases:
- Contract performance: to fulfil your order and provide the services you have purchased
- Legitimate interests: to improve our services and communicate with you regarding your order
- Legal obligation: to comply with applicable laws and regulations
Sharing Your Data
We do not sell your personal data to third parties. We may share your data with trusted third-party service providers where necessary to fulfil your order, including:
- Shopify: our e-commerce platform provider, which hosts our store and processes payments
- Postal and courier services: for order delivery
All third parties are required to handle your data securely and in accordance with applicable data protection law.
Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy, or as required by law. Order records are typically retained for up to 7 years in line with HMRC requirements.
Your Rights
Under UK GDPR, you have the following rights regarding your personal data:
- The right to access your personal data
- The right to rectify inaccurate data
- The right to erasure ("right to be forgotten"), where applicable
- The right to restrict processing
- The right to data portability
- The right to object to processing
To exercise any of these rights, please contact us at admin@surprisemehq.co.uk. We will respond within one month.
Cookies
Our website uses cookies to improve your browsing experience and to help us understand how our site is used. You can manage your cookie preferences via the cookie consent banner on our website.
Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date. We encourage you to review this policy periodically.
Contact & Complaints
If you have any questions or concerns about how we handle your personal data, please contact us at admin@surprisemehq.co.uk.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk.