Privacy policy

This policy explains how Hull Online Group Limited, trading as INESS (“we”, “us”), handles personal information when you use https://www.iness.co.uk, create an account, place an order, join the mailing list, or write to us. It is written for the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

1. Who is responsible

The data controller is Hull Online Group Limited (company number 15200823), trading as INESS. Registered office: 167 Frome Road, Hull, England, HU8 9QD. You can reach us at office@hullonline.co.uk.

We do not have a statutory data protection officer. Privacy questions go to the same inbox; we treat them as a priority.

2. What we collect

Depending on how you use the Site, we may hold:

Identity and contact details: name, email, phone, delivery address.
Order details: what you bought, quantities, prices, delivery method, notes, order reference.
Account details: email, name, a hashed password (we never store the password itself).
Payment status from Stripe (paid / unpaid / refunded). We do not receive or store full card numbers, CVV or card PINs.
Messages you send us, including attachments such as a photograph of a damaged parcel.
Newsletter sign-ups: your email, and the time you joined.
Technical data needed to run the shop: basket cookie, signed-in session, and standard server logs (IP address, browser, pages requested) held by our host for security and diagnosis.

We do not buy marketing lists. We do not collect special-category data (health, religion, and so on) as a matter of course. If you mention an allergy in an order note, we use that only to help with that order.

The shop is not intended for children. We do not knowingly collect personal information from anyone under 16.

3. Why we use it, and the lawful basis

We use personal information for the following purposes.

To fulfil an order — packing, delivery, payment, receipts, returns and customer service. Lawful basis: contract.
To run your account — sign-in, order history, wishlist. Lawful basis: contract.
To take payment — Stripe processes the card transaction. Lawful basis: contract.
To send the mailing list — harvest notes and restocks, only if you asked to join. Lawful basis: consent. You can unsubscribe at any time by writing to us.
To keep the Site secure — preventing fraud, abuse and technical failure. Lawful basis: legitimate interests.
To meet the law — tax, accounting, and consumer-rights records. Lawful basis: legal obligation.
To improve the shop — understanding which products are asked for, fixing errors. We use aggregated or minimally identifiable information where we can. Lawful basis: legitimate interests.

You do not have to give us your details, but we cannot complete a delivery or open an account without the fields marked required at checkout.

We do not sell your information. We share it only as needed to run the shop:

Stripe — payment processing. Stripe is a separate controller/processor for card data. See Stripe’s own privacy notice.
Carriers — name, address, phone and parcel contents as required to deliver.
Hosting — the Site is hosted by Vercel. Order and account data is stored so that we can fulfil and support orders.
Professional advisers and authorities — accountants, insurers, or a regulator, where we must or where it is necessary to establish, exercise or defend legal claims.

Some of those providers (including Stripe and Vercel) may process information outside the United Kingdom. Where that happens, they rely on an adequacy decision or on standard contractual clauses (or an equivalent safeguard) approved for UK transfers.

5. Cookies

We use a small number of cookies that are required to make the shop work. We do not run advertising cookies, and we do not currently run a third-party analytics pixel on this Site.

iness_cart — remembers what is in your basket. It is an HTTP-only cookie, lasts 21 days, and is necessary to shop.
iness_session — keeps you signed in. It is an HTTP-only cookie and is necessary if you use an account.

When you pay, Stripe may set its own cookies on Stripe’s checkout pages. Those cookies are Stripe’s responsibility and are covered by Stripe’s notices.

You can block cookies in your browser. If you block the basket cookie, the cart will not persist. If you block the session cookie, you will not stay signed in.

6. How long we keep it

Orders, invoices and related correspondence: at least six years, which is what UK tax and accounting practice requires.
Account: for as long as the account is open, then for a short period afterwards in case of a query, unless you ask us to delete it sooner and the law allows.
Basket cookie: 21 days of inactivity, or when you empty it.
Newsletter: until you unsubscribe or we close the list.
Contact messages: as long as needed to resolve the query, then in line with our order records if they relate to a purchase.
Server logs: for a short operational period, unless we need them longer to investigate an incident.

When we no longer need information we delete it or irreversibly anonymise it.

7. Your rights

Under UK GDPR you can ask us to:

give you a copy of the personal information we hold about you (access);
correct inaccurate information;
delete information in certain cases;
restrict or object to certain processing;
send information you gave us to you or to another service, where the basis was consent or contract and the processing is automated (portability);
withdraw consent for the mailing list at any time, without affecting processing already carried out.

Write to office@hullonline.co.uk with enough detail for us to find you (an email address and, if relevant, an order reference). We will respond within one month, or tell you if we need longer. We may need to verify that the request comes from you.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator: ico.org.uk, or 0303 123 1113. We would rather put it right ourselves first.

8. Changes and how to reach us

We will update this policy when the shop or the law changes. The date at the top of the page is the date of the current version. If a change is material we will note it on the Site or, where we can, email account holders.

Privacy and data requests: office@hullonline.co.uk. Related pages: Terms & conditions, Returns, Contact.