Koaura Studio

Privacy Policy

Last updated: 21 October 2026

Your privacy matters. This notice explains how Rebecca Faulkner trading as Koaura Studio uses personal information when you browse, shop, book or contact me through koaura.studio.

Who is responsible for your information?

Rebecca Faulkner is the data controller. Contact: koaura.studio@gmail.com, or 4 Gelli Unig Terrace, Pontywaun, NP11 7GF, United Kingdom.

What information is used, and why?

  • Orders and vouchers: your name, billing and delivery details, email, telephone number where supplied, purchases, voucher recipient details, payment status and order history. This is used to fulfil your contract, deliver purchases, handle returns and provide support.
  • Appointments and events: contact details, chosen service, appointment or event date, attendance and booking correspondence. This is used to arrange and provide the service you request.
  • Enquiries: the details you provide through contact forms or email, to answer you and take steps towards a booking or purchase. For other enquiries, the basis is the legitimate interest in responding and providing customer support.
  • Accounts: login and profile details, saved addresses and order history, to provide the account you request and keep it secure.
  • Newsletters: your email address and consent preferences, used with your consent to send Koaura news. You can unsubscribe at any time using the link in an email or by contacting me. Buying or booking does not itself subscribe you.
  • Security and administration: technical details such as IP address, browser information, security logs and payment risk information, for the legitimate interests of protecting the website and preventing fraud. Transaction records are also kept where required for accounting and other legal obligations.

Please provide only information needed for your enquiry or booking. Do not send detailed medical records through general contact forms. If health information is needed for a treatment, the purpose, applicable condition for using it and relevant retention arrangements must be explained when it is collected.

The systems supporting Koaura

The website runs on WordPress. WooCommerce manages shop orders, accounts and vouchers; LatePoint supports appointment bookings. Contact and newsletter forms use WPForms and Fluent Forms, with FluentCRM supporting newsletter subscriptions. FluentSMTP sends website emails through the connected Gmail account, so Google processes email content and recipient details. These tools do not mean that every software vendor receives the contents of your records.

Stripe processes payments and supports fraud prevention. Koaura receives payment confirmations and transaction references, rather than your full card number. Royal Mail Click & Drop receives the recipient and delivery information needed to create labels, deliver jewellery and provide shipment updates. Shipment tracking is associated with the relevant order.

Website hosting, email and backup services also support storage and delivery. Information may be shared with professional advisers or authorities where necessary to meet legal obligations or handle a dispute. Information is not sold.

Cookies and external services

See the Cookie Policy for information about browser storage, essential shopping and booking functions, and payment security. External font resources may receive your IP address and browser request information when loaded. Following an external link takes you to a service with its own privacy notice.

How long information is kept

Retention depends on why the information is needed: completing your order or appointment, handling enquiries and returns, meeting accounting obligations, and resolving or defending legal claims. Account information supports your account while it is in use. Newsletter preferences are kept while relevant, including a limited record where needed to honour an unsubscribe request.

The website does not currently have automatic deletion periods configured for completed orders or inactive accounts. Records are therefore not automatically removed after a fixed period. You can contact me about the information held about you or request deletion; records needed for legal obligations or claims may need to be retained. FluentSMTP email logs are configured to delete after 14 days; this does not remove messages in the Gmail mailbox or records held by other systems. Backup copies may remain until the applicable backup cycle replaces them.

International processing

Some service providers, including Stripe and email or external-resource providers, may process information outside the UK. Where a restricted transfer is made, an appropriate UK adequacy arrangement or contractual safeguard is required. Contact me for information about the safeguards applicable to your data.

Your rights

Depending on the circumstances, you can ask to access or correct your information, request erasure or restriction, receive portable data, and object to processing based on legitimate interests. You can object to direct marketing at any time. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.

Email me to exercise a right. I may need proportionate information to confirm your identity. You can also complain to the Information Commissioner’s Office. Please contact me if you would like to raise a concern directly first.

Changes to this notice

This notice will be updated when the website’s services or data use change. The date above identifies the current version.