Privacy Policy
PRIVACY POLICY — UNITED KINGDOM
Last updated: 26.08.2026
1. Who we are
1.1 This policy explains how we collect and use personal data. It applies to littlesonny.com (the "Site") and to any purchase you make from us.
1.2 We are Little Sonny Limited trading as Little Sonny, a company registered in England and Wales with company number 17298998, whose registered office is at 207 Knutsford Road, Grappenhall, Warrington, Cheshire, United Kingdom, WA4 2QL. We are the controller of your personal data.
1.3 Our registration number with the Information Commissioner's Office is ZC232006.
1.4 We are not required to appoint a Data Protection Officer. If you have any question about this policy or about how we use your personal data, contact us at hello@littlesonny.com or write to us at the address above.
1.5 We handle personal data in accordance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 ("PECR").
2. What personal data we collect
We collect the following categories of personal data:
When you place an order
- Name
- Email address
- Delivery and billing address
- Telephone number
- Order history and product preferences
- Partial payment card details, being the last four digits and the card type. We never see or store your full card number.
When you contact us
- Name and contact details
- The content of your message, including any photographs or documents you send us in support of a claim
- Records of our correspondence with you
When you use the Site
- IP address
- Device and browser type
- Pages viewed, referring pages and time spent
- Cookie and similar identifiers
When you subscribe to marketing
- Email address and any preferences you tell us about
2.1 Special category data. We do not seek to collect special category data, such as data about health, race, religion or sexual orientation. Please do not send us this information. If you include it in a message to us about a product claim, we will use it only to assess and resolve that claim.
2.2 Children. The Site is intended for adults buying products for use with children. It is not directed at children and we do not knowingly collect personal data from anyone under 18. If you believe we hold data about a child, contact us and we will delete it.
2.3 If you do not provide the personal data we need to fulfil an order, we will not be able to supply the goods to you.
3. How we collect your personal data
3.1 We usually collect personal data directly from you, when you place an order, create an account, subscribe to marketing, contact us or leave a review.
3.2 We also collect data automatically when you use the Site, through cookies and similar technologies. See section 5.
3.3 We may receive data about you from third parties, including our payment provider, our delivery carriers, and advertising and analytics platforms.
4. Why we use your personal data, and our lawful basis
| Purpose | Data used | Lawful basis |
|---|---|---|
| Processing and fulfilling your order | Name, contact details, addresses, order details | Performance of a contract with you |
| Taking payment and preventing fraud | Payment details, billing address, device and IP data | Performance of a contract; our legitimate interests in preventing fraud; compliance with a legal obligation |
| Delivering your order | Name, delivery address, contact details, order contents | Performance of a contract |
| Handling returns, cancellations, refunds and claims | Order details, correspondence, evidence you provide | Performance of a contract; compliance with a legal obligation |
| Product safety, including recalls and incident reporting | Name, contact details, order and product details | Compliance with a legal obligation; protection of vital interests |
| Responding to your enquiries and complaints | Contact details and correspondence | Our legitimate interests in running our business and supporting customers |
| Sending marketing emails | Email address and preferences | Your consent, or our legitimate interests where we are permitted to contact existing customers about similar products |
| Analytics and improving the Site and our products | Site usage data, order data, reviews | Your consent for the cookies used; our legitimate interests in improving what we offer |
| Measuring and targeting advertising | Site usage data, cookie identifiers, hashed contact details | Your consent |
| Meeting our tax, accounting and legal obligations | Order and transaction records | Compliance with a legal obligation |
4.1 Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms. You can ask us for more detail about that assessment, and you have the right to object. See section 9.
4.2 We do not carry out automated decision making that produces legal effects concerning you or similarly significantly affects you.
5. Cookies, analytics and advertising
5.1 We use cookies and similar technologies to operate the Site, remember your basket, understand how the Site is used, and measure and target our advertising.
5.2 The categories we use are:
- Strictly necessary. Required for the Site to work, including your basket and checkout. These do not require your consent.
- Analytics. To understand how visitors use the Site. We use Shopify's built in analytics and Google Analytics.
- Advertising and measurement. To show you our advertising on other platforms and to measure whether it worked. We use Meta, covering Facebook and Instagram, TikTok and Google.
5.3 We place analytics and advertising cookies only with your consent. You give or refuse that consent through the cookie banner when you first visit the Site, and you can change your choice at any time through the cookie preferences on the Site.
5.4 Where we use advertising and measurement tools, data about your activity on the Site, and in some cases a scrambled version of your email address or telephone number, may be shared with Meta, TikTok or Google so that the platform can match your activity to an account and report on advertising performance. This happens through tags in your browser and through direct server to server connections between our systems and those platforms.
5.5 You can also control cookies through your browser settings. Blocking strictly necessary cookies will prevent parts of the Site from working.
5.6 We keep a record of your cookie choices for 12 months, after which we will ask you again.
6. Who we share your personal data with
6.1 We share personal data with the following categories of recipient:
- Shopify, which hosts our online store and processes payments through Shopify Payments
- Evri, which delivers your order within the United Kingdom
- Spacemail, which provides our business email and through which we correspond with you
- Google, Meta and TikTok, for the analytics and advertising purposes described in section 5
- Our professional advisers, including accountants and lawyers, where relevant
- Regulators and authorities, including HM Revenue and Customs, and the Office for Product Safety and Standards or Trading Standards where we are required to report a product safety incident or recall
- A buyer of our business, if we sell or transfer all or part of it
6.2 We do not sell your personal data.
6.3 Payment card details. Full card numbers are collected and processed directly by Shopify Payments. We do not have access to your full card number at any point.
6.4 We require everyone who processes personal data on our behalf to do so under a written contract, to act only on our instructions, and to keep your data secure.
7. International transfers
7.1 We store your personal data in the United Kingdom.
7.2 Some of our service providers process personal data outside the United Kingdom. The countries involved are:
| Recipient | Country |
|---|---|
| Shopify | Canada and the United States |
| The United States | |
| Meta | The United States |
| TikTok | The United States and Singapore |
7.3 Where we transfer personal data outside the United Kingdom, we do so only where one of the following applies: (a) the country has been assessed by the UK government as providing an adequate level of protection, which is the case for Canada in respect of organisations subject to Canadian federal privacy law; (b) the recipient is certified under the UK Extension to the EU US Data Privacy Framework; or (c) we have put in place the International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses, together with any additional safeguards needed.
7.4 You can ask us for a copy of the safeguards we use by emailing hello@littlesonny.com.
8. How long we keep your personal data
8.1 We keep personal data only for as long as we need it:
- Order and transaction records, including batch and product traceability data. 11 years from the date we supplied the product. We hold these for this period because claims about defective products can be brought up to 10 years after a product is supplied, and because it allows us to contact affected customers directly in the event of a product safety recall.
- Accounting and tax records. 7 years, to meet HMRC requirements.
- Customer service and claims correspondence. 7 years.
- Marketing contact details. Until you unsubscribe. We then keep a minimal suppression record indefinitely, so that we do not contact you again.
- Site usage, analytics and cookie data. 14 months.
- Cookie consent preferences. 12 months.
8.2 When we no longer need personal data and are not required to keep it, we delete it or anonymise it.
9. Your rights
9.1 Under data protection law you have the right to:
- Be informed about how we use your personal data, which is the purpose of this policy
- Access a copy of the personal data we hold about you
- Rectification of inaccurate or incomplete data
- Erasure of your data in certain circumstances, sometimes called the right to be forgotten
- Restrict processing of your data in certain circumstances
- Data portability, meaning you can ask us to transfer data you gave us to you or to another organisation, where we process it by automated means on the basis of consent or a contract
- Object to processing based on our legitimate interests
- Object to direct marketing at any time, which is an absolute right
- Withdraw consent at any time, where we rely on consent. This does not affect the lawfulness of anything we did before you withdrew it
9.2 To exercise any of these rights, email hello@littlesonny.com.
9.3 We will respond within one month. If your request is complex or you have made several requests, we may extend this by up to two further months, and we will tell you within one month if that applies.
9.4 There is no charge for making a request. We may charge a reasonable fee, or refuse to act, if a request is manifestly unfounded or excessive, and we will explain our reasons if so.
9.5 We may need to verify your identity before acting on a request.
10. Marketing
10.1 We will send you marketing emails only where you have consented, or where you have bought from us before and we are permitted to contact you about similar products.
10.2 Every marketing email identifies us and includes an unsubscribe link. You can also opt out at any time by emailing hello@littlesonny.com.
10.3 Opting out of marketing does not stop us sending you messages about an order you have placed, such as dispatch confirmations, or messages we are required to send you, such as a product safety recall.
11. Security
11.1 We take appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, and against accidental loss, destruction or damage.
11.2 Our online store is hosted by Shopify. Shopify maintains PCI DSS Level 1 certification for payment processing and encrypts personal data in transit and at rest. In addition, we restrict access to personal data to those who need it to do their job, and we require multi factor authentication on administrative accounts.
11.3 No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11.4 We have a process for dealing with personal data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours. Where it is likely to result in a high risk to you, we will tell you as well.
12. Changes to this policy
12.1 We may update this policy from time to time. The current version is always available at littlesonny.com/privacy and shows the date it was last updated.
12.2 Where a change is significant, we will take reasonable steps to bring it to your attention.
13. Complaints
13.1 If you are unhappy with how we have handled your personal data, please contact us first at hello@littlesonny.com. We will acknowledge within 2 business days and aim to respond substantively within one month.
13.2 You also have the right to complain to the Information Commissioner's Office at any time:
- Website: ico.org.uk
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would appreciate the chance to deal with your concerns first.
Privacy Policy
PRIVACY POLICY — AUSTRALIA
Last updated: 26.08.2026
1. About this policy
1.1 This policy explains how we handle personal information about individuals in Australia. It applies to littlesonny.com (the "Site") and to any purchase you make from us.
1.2 In this policy, "we", "us" and "our" mean Little Sonny Limited trading as Little Sonny, a company registered in England and Wales with company number 17298998, of 207 Knutsford Road, Grappenhall, Warrington, Cheshire, United Kingdom, WA4 2QL.
1.3 We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"). Because we are based in the United Kingdom, we also handle your personal information in accordance with United Kingdom data protection law.
1.4 "Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable.
1.5 If you have any questions about this policy, contact us at hello@littlesonny.com.
2. What personal information we collect
2.1 We collect the following categories of personal information:
When you place an order
- Name
- Email address
- Delivery address and billing address
- Telephone number
- Order history and product preferences
- Partial payment card details (the last four digits and card type). We do not collect or store full card numbers — see section 6.
When you contact us
- Name and contact details
- The content of your message, including any photographs or documents you send us in support of a claim
- Records of our correspondence with you
When you use the Site
- IP address
- Device and browser type
- Pages viewed, referring pages and time spent
- Cookie and similar identifiers
When you subscribe to marketing
- Email address and any preferences you tell us about
2.2 Sensitive information. We do not seek to collect sensitive information (such as health information, racial or ethnic origin, or religious beliefs). Please do not send us sensitive information. If you send us sensitive information in support of a product claim, we will use it only to assess and resolve that claim.
2.3 Government identifiers. We do not collect or use government-related identifiers such as tax file numbers, Medicare numbers or driver licence numbers, and we will not adopt one as our own identifier for you.
2.4 Children. The Site is intended for adults purchasing products for use with children. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe we hold information about a child, contact us and we will delete it.
3. Anonymity and pseudonymity
3.1 You may browse the Site without telling us who you are.
3.2 You may deal with us anonymously or using a pseudonym where it is lawful and practicable to do so — for example, a general product enquiry. We cannot fulfil an order, deliver goods, process a payment or resolve a product claim anonymously, because we need your details to do those things.
4. How we collect personal information
4.1 We usually collect personal information directly from you — when you place an order, create an account, subscribe to marketing, contact us, or leave a review.
4.2 We also collect information automatically when you use the Site, through cookies and similar technologies (see section 5).
4.3 We may receive information about you from third parties, including our payment provider, our delivery carrier, and advertising or analytics platforms. Where we collect your personal information from someone other than you, we will take reasonable steps to make you aware of that collection.
5. Cookies, analytics and advertising
5.1 We use cookies and similar technologies to operate the Site, remember your basket, understand how the Site is used, and measure and target our advertising.
5.2 The categories we use are:
- Strictly necessary — required for the Site to function, including your basket and checkout.
- Analytics — to understand how visitors use the Site. We use Shopify's built-in analytics and Google Analytics.
- Advertising and measurement — to show you our advertising on third-party platforms and to measure whether it worked. We use Meta (Facebook and Instagram), TikTok and Google.
5.3 Where we use advertising and measurement tools, information about your activity on the Site — and, in some cases, a scrambled (hashed) version of your email address or phone number — may be shared with Meta, TikTok or Google so that the platform can match your activity to an account and report on advertising performance. This may happen through tags in your browser and through direct server-to-server connections between our systems and those platforms.
5.4 You can control cookies through your browser settings, and through the cookie preferences available on the Site. Blocking strictly necessary cookies will prevent parts of the Site from working.
5.5 You can opt out of interest-based advertising through the settings offered by the relevant advertising platform.
6. Why we collect, hold, use and disclose personal information
6.1 We use personal information for the following purposes:
| Purpose | Information used |
|---|---|
| Processing and fulfilling your order | Name, contact details, addresses, order details |
| Taking payment and preventing fraud | Payment details, billing address, device and IP information |
| Delivering your order and handling customs clearance | Name, delivery address, contact details, order contents and value |
| Handling returns, refunds and product claims | Order details, correspondence, evidence you provide |
| Product safety, including recalls and mandatory incident reporting | Name, contact details, order and product details |
| Responding to your enquiries and complaints | Contact details and correspondence |
| Sending marketing communications, where permitted | Email address and preferences |
| Improving the Site and our products | Site usage data, order data, reviews |
| Measuring and targeting advertising | Site usage data, cookie identifiers, hashed contact details |
| Meeting our legal, tax and accounting obligations | Order and transaction records |
6.2 We disclose personal information to the following categories of recipient:
- Shopify, which hosts our online store and processes payments through Shopify Payments
- FedEx, which delivers your order and completes customs formalities on our behalf
- Advertising and analytics platforms, as described in section 5
- Spacemail, which provides our business email and through which we correspond with you
- Our professional advisers, including accountants and lawyers, where relevant
- Regulators and authorities, including the Australian Border Force for customs clearance, and the Australian Competition and Consumer Commission where we are required to report a product safety incident or recall
- A purchaser of our business, if we sell or transfer all or part of it
6.3 We do not sell your personal information.
6.4 Payment card details. Full card numbers are collected and processed directly by Shopify Payments. We do not have access to your full card number at any point.
7. Overseas disclosure
7.1 We are based in the United Kingdom. Personal information you provide to us is stored in the United Kingdom.
7.2 By providing us with your personal information, you acknowledge that it will be disclosed to and held by us and our service providers outside Australia.
7.3 The countries in which recipients are likely to be located are:
- United Kingdom — where we store your information and operate our business
- Canada and the United States — where Shopify hosts our online store and processes payments
- The United States — where Google, Meta and FedEx process information
- The United States and Singapore — where TikTok processes information
7.4 Your delivery details are also provided to FedEx's operations in Australia in order to deliver your order.
7.5 Before disclosing personal information overseas, we take steps that are reasonable in the circumstances to ensure the recipient does not breach the Australian Privacy Principles, including entering into contractual arrangements with our service providers that require them to protect personal information.
7.6 We hold your information in the United Kingdom, which has its own comprehensive data protection framework. This does not remove our obligations to you under Australian law.
8. Direct marketing
8.1 We will send you marketing communications only where you have consented, or where consent may be inferred at law — for example, where you have purchased from us and would reasonably expect to hear from us about similar products.
8.2 Every marketing message we send identifies us and includes a functional unsubscribe facility. We will action an unsubscribe request within five business days.
8.3 You can also opt out at any time by emailing hello@littlesonny.com.
8.4 Opting out of marketing does not stop us sending you messages about an order you have placed, such as dispatch confirmations, or messages we are required to send you, such as a product safety recall.
8.5 If you ask us, we will tell you where we obtained your information.
9. Accuracy of your information
9.1 We take reasonable steps to ensure the personal information we collect, use and disclose is accurate, up to date, complete and relevant.
9.2 If your details change, or if you believe the information we hold is inaccurate, contact us at hello@littlesonny.com and we will correct it.
10. Security and retention
10.1 We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.
10.2 Our online store is hosted by Shopify. Shopify maintains PCI DSS Level 1 certification for payment processing, and encrypts personal information in transit and at rest. In addition, we restrict access to personal information to those who need it to do their job, and require multi-factor authentication on administrative accounts.
10.3 No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10.4 We retain personal information only for as long as we need it:
- Order and transaction records, including batch and product traceability data — 11 years from the date we supplied the product. We hold these for this period because claims relating to defective goods can be brought up to 10 years after a product is supplied, and because this enables us to contact affected customers directly in the event of a product safety recall.
- Accounting and tax records — 7 years, to meet United Kingdom and Australian tax requirements.
- Customer service and claims correspondence — 7 years.
- Marketing contact details — until you unsubscribe. We then keep a minimal suppression record indefinitely, so that we do not contact you again.
- Site usage, analytics and cookie data — 14 months.
- Cookie consent preferences — 12 months, after which we will ask you again.
10.5 When we no longer need personal information and are not required to keep it, we destroy it or de-identify it.
11. Data breaches
11.1 We maintain a data breach response process.
11.2 If a data breach occurs that is likely to result in serious harm to any individual whose information is involved, we will notify the affected individuals and the Office of the Australian Information Commissioner ("OAIC") as required by the Notifiable Data Breaches scheme.
12. Accessing and correcting your information
12.1 You may request access to the personal information we hold about you, and ask us to correct it. Contact us at hello@littlesonny.com.
12.2 We will respond to your request within a reasonable period, and ordinarily within 30 days.
12.3 We do not charge for making a request. We may charge a reasonable cost of providing access where a request is complex or requires substantial work, and we will tell you what that cost will be before we incur it.
12.4 We may need to verify your identity before acting on a request.
12.5 In limited circumstances we may refuse access or correction — for example, where giving access would have an unreasonable impact on another person's privacy, or where we are required or authorised by law to refuse. If we refuse, we will tell you why in writing and explain how you can complain.
12.6 If we correct information we have already disclosed to someone else, you may ask us to notify that recipient, and we will take reasonable steps to do so.
12.7 If we refuse to correct information, you may ask us to associate a statement with it noting that you believe it is inaccurate, and we will take reasonable steps to do so.
13. Complaints
13.1 If you believe we have breached the Australian Privacy Principles, contact us at hello@littlesonny.com. Please set out what happened and what you would like us to do.
13.2 We will acknowledge your complaint within 2 business days and aim to respond substantively within 30 days. If we need longer, we will tell you and keep you updated.
13.3 If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:
- Website: oaic.gov.au
- Telephone: 1300 363 992
- Post: GPO Box 5218, Sydney NSW 2001
14. Changes to this policy
14.1 We may update this policy from time to time. The current version is always available at littlesonny.com/privacy and shows the date it was last updated.
14.2 Where a change is significant, we will take reasonable steps to bring it to your attention.
15. Contact us
Email: hello@littlesonny.com
Post: Little Sonny Limited T/A Little Sonny, 207 Knutsford Road, Grappenhall, Warrington, Cheshire, United Kingdom, WA4 2QL