Privacy policy
Privacy Policy
Last updated: 17 September 2026
1. Who we are
CREAM is operated by Cars Rule Ltd (company number 16377364), registered at 109-111 Fulham Palace Road, London, England, W6 8JA. We are the data controller for the personal information described here.
Any questions, or to exercise your rights: shop@carsrule.co.uk.
2. What we collect
When you order Name · email · delivery and billing address · phone number (for carriers) · order contents and history.
When you pay Our payment provider handles your card details. We never see or store your full card number — we only receive confirmation of payment and the last four digits.
When you sign up for email Your email address, stored against your customer record so we can tell you when we launch and when something drops.
When you browse IP address, device and browser type, pages viewed, and referring site. Collected through cookies and similar technology — see §7.
When you contact us Whatever you put in the message, plus your contact details.
3. Why we use it, and our lawful basis
| What for | Lawful basis |
|---|---|
| Taking payment, making and delivering your order, order updates | Contract — we can't fulfil an order without it |
| Handling returns, refunds and support | Contract |
| Keeping tax and accounting records | Legal obligation — HMRC requires six years |
| Marketing emails | Consent — you opt in, and you can opt out any time |
| Fraud prevention and site security | Legitimate interests — protecting the business and customers |
| Understanding how the site is used | Consent, via the cookie banner |
4. Who we share it with
We don't sell your data. We share it only with businesses that help us run CREAM, and only what they need:
| Who | What for | Where |
|---|---|---|
| Shopify | Store platform, hosting, checkout, payment processing, and the analytics that tell us how the site is used | Canada / USA |
| Google Analytics — how people find and use the site, so we know what's working. Only runs if you accept analytics cookies | USA | |
| Inkthreadable | Printing and fulfilment — receives your name and delivery address | UK (Blackburn) |
| Royal Mail, EVRi, DPD, USPS | Delivery, and tracking updates | UK / destination country |
We don't currently use any third-party marketing or analytics tools. If that changes, this list changes with it.
We may also disclose information where the law requires it.
5. Sending data outside the UK
Some of the businesses above are outside the UK. Where that happens we rely on UK adequacy regulations, or on the UK International Data Transfer Agreement / Addendum, so your information keeps equivalent protection.
6. How long we keep it
- Order records: six years after the order, because tax law requires it
- Marketing contacts: until you unsubscribe, then a suppression record so we don't email you again by mistake
- Support messages: two years
- Analytics: as set out in the cookie banner
7. Cookies
We use cookies that are strictly necessary for the site and checkout to work — these don't need consent. Anything else (analytics, advertising) only runs if you accept it in the cookie banner, and you can change your mind at any time.
8. Your rights
Under UK GDPR you can ask us to: give you a copy of your data · correct it · delete it · restrict or object to how we use it · send it to another provider · withdraw consent at any time.
Email shop@carsrule.co.uk. We'll respond within one month, and it's free.
If you're unhappy with how we've handled it, you can complain to the Information Commissioner's Office — ico.org.uk, or 0303 123 1113. We'd rather you came to us first so we can put it right.
9. Children
CREAM isn't aimed at under-16s and we don't knowingly collect their data. If you believe we have, tell us and we'll delete it.
10. Changes
If we change this policy we'll update the date above, and tell you directly if the change is significant.