Last updated: 11 August 2026

This privacy notice explains how Burnt Toast collects and uses personal information when you visit our website, buy a collectible, create an account or contact us about a commission.

Who we are

Burnt Toast is a trading name of FMC NE LTD, company number 14433237, registered in England and Wales. Our registered address is 5 Dundas Street, Redcar, England, TS10 3AD. FMC NE LTD is the data controller for the personal information described in this notice.

For privacy questions or requests, email hello@burnttoast.uk.

Information we collect

  • Identity and contact details, including your name, email address, telephone number, billing address and delivery address.
  • Order information, including the products you buy, order value, delivery instructions, returns and correspondence.
  • Commission enquiry information, including your brief, preferred size, budget, timescale and any reference material you choose to provide.
  • Account information if you create a customer account.
  • Technical and security information, such as IP address, browser type, device information and essential cookie data.
  • Analytics information collected only after you consent, including pages and products viewed, shopping interactions, referral source, approximate location, device and browser information.
  • Communications you send to us and records of customer-service conversations.

Payments are processed securely by PayPal. We do not receive or store your complete card number or PayPal password.

How we use your information and our lawful bases

  • To process orders, take payment, arrange delivery and handle returns: necessary to perform our contract with you.
  • To respond to enquiries and prepare commission quotations: necessary to take steps at your request before entering a contract.
  • To maintain accounts, prevent fraud and protect the website: our legitimate interests in operating a safe and reliable business.
  • To keep accounting, tax and transaction records: necessary to comply with legal obligations.
  • To understand and improve website and shop performance: your consent. You can withdraw consent at any time using the Manage consent control.
  • To send marketing: only where you have consented or where the law otherwise permits it. You can opt out at any time.

Who we share information with

We share only what is necessary with trusted service providers that help us operate the store, including our website and hosting providers, WooCommerce, Google Analytics, PayPal, email providers and delivery couriers. We may also share information with professional advisers, regulators, law-enforcement bodies or courts where required by law or necessary to establish or defend legal rights.

PayPal processes payment and fraud-prevention information under its own privacy notice. Couriers receive the contact and delivery details needed to deliver your order.

International transfers

Some service providers may process information outside the United Kingdom. Where this happens, we require an appropriate legal safeguard, such as UK adequacy regulations or approved contractual protections. Google Analytics services may involve processing by Google group companies outside the United Kingdom; Google states that it uses recognised transfer safeguards where required. International orders also require us to provide delivery and customs information to carriers and relevant authorities in the destination country.

How long we keep information

  • General and commission enquiries: up to 12 months after the last meaningful contact.
  • Failed or abandoned order information: up to 30 days, unless needed for fraud prevention or a legal dispute.
  • Completed order, payment and accounting records: 6 years after the end of the relevant financial year, or longer where the law requires.
  • Customer accounts: while the account remains active, then deleted or anonymised when requested unless information must be retained for legal reasons.
  • Google Analytics user-level and event-level data: 14 months, subject to your consent; aggregated reports may remain available for longer.
  • Security logs and backups: only for the period reasonably required for security, recovery and troubleshooting.

Cookies

Our website uses essential cookies needed for functions such as the basket, checkout, account login, security and payment processing. These cookies do not require consent where they are strictly necessary. Optional analytics cookies and measurement are controlled through Complianz and are not enabled for UK visitors unless they consent. You can change your choice at any time using the Manage consent control. Details are available in our Cookie Policy.

Google Analytics

With your consent, we use Google Analytics 4 to understand visits, product views, basket activity, checkout progress and completed purchases. The information sent may include online identifiers, device and browser information, approximate location, referral source and interaction data. We do not send Google your PayPal password or complete payment-card details. Google processes this information under its own Privacy Policy. Google Signals and display-advertising support are disabled.

Your data-protection rights

Depending on the circumstances, you may have the right to ask for access to your information, correction, deletion, restriction of use, portability, or to object to processing based on legitimate interests. Where we rely on consent, you may withdraw it at any time. These rights can be limited where we must retain information by law or have another lawful reason to continue processing it.

To exercise a right, email hello@burnttoast.uk. We may need to verify your identity and normally respond within one month.

Complaints

Please contact us first so we can try to resolve your concern. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint or by telephone on 0303 123 1113.

Security

We use appropriate technical and organisational measures to protect personal information. No online service can guarantee absolute security, but access is limited to those who need it and our payment provider handles sensitive payment credentials.

Children

Our products and services are not directed at children under 13, and we do not knowingly collect their personal information.

Changes to this notice

We may update this notice when our services or legal obligations change. The latest version will always be published on this page with its revision date.