Privacy policy

Last updated: 24 October 2026

Midnight Folio Ltd is responsible as controller for the personal information we use to run our shop at midnightfolio.co.uk. Contact hello@midnightfolio.co.uk, use our Contact page or write to our registered office: Work Station, 15 Paternoster Row, Sheffield, S1 2BX, United Kingdom. Our company number is 17485352 and we are registered in England and Wales.

Information we use

We use names, contact details, billing and delivery addresses, order contents and values, payment status and transaction references, delivery and return information, enquiries, complaints and marketing preferences. Shopify and payment providers process payment credentials; our shop administration uses payment status, references and limited payment information rather than requiring you to email card details. Please never send full payment details or passwords to customer care.

When you browse, Shopify may process device and browser information, IP addresses, identifiers and information about pages, products and checkout activity. Cookies and similar technologies are explained in our Cookie Policy and privacy controls. If you use an account, Shopify processes the information needed to provide account access. We do not ask for sensitive personal information in ordinary shopping or enquiries; please only send information relevant to your request.

We receive information directly from you and through Shopify, payment and delivery providers. If you send a gift, we receive the recipient's name and delivery details from you. We use those details to deliver and deal with the order, not to subscribe the recipient to marketing. Please provide only details you are entitled to share and direct the recipient to this notice.

Why we use it and our lawful bases

Orders, payments, dispatch, cancellations and returns: we use the information needed to take steps at your request before an order and perform our contract with you. We also meet legal duties concerning consumer rights and accounting records. Without necessary order and delivery details we cannot process the order.

Gift recipient details: our legitimate interests in fulfilling the purchaser's gift order and resolving delivery problems. We minimise the information and do not use it to market to the recipient.

Customer enquiries: steps towards a contract or performance of it where your enquiry concerns an order; otherwise our legitimate interests in answering questions and resolving problems. Complaints and rights requests also involve compliance with legal duties.

Finance and records: compliance with company, accounting and tax obligations. Where relevant, our legitimate interests in evidencing transactions and establishing or defending legal claims.

Security and fraud: our legitimate interests in protecting customers, preventing misuse and safeguarding the shop, together with legal obligations where applicable. We assess necessity and the effect on individuals. Provider risk checks may inform a decision to review an order. Contact us if you believe a decision is wrong and would like us to look at it.

Email marketing and checkout recovery: consent where we invite you to subscribe. You can withdraw it at any time by using the unsubscribe link or emailing us. Withdrawal does not affect earlier lawful processing. We retain the minimum suppression information needed to respect your preference, relying on our legitimate interests and relevant legal duties. Essential order and support messages continue when needed, even if you unsubscribe from marketing.

Website operation and measurement: our legitimate interests in operating a secure, usable shop for essential processing; consent for optional analytics or advertising where required. Device storage/access rules apply separately from the lawful basis for personal information. We do not treat browsing as agreement to optional tracking.

Who receives information

We share information needed for the relevant service with Shopify for hosting, checkout, accounts, shop administration and messaging; payment providers, including Shopify Payments and PayPal, for transactions, fraud checks and refunds; Royal Mail for delivery; and Xero, our business bank and our chosen Amaka integration for transferring relevant Shopify transaction information to Xero for bookkeeping and reconciliation. Other payment services you choose at checkout may also process information under their own notices. We share relevant records with professional advisers or authorities where necessary and lawful, and with providers of our business email and IT services to handle correspondence securely.

Where you allow optional analytics, we also share website usage information with Google as our analytics provider, as described under Google Analytics below.

Providers may act as processors under our instructions or as controllers for their own regulated payment, security or other purposes. We do not give suppliers the customer list for their own marketing. Access within Midnight Folio is restricted to people who need it for their work.

Shopify and enhanced services

Our shop is hosted by Shopify, which collects and processes personal information when you visit and make purchases. Shopify Network Intelligence is enabled. It supports Enhanced Services using information from interactions and transactions with our shop, other merchants and Shopify, including personalisation, analytics and advertising-related features. Information is shared with Shopify and relevant third parties, which may be located outside the UK, to provide these services.

Shopify processes information on our instructions for relevant platform services and acts as a controller for its Enhanced Services processing. Each of us is responsible for our own controller processing and responding to related rights requests. We remain responsible for our own lawful use and sharing of information.

Targeted advertising through Enhanced Services requires your consent. Optional device storage or access also requires consent unless a specific legal exception applies. You can accept, decline or manage choices through our native cookie controls and change your choice using Cookie preferences in the footer. Ordinary shopping does not depend on agreeing to optional advertising.

Read Shopify's consumer privacy notice at https://www.shopify.com/legal/privacy/consumers and use its privacy portal at https://privacy.shopify.com/en to learn about Shopify's processing and exercise relevant rights, including withdrawal or objection. You may also contact us about our use of your information. We will not use Shopify's separate responsibilities to avoid our own.

Google Analytics

We use Google Analytics 4, a web analytics service provided by Google, to understand how visitors use our shop so we can improve it. It is an optional analytics technology. You can control optional Google Analytics measurement through the Analytics setting in our cookie preferences. You can decline or withdraw your consent at any time using the Cookie preferences link in our website footer.

Where optional analytics is allowed, Google Analytics processes information such as pages and products viewed, basket activity, approximate location derived from your IP address, device and browser information and online identifiers. We use this to see which products and pages are of interest, how people move through the shop and where the experience can be improved. We rely on your consent for this processing and for the related storage of or access to information on your device.

Google acts as our processor for this analytics, processing the information on our instructions under Google's data processing terms. We use Google Analytics for site measurement rather than advertising: we have turned off Google Signals and we do not link Google Analytics to Google Ads. Google may transfer and store information outside the UK; such transfers rely on appropriate safeguards, as described under International processing. You can read how Google handles information in its privacy policy at https://policies.google.com/privacy and how Google Analytics uses data at https://policies.google.com/technologies/partner-sites.

International processing

Our providers may process information outside the UK. Shopify's EU hosting setting does not mean all processing stays there. For restricted transfers we use applicable UK adequacy arrangements or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, with the required assessment and additional measures where needed. Shopify's Data Processing Addendum explains its transfer arrangements: https://www.shopify.com/legal/dpa. Contact us for information about safeguards relevant to your information or how to obtain a copy, subject to necessary redactions.

Keeping information

We keep information only for the purpose for which it is needed, including relevant legal obligations. Necessary company accounting records are generally kept for six years from the end of the financial year to which they relate, or longer where legally required. This does not mean every browsing record or customer message is kept for six years.

We keep order, complaint and correspondence records for as long as needed to fulfil the order, address problems, meet legal duties and deal with reasonably foreseeable claims. We review ordinary enquiries when resolved and remove information no longer needed. Marketing information is retained while a subscription remains appropriate, with reviews of inactive records; minimal suppression records may be kept to avoid contacting someone who has opted out. Cookie lifetimes are shown in the privacy controls or cookie information. A necessary legal or safety hold can temporarily prevent deletion; we restrict use during that time.

Your choices and rights

Depending on the processing, you may ask for access to your personal information, correction, erasure, restriction or portability. You may object to processing based on legitimate interests. Your right to object to direct marketing is absolute: we will stop using your information for that purpose. Where we rely on consent, you can withdraw it at any time. Some information must be retained to meet legal duties or handle claims, so a request to erase it may not always apply.

Email hello@midnightfolio.co.uk or use our Contact page to make a request. No special form is needed. We may ask for proportionate information to confirm identity and protect your information. We normally respond without undue delay and within one month. If a lawful extension or other timing rule applies, we will explain it. Requests are normally free.

Complaints about personal information

You can complain to us by email, our Contact page or post. We will acknowledge receipt within 30 days, investigate appropriately, keep you informed and communicate the outcome without undue delay. We aim to acknowledge sooner under our ordinary two-working-day reply aim. You may complain to the UK data protection regulator, the ICO, at https://ico.org.uk/make-a-complaint/. You can also contact it through https://ico.org.uk/global/contact-us/. This process does not remove your right to a legal remedy.

Changes

We will update this notice when our processing changes and make any further notification required by law. Optional new uses requiring consent will not be introduced merely by changing this notice.