Privacy Policy
Last updated: 24 August 2026
Blunt Trauma is an independent greeting card shop, run by an individual seller, trading on Etsy and at blunttrauma.co.uk. This policy explains what personal information is collected, why, and what happens to it.
Who is responsible and how to get in touch
Blunt Trauma is responsible for the information described here.
If you bought through Etsy, get in touch through Etsy Messages, using the “Contact shop owner” link on the shop page.
If you bought through blunttrauma.co.uk, reply to your order confirmation email and it reaches us directly.
What is collected, and where it comes from
Etsy orders are placed through Etsy, not directly. Etsy collects the order and passes on only what is needed to fulfil it:
- Name
- Delivery address
- Order details — which card, quantity, and any message to be printed inside
- Etsy order reference
Website orders (blunttrauma.co.uk) are collected directly by the site, using the same principle — only what is needed to fulfil the order:
- Name
- Delivery address
- Email address, to send order confirmation and dispatch updates
- Order details — which card, quantity, and any message to be printed inside
Payment details are never received or stored by Blunt Trauma, on either channel. Etsy processes payment for Etsy orders. Stripe processes payment for website orders — card numbers and bank details go directly to Stripe and are never visible to Blunt Trauma.
Why it is used
Solely to print and post the order, and to deal with any problem arising from it — a delivery that does not arrive, a misprint, a refund.
The lawful basis is performance of a contract: you have bought something, and it has to be delivered to you.
Who it is shared with
You Said It, a UK printing and fulfilment company, receives the name, delivery address and card details in order to print the card and post it. They act on Blunt Trauma’s instructions and use the information only to fulfil the order.
Royal Mail receives the delivery address in order to deliver.
Stripe receives payment and billing details for website orders, to process the payment. Stripe acts as an independent data controller for that payment data under its own privacy policy (stripe.com/privacy) — Blunt Trauma never sees or stores it.
WooCommerce/WordPress, run on Blunt Trauma’s own server, stores website order records. No other company has access to this data.
Information is not sold, rented, or shared for advertising, and there is no mailing list.
Cookies
The website uses cookies that are strictly necessary for the shop to work — remembering what’s in your basket, carrying you through checkout, and preventing fraud on the payment step. Under UK law these do not require your consent, but here they are anyway:
- WooCommerce cart and session cookies — remember what’s in your basket
- Stripe fraud-prevention cookies — set during checkout to protect the payment you’re actively making
No advertising or analytics cookies are used. Nothing here tracks you between visits or follows you to other sites.
Where it goes
Orders are printed and posted in the United Kingdom. Card payment data goes to Stripe, which may process it outside the UK under its own safeguards — see stripe.com/privacy for detail. Beyond that, personal information is not transferred outside the UK.
How long it is kept
Order records are kept for as long as needed to handle returns, complaints and tax obligations — six years for records with a tax relevance, which is the standard UK requirement. After that they are deleted.
Inner messages
If a message to be printed inside a card is supplied, it is used only for printing that card and is deleted along with the order record. Please do not include information in a card message that you would not want written down — it is printed on a physical product and handled by a printing company.
Your rights
Under UK data protection law you can ask to:
- See the information held about you
- Correct anything inaccurate
- Delete it, where there is no legal reason to keep it
- Restrict or object to how it is used
- Receive a copy in a portable format
Ask through Etsy Messages (Etsy orders) or by replying to your order confirmation email (website orders) and it will be dealt with within one month.
Note that Etsy and Stripe each hold their own copy of relevant order/payment data under their own privacy policies, and a request to Blunt Trauma does not cover their records.
Complaints
If something has been handled badly, please raise it with us first — through Etsy Messages or by replying to your order confirmation, whichever channel you ordered through. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk), the UK’s data protection regulator.
Security
Order information is held on password-protected devices and accounts. Only Blunt Trauma has access. Information is not kept for longer than needed.
Changes
If this policy changes, the updated version will be posted with a new date at the top.