Privacy policy

Last updated: October 16, 2026

1. Who We Are

Earthlings is a trading name of Sapling Innovation Ltd, a company registered in England and Wales. We are the data controller for the personal information described in this policy, which means we decide how and why your personal information is processed.

Correspondence address: Sapling Innovation Ltd, Unit 174172, PO Box 7169, Poole, BH15 9EL, United Kingdom

Data protection contact: datacontroller@earthlings.online

This is the address to use for any question about this policy, to exercise a data protection right, or to raise a concern about how we handle your personal information. See Section 9 for your rights and Section 10 for how to complain.

This policy applies to earthlings.online, our Shopify-hosted store, and our presence on Instagram, Facebook, Pinterest and Google where we interact with you as a business. It explains what personal information we collect, why, who we share it with, and the rights you have over it.

2. Information We Collect

"Personal information" means information that identifies or can reasonably be linked to you. We may collect the following categories, depending on how you interact with us:

  • Contact details — name, billing and delivery address, phone number, email address
  • Order and payment information — items purchased, order history, payment confirmation (we do not store full card numbers ourselves — see Section 4)
  • Account information — username, password, preferences, if you create an account
  • Communications — anything you send us through the contact form, email, or social media
  • Device and usage information — IP address, browser type, pages viewed, and how you interact with the site, collected automatically through cookies and similar technologies (see Section 5)

Where we get it from:

  • Directly from you — when you place an order, create an account, or contact us
  • Automatically — through cookies and similar technologies when you use the site
  • From our service providers — Shopify and the payment, delivery and marketing tools listed in Section 4

3. How We Use Your Information

Under UK GDPR, we must have a lawful basis for every use of your personal information. Here is what we use it for and which basis applies:

What we do

Why

Lawful basis

Process and fulfil your order, take payment, arrange delivery

To perform our contract with you

Contract

Provide customer support and respond to enquiries

To perform our contract, or respond to your request

Contract / Legitimate interests

Send order and delivery confirmations

To perform our contract with you

Contract

Send marketing emails about new products or offers

You have told us you want to hear from us

Consent

Show you ads on Instagram, Facebook, Pinterest or Google based on your activity on our site

To grow our business efficiently, balanced against your right to privacy

Legitimate interests (and consent for non-essential cookies — see Section 5)

Detect and prevent fraud, keep the site secure

To protect our business and our customers

Legitimate interests

Comply with tax, accounting and other legal obligations

Required by law

Legal obligation

Where we rely on legitimate interests, we have considered that interest against your right to privacy and concluded our processing is reasonable and proportionate. You can ask us for details of this assessment, or object to this processing, at any time — see Section 9.

4. How We Share Your Information

We do not sell your personal information. We share it with the following categories of recipient, for the purposes described below.

Shopify

Our store is built on Shopify, which processes personal information on our behalf to provide hosting, checkout, payment processing and order management. Shopify acts as our data processor for these functions, and separately as a controller for its own enhanced features (such as fraud prevention across its merchant network). Details: Shopify's Consumer Privacy Policy. You can exercise rights over data Shopify processes directly via the Shopify Privacy Portal.

Meta (Facebook and Instagram)

We use Meta's business tools — including the Meta Pixel and Conversions API — through Shopify's Facebook & Instagram sales channel, with "Enhanced" data sharing enabled. This means that when you visit our site or make a purchase, information such as your IP address, device information, pages viewed, and purchase activity (including hashed contact details for advanced matching) is shared with Meta Platforms Ireland Limited. Meta uses this to help us measure and target advertising on Facebook and Instagram, and to power our Instagram and Facebook Shop listings. Meta is an independent controller of this data once received. You can review Meta's own privacy policy and manage how Meta uses your data for ads at Meta's Privacy Centre and in your Facebook ad settings.

Google (Google & YouTube)

We use Google's Google & YouTube sales channel, which places a Google tag on our site and lists our products on Google Shopping via Google Merchant Center. This shares information such as cookies or device identifiers, IP address, and browsing and purchase activity with Google Ireland Limited, which Google may use to support both personalised and non-personalised advertising and to measure ad performance. You can control how Google uses this information, including withdrawing consent, through Google's Ads Settings and can read more at Google's Privacy & Terms.

Pinterest

We use the Pinterest sales channel, which places the Pinterest tag on our site to sync our product catalogue for Pinterest Shopping and to measure and target advertising. This shares information about your visit and activity on our site with Pinterest Europe Limited, for online behavioural advertising. You can opt out of this at Pinterest's ad settings or via Your Online Choices.

Other recipients

  • Service providers who support our operations — payment processing, delivery couriers, email and customer support tools — under contracts that require them to protect your data
  • Professional advisers — our accountant, solicitor or insurer, where necessary
  • Legal and regulatory bodies — where required by law, to establish or defend legal claims, or to protect the rights, property or safety of Earthlings, our customers, or others
  • A buyer or successor — in the event of a sale, merger or restructuring of the business

You have a right to object to your data being shared for advertising purposes at any time — see Section 9.

5. Cookies and Similar Technologies

Cookies are small files stored on your device. Under the Privacy and Electronic Communications Regulations (PECR), alongside UK GDPR, we need your consent before we can use non-essential cookies.

Required — essential for the site to work: keeping items in your basket, letting you log in, remembering your cookie choices, and security. These do not require consent.

Personalization — stores details about your actions on earthlings.online so we can tailor your next visit to the site.

Marketing — used by us and our partners, including Shopify, Meta, Google and Pinterest (see Section 4), to optimise marketing communications and show you more relevant ads, on and off our site.

Analytics — help us understand how you interact with the site, so we can identify areas to improve.

When you first visit earthlings.online, a cookie consent banner appears, explaining that we and our partners (including Shopify) use cookies and similar technologies for personalisation, marketing and analytics, and that we will not use them for these purposes unless you accept. You can Accept all, Decline all, or select Manage preferences to choose which of the categories above you consent to individually. You can change your choice at any time by selecting Cookie preferences in the website footer, or by managing cookies through your browser settings.

6. International Transfers

Some of the organisations we share your data with — including Shopify, Meta, Google and Pinterest — may process it outside the UK, including in the United States.

Where this happens, we rely on one of the following safeguards, as applicable:

  • UK adequacy regulations — where the UK government has decided a country offers an adequate level of data protection
  • The UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses with the UK Addendum — our standard safeguard for transfers to the US and other non-adequate countries
  • The UK extension to the EU-US Data Privacy Framework — where the receiving organisation is self-certified under this framework (Meta and Google are both self-certified)

You can request more information about the safeguards we use for a specific transfer by contacting datacontroller@earthlings.online.

7. Data Retention

We keep personal information only as long as we need it for the purpose it was collected, including to satisfy any legal, accounting or reporting requirements. As a guide:

  • Order and transaction records — kept for 6 years, in line with UK tax and accounting obligations
  • Account information — kept while your account is active, and for a reasonable period afterwards in case you return
  • Marketing preferences — kept until you unsubscribe or ask us to delete them
  • Data processed by Meta, Google and Pinterest for advertising — retained according to each platform's own retention periods, set out in their respective privacy policies linked in Section 4

When personal information is no longer needed, we delete it or anonymise it so it can no longer identify you.

8. Children's Data

Our products are made for children, but our Services — the website, account creation and checkout — are intended for use by adults. We do not knowingly collect personal information directly from children under 13, the age at which UK data protection law allows a child to consent to their own data being processed.

If you are a parent or guardian and believe your child has provided us with personal information, contact datacontroller@earthlings.online and we will delete it.

9. Your Rights Under UK Data Protection Law

Under UK GDPR, you have the right to:

  • Access — ask for a copy of the personal information we hold about you
  • Rectification — ask us to correct inaccurate or incomplete information
  • Erasure — ask us to delete your personal information, in certain circumstances
  • Restriction — ask us to limit how we use your information
  • Portability — ask for your information in a portable format, or ask us to transfer it to another organisation
  • Object — object to processing based on legitimate interests, including for direct marketing — we will always stop using your data for marketing if you object
  • Withdraw consent — where we rely on consent (such as marketing emails or advertising cookies), withdraw it at any time, without affecting processing already carried out

These rights are not absolute and may not apply in every circumstance. To exercise any of them, contact datacontroller@earthlings.online. We will respond within one month, and we may need to verify your identity first. We will not charge a fee, unless a request is clearly unfounded or excessive.

10. How to Complain

If you're unhappy with how we've handled your personal information, please contact us first at datacontroller@earthlings.online so we can try to put it right. We will acknowledge your complaint and let you know the outcome.

If you're not satisfied with our response, you have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO) Website: ico.org.uk/make-a-complaint Helpline: 0303 123 1113 Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

11. Changes to This Policy and Contact Us

We may update this policy from time to time, including to reflect changes in our practices, the tools we use, or the law. We'll update the "Last updated" date at the top of this page when we do, and let you know directly if a change is significant.

Questions about this policy or your data? Email: datacontroller@earthlings.online Post: Sapling Innovation Ltd, Unit 174172, PO Box 7169, Poole, BH15 9EL, United Kingdom