Privacy Policy

Effective date: 19 October 2026

This policy explains what personal information The Tote Library collects when you visit thetotelibrary.com, buy from us, sign up for our emails or message us, why we use it, who we share it with, and the choices and rights you have.

1. Who we are

The Tote Library Ltd is the controller of your personal information. We are a company registered in England and Wales (company number 14215623), registered office: 5 Brayford Square, London E1 0SG, United Kingdom. Director: Patrik Nicholas Walk.

Privacy contact: info@thetotelibrary.com (please put "Privacy" in the subject line). We are not required to appoint a data protection officer. Our director is the person responsible for privacy, including for the purposes of Quebec's Law 25 and Canada's PIPEDA.

2. What we collect

Order information: name, email, phone number, billing and shipping address, items bought, order history. Payment card details are handled by our payment providers; we never see or store your full card number.
Account information: if you create an account, your login email and saved addresses.
Messages: what you write to us by email, live chat, or Instagram, Facebook and TikTok direct messages, including your social media handle.
Marketing preferences: whether you signed up to our emails, and how you interact with them (opens, clicks).
Reviews: your name or initials, review text, photos and rating if you leave a review.
Device and usage information: IP address, approximate location, browser and device type, pages viewed, clicks and how you reached our site. Most of this is collected through cookies and similar technologies, described in section 5.
Business contacts: if you work for a company we think might like our products for corporate gifting or wholesale, your name, role, company and work email, taken from public business sources and business databases.

3. Why we use it, and our legal basis

If you are in the UK, the EEA or Switzerland, we must have a legal basis for each use:

What we do	Legal basis
Take payment, pack, ship and track your order, handle returns, refunds and withdrawals, answer your questions	Performing our contract with you
Keep invoices and accounting records	Legal obligation (tax and company law)
Prevent fraud and keep our shop secure	Our legitimate interest in protecting our business and customers
Send marketing emails	Your consent, or for existing customers, our legitimate interest in telling you about similar products (you can opt out at any time)
Analytics, session recordings and advertising cookies and pixels	Your consent through our cookie banner (in the UK, EEA and Switzerland)
Reply to social media messages and send you the link or code you asked for	Performing your request, and your consent where you join our email list
Publish your product review	Your consent
Contact businesses about corporate gifting and wholesale	Our legitimate interest in promoting our products to relevant organisations. You can object at any time and we will stop.

You must give us your name, contact details and address to place an order, otherwise we cannot deliver it. Everything else is optional. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Advertising platforms may use your data to show you more relevant ads, but only if you accept marketing cookies (or, in the US, unless you opt out).

4. Who we share it with

We use trusted service providers who process data on our behalf and under contract. We do not sell your personal information for money.

Provider	What for	Where
Shopify (incl. Shop Pay, Shopify Payments)	Online store, checkout, payments, customer accounts	Canada, US, Ireland
PayPal	Payments	Luxembourg, US
Our fulfilment partner and shipping carriers (including local postal services such as USPS, Deutsche Post/DHL and Royal Mail)	Packing, shipping and tracking orders	See section 6, and the destination country
Klaviyo	Marketing and order emails, sign-up forms	US
Gorgias	Customer service inbox and live chat	US, EU
ManyChat	Automated Instagram and Facebook messages	US
Loox	Product reviews and review requests	US, Israel
Microsoft Clarity	Session recordings and heatmaps (only with consent in the UK, EEA and Switzerland)	US
Google (Analytics, Ads)	Website analytics and advertising measurement	US
Triple Whale	Marketing attribution (which ads lead to sales)	US
Meta (Facebook, Instagram), Pinterest, AppLovin	Advertising and measuring ad performance	US, Ireland
Instantly	Business-to-business emails	US
Our accountants and professional advisers	Accounting, tax and legal advice	UK

Meta, Google, Pinterest and AppLovin may combine data from our site with data they collect elsewhere to build advertising profiles. For that use they act as independent controllers or, for Meta, jointly with us for the collection on our site. We may also share information where the law requires it, to protect our rights, or with a buyer if our business is sold.

5. Cookies and similar technologies

Cookies are small files stored on your device. We use four types:

Strictly necessary: make the shop work (cart, checkout, security, remembering your cookie choice). Always on.
Preferences: remember settings such as language and currency.
Analytics: help us understand how the site is used (Shopify analytics, Google Analytics, Microsoft Clarity).
Marketing: measure and personalise ads (Meta pixel, Google Ads, Pinterest tag, AppLovin pixel, Triple Whale, Klaviyo on-site tracking).

UK, EEA and Switzerland: we only set preference, analytics and marketing cookies if you click "Accept" in our cookie banner. "Decline" is just as easy, and you can change your choice at any time through the Cookie Settings link at the bottom of every page. Until you accept, Google tags run in "consent mode" without cookies, and Microsoft Clarity runs without cookies.

United States and other regions: these cookies are on by default. You can opt out of the sale or sharing of your personal information for targeted advertising through the Your Privacy Choices link at the bottom of every page. We treat a Global Privacy Control (GPC) signal from your browser as a valid opt-out. We do not respond to "Do Not Track" signals, because there is no common standard for them; GPC is the signal we honour.

You can also block or delete cookies in your browser settings, and opt out of interest-based ads at aboutads.info or youronlinechoices.eu.

6. International transfers

We are based in the UK and work with service providers in several countries. Your information may therefore be transferred to and stored in the following countries: United Kingdom, European Union member states, United States, Canada, China and Israel, and the country your order is shipped to. Where the destination does not have an adequacy decision from the UK, EU or Swiss authorities, we protect your information with the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or the EU-US, UK-US and Swiss-US Data Privacy Framework where the provider is certified. Email us for a copy of the relevant safeguards.

7. How long we keep it

Orders, invoices and payment records: 6 years after the end of the financial year (UK tax and limitation rules).
Customer accounts: until you delete your account, or after 3 years of inactivity.
Email marketing: until you unsubscribe. We keep a minimal record of your unsubscribe so we never email you again.
Customer service emails, chats and social messages: 3 years.
Reviews: while published, or until you ask us to remove them.
Analytics data: up to 14 months (Google Analytics); session recordings up to about 13 months (Microsoft Clarity).
Business contacts: up to 2 years after our last contact, or until you object.

8. Your rights

Depending on where you live, you can ask us to:

give you a copy of your personal information, including in a portable format;
correct information that is wrong or incomplete;
delete your information (we may need to keep order records for tax purposes);
restrict or object to how we use it, including objecting to direct marketing at any time;
withdraw your consent at any time, without affecting what we did before.

To use any of these rights, email info@thetotelibrary.com with "Privacy request" in the subject. We may ask you to confirm your identity, usually by replying from the email address on your order. We respond within one month (UK/EEA/Switzerland) or within the time your local law requires. To stop marketing emails, you can also click "unsubscribe" in any email.

Complaints: please tell us first at info@thetotelibrary.com. We will acknowledge your complaint within 30 days, look into it and tell you the outcome. You also have the right to complain to a data protection authority:

UK: the Information Commissioner's Office, ico.org.uk
EEA: the data protection authority in the country where you live or work (list at edpb.europa.eu)
Switzerland: the Federal Data Protection and Information Commissioner (FDPIC)
Canada: the Office of the Privacy Commissioner of Canada; Quebec: the Commission d'accès à l'information
Australia: the OAIC; New Zealand: the Office of the Privacy Commissioner
Japan: the Personal Information Protection Commission

9. Information for specific regions

United States (incl. California): we collect the categories listed in section 2 and share them with the categories of providers in section 4. Third-party advertising partners (Meta, Google, Pinterest, AppLovin) may collect information about your activity across different websites over time. You can opt out of this through "Your Privacy Choices" or a GPC signal. We will tell you about material changes to this policy by updating it here and changing the effective date.

Canada and Quebec: the person responsible for the protection of personal information is our director, Patrik Nicholas Walk, reachable at info@thetotelibrary.com. Your information may be stored and processed outside Quebec and Canada, as described in section 6. We do not use technology that identifies, locates or profiles you unless you turn it on, except advertising cookies, which you can decline.

Japan: we share your information with the overseas providers and in the countries listed in sections 4 and 6. Information about each country's data protection system is available from the Personal Information Protection Commission. We protect your data with access controls limited to staff who need it, two-factor authentication on our accounts, encrypted connections, and written agreements with our providers. Our representative is our director, Patrik Nicholas Walk.

Australia and New Zealand: you can request access to and correction of your information as described in section 8.

10. Children

Our shop is not directed at children under 16, and we do not knowingly collect their personal information. If you think a child has given us information, please contact us and we will delete it.

11. Security

We use encrypted connections, access controls and reputable providers to protect your information. No system is completely secure, so if we become aware of a breach that affects you, we will tell you and the relevant authorities where the law requires.

12. Changes to this policy

We may update this policy when our practices or the law change. The effective date at the top shows when it last changed. If the changes are significant, we will tell you by email or with a notice on our site.