Privacy & Cookies Policy

Last updated: 31 July 2026

Poppy's Picnic is the trading name of Four Legs Are Better Than Two Ltd (company number 09522208), registered in England and Wales with its registered office at Sloperton Farm, Westbrook, Bromham, Chippenham, Wiltshire, SN15 2ED, United Kingdom ("we", "us", "our").

We are the data controller responsible for your personal data. We are committed to protecting your personal data and respecting your privacy. This policy explains what we collect, how we use it, how long we keep it, who we share it with, and the rights you have, in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

We are registered with the Information Commissioner's Office (ICO) under registration number ZA529599.

1. Contact Details

If you have any questions about this policy or wish to exercise your rights, you can reach us at:

Post: Poppy's Picnic, Sloperton Farm, Westbrook, Bromham, Chippenham, Wiltshire, SN15 2ED, United Kingdom

Email: paws@poppyspicnic.co.uk

Data Protection Contact: paws@poppyspicnic.co.uk

1. What We Collect

We may collect and process the following categories of personal data when you use our services, subscribe to our communications, or interact with our website:

• name and contact details;
• email address;
• delivery and billing address;
• mobile telephone number (where you opt in to SMS);
• WhatsApp number and messaging opt-in (where you choose to contact us or opt in via WhatsApp);
• approximate location (derived from your IP address);
• account login details;
• preferences and interests;
• information about your pet (such as its name, age, and any ailments or dietary requirements);
• purchase and order history;
• subscription and loyalty programme details;
• website and app usage data (including cookies and similar technologies, user journeys and IP addresses);
• marketing preferences and consent records;
• call recordings; and
• complaints and other correspondence with us.

We do not store credit or debit card details. Payments are processed securely by Stripe and PayPal.

1. How We Use Your Information and Our Lawful Bases

We use your personal data only where we have a lawful basis to do so under the UK GDPR. The table below sets out our purposes and the corresponding lawful basis.

Purpose	Lawful basis
To process, fulfil and deliver your orders and manage your account	Performance of a contract
To manage subscriptions, loyalty and referral programmes	Performance of a contract
To contact you about your order or respond to queries or complaints	Performance of a contract; legitimate interests
To send marketing emails or SMS where you have opted in or where the soft opt-in applies	Consent; legitimate interests (see clause 4)
To provide service updates and improve our products, website and services	Legitimate interests
To detect, prevent and investigate fraud and to keep our systems secure	Legitimate interests
To keep accounting and tax records and comply with other legal obligations	Legal obligation

Where we rely on legitimate interests, we have carried out a balancing assessment to ensure our interests are not overridden by your rights. You may ask us for further information about this assessment at any time.

1. Marketing and SMS Consent

Where required, we will only send you marketing communications if you have given your consent. In some cases we may send you marketing about our own similar products or services under the PECR "soft opt-in" — that is, where you have bought from us (or negotiated to buy) and were given a clear opportunity to opt out when we collected your details.

You can unsubscribe from marketing emails at any time using the link in any message or by emailing paws@poppyspicnic.co.uk. You can opt out of marketing SMS at any time by replying STOP or by contacting us by email. Every marketing message we send includes a simple, free way to opt out.

Where you opt in to receive WhatsApp messages from us, we send these through our messaging provider, BiteSpeed. WhatsApp marketing requires your specific consent — agreeing to email or SMS marketing does not cover WhatsApp, and vice versa. You can opt out at any time by replying STOP to any WhatsApp message or by emailing paws@poppyspicnic.co.uk. Every message we send includes a simple, free way to opt out.

We store SMS opt-in details and engagement history. SMS data is shared only with message delivery providers acting on our instructions.

1. How Long We Keep Your Data

We keep personal data only for as long as necessary for the purposes for which it was collected:

• customer account and marketing data: up to three years after your last order or interaction, unless you place a further order or ask us to delete it earlier;
• accounting and tax records: six years, as required by law; and
• in certain cases where personal data has been erased, we retain minimal information to ensure deletion requests are honoured and not overridden by new activity.

1. Your Rights

Under the UK GDPR, you have the right to:

• be informed about how we use your data;
• access your personal data;
• have inaccurate or incomplete data corrected;
• have your data erased in certain circumstances;
• restrict or object to our processing;
• data portability;
• withdraw consent at any time, where we rely on consent; and
• object to direct marketing at any time.

To exercise any of these rights, please contact us at paws@poppyspicnic.co.uk. We will respond within one month. You also have the right to complain to the Information Commissioner's Office (see clause 12).

1. How We Protect Your Data

We use encrypted transfers, secure storage systems, and restrict access to authorised staff only. We have appropriate technical and organisational measures in place to protect your personal data against unauthorised access, loss or misuse.

1. Third-Party Services

We never sell your data. We share it only where necessary with trusted service providers who process it on our behalf and under our instructions, including:

• Stripe – payment processing;
• PayPal – payment processing;
• Shopify – ecommerce and order fulfilment;
• DPD – delivery service;
• ShipStation – shipping management and order fulfilment;
• Mailchimp – email marketing;
• Intercom – customer support;
• BiteSpeed – WhatsApp customer messaging and marketing;
• WhatsApp (Meta Platforms Ireland Limited) – messaging channel used to deliver our WhatsApp communications;
• Facebook and Instagram (Meta Platforms Ireland Limited) – social media, advertising, retargeting and audience measurement;
• Awtomic – subscription management;
• Smile.io – loyalty and rewards programme; and
• ReferralCandy – referral marketing management.

We may also disclose your data where required to comply with a legal obligation, to enforce our terms, or to protect our rights, property or safety.

1. International Data Transfers

Some of our service providers process personal data outside the UK. For example, our WhatsApp messaging provider BiteSpeed is based in India, and WhatsApp/Meta may process data in the United States or other countries. Where we transfer personal data outside the UK, we ensure an appropriate safeguard is in place, such as:

• a transfer to a country covered by UK adequacy regulations; or
• the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

You can request further information about the safeguards we use, or a copy of them, by emailing paws@poppyspicnic.co.uk.

1. Cookies

Cookies and similar technologies are small files or identifiers stored on or read from your device. They help our site function, help us understand how it is used, remember your settings, and deliver relevant marketing.

We use the following categories:

• Strictly necessary – essential for core functions such as the basket and checkout. These do not require consent;
• Performance/analytics – help us understand how the site is used;
• Functionality – remember your preferences and settings; and
• Targeting/advertising – used for marketing and personalisation. This includes the Meta pixel (used for Facebook and Instagram advertising), which relies on cookies such as _fbp to measure the performance of our ads and show you relevant marketing on those platforms.

We set non-essential cookies (including targeting and most analytics and functionality cookies) only where you have given your consent. When you first visit our site, our cookie banner lets you accept or reject each category of non-essential cookie, and you can change your preferences at any time via the "Cookie settings" link at the foot of every page. You can also control cookies through your browser settings. Disabling cookies may affect how the site functions.

1. Links to Other Websites

Our site may link to other websites. We are not responsible for the content or privacy practices of those sites. Please check their own privacy policies.

1. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at paws@poppyspicnic.co.uk so we can try to resolve the matter. You also have the right to complain to the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/

1. Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with a revised "Last updated" date. Where changes are significant, we will take reasonable steps to notify you.