McIntosh - Privacy Policy (UK)

Last updated: 16 October 2026

The following should be red together with the documents listed below:

Website Terms & Conditions
Cookie Policy
Data Protection (GDPR) Policy
McIntosh Customer Charter

1. Who we are

This Privacy Policy explains how we, James McIntosh Omnimedia Limited (“JMOL”, “McIntosh”, “we”, “us”, “our”), collect and use your personal data when you visit or shop from our websites:

knitmcintosh.com, knitnibble.com, mcintoshpublishing.com, drternst.com, jamesmcintosh.co.uk, sockknitting.co.uk, babyknitting.co.uk, chunkyknits.co.uk (and any domains that redirect to these sites) (the ‘Sites’).

Controller: James McIntosh Omnimedia Limited (company no. 09113481)
Registered office: 42 Denman Road, London, SE15 5NR, United Kingdom
Email: [email protected]
ICO registration: ZA547821

We are the data controller for the personal data we process.

2. The personal data we collect

We collect the following categories of data:

Identity & contact data — name, billing/delivery address, email, phone.
Order & payment data — items purchased, order value, delivery method, part-masked payment card details/authorisation info from our payment processor (we do not store full card numbers).
Account data — login details, order history, saved addresses.
Communications — emails, messages, customer service notes.
Marketing preferences — newsletter opt-in, channel preferences.
Technical & usage data — IP address, device, browser, time zone, pages viewed, interaction data; cookie identifiers and similar technologies (see Cookie Policy).
Social handles / User Generated Content (UGC) — if you tag us or use our hashtags and we request permission to repost.
Competition & voucher data — entries, eligibility, voucher codes, redemptions.
Professional data (B2B) — if you buy on behalf of a business: role, company, VAT no.

We do not intentionally collect special category data. Please do not share health or other sensitive information in free-text fields.

3. How we get your data

Directly from you — when you browse, create an account, place an order, contact us, enter a competition, or subscribe to marketing.
Automatically — via cookies and similar technologies when you use the Sites.
From third parties — payment providers (e.g., Shopify Payments, Klarna or PayPal etc), delivery partners (e.g., Royal Mail, DPD, UPS), analytics/advertising partners (e.g., Google, Meta, Pinterest), address lookup or fraud-prevention tools.

3.1 AI chatbot

When you use the AI-powered chatbot on our Sites, we collect the information you enter into the chat, together with associated technical and usage data, which may include the date and time of the conversation, your IP address, and information about your device and browser.

Please do not provide payment card details, passwords, health information, special category data, or other sensitive or confidential information through the chatbot.

We use chatbot information to respond to your enquiries, provide customer support, assist with products and orders, maintain security, prevent misuse, and monitor and improve our Sites and services. Our lawful bases are the performance of a contract where the chatbot assists with an order or service you have requested, and our legitimate interests in providing customer support and improving and protecting our business.

Chatbot conversations and associated information may be processed on our behalf by Shopify and by any AI, hosting, or technology providers used to operate the chatbot. Conversations may also be reviewed by authorised members of our team where reasonably necessary to provide support, check the accuracy of responses, maintain security, or improve our services. We require service providers acting on our behalf to protect personal data and use it only for authorised purposes.

Where chatbot information is processed outside the UK, we use the safeguards described in section 8 of this Privacy Policy.

We retain chatbot conversations only for as long as reasonably necessary to provide customer support, administer our relationship with you, maintain security, resolve disputes, and comply with our legal obligations. Conversations and associated customer information may also be retained by Shopify in accordance with Shopify’s applicable retention practices and our instructions.

The chatbot provides automated responses, but it does not make solely automated decisions that have legal or similarly significant effects on you. You may contact us at [email protected] if you would prefer assistance from a person or wish to exercise your data-protection rights in relation to a chatbot conversation.

4. Why we use your data (lawful bases)

We use your data only where the law allows:

Contract — to take and fulfil your order, process payments, deliver goods, manage returns/warranties, and provide customer service.
Legal obligation — record-keeping for tax/accounting, consumer rights, product safety and recalls.
Legitimate interests — running and improving our Sites and business (IT security, analytics, stock management), preventing fraud/abuse, customer service training, showing relevant products and offers to our existing customers (soft opt-in under PECR), and operating promotions. We balance these interests against your rights.
Consent — sending email marketing to non-customers, placing non-essential cookies/trackers (analytics/advertising), featuring your tagged content. You can withdraw consent at any time.

We do not make decisions solely by automated means that have legal or similarly significant effects.

5. Marketing communications

Soft opt-in (PECR): If you’ve bought from us or asked for a quote, we may email you about similar products unless you opt out.
All other e-marketing: we’ll only email/SMS you if you explicitly opt in.
You can opt out at any time via unsubscribe links or by emailing [email protected].

6. Cookies and similar technologies

We use cookies, pixels and local storage to make the Sites work, measure performance, and (with your consent) tailor advertising. Full details are in our Cookie Policy. You can manage your preferences at any time via our cookie banner or your browser settings.

7. Sharing your data

We share data with trusted service providers acting on our instructions, including:

Payment processing: e.g., Shopify Payments.
Warehousing & delivery: e.g., Royal Mail, DPD, UPS and similar couriers.
E-commerce & IT: hosting, security, backup, website support.
Marketing & analytics: email service providers, customer analytics, review platforms, advertising networks (e.g., Google/Meta, Pinterest where you have consented).
Professional services: accountants, auditors, legal advisers.
Regulators/authorities: where legally required (e.g., product safety, fraud prevention, payment of tax obligation).

We require all processors to safeguard your data and use it only for our purposes.

We do not sell your personal data.

7.1 Digital knitting patterns from LANGYARNS

When you purchase a kit that includes a digital pattern supplied by LANGYARNS or WOOLADDICTS by LANGYARNS, we share your email address with LANGYARNS in Switzerland through our order integration solely to arrange delivery of the PDF pattern included with your purchase. Your pattern will be emailed directly to you by LANGYARNS.

We process and share your email address for this purpose to fulfil our contract with you. LANGYARNS uses your email address solely to deliver your pattern and does not retain it after delivery, add it to a marketing list or sell it to third parties.

For the transfer to Switzerland, we rely on UK adequacy regulations recognising Switzerland as providing an adequate level of protection for personal data.

8. International transfers

Some partners may process data outside the UK. Where they do, we rely on:

UK adequacy regulations (where applicable), or
Approved safeguards (e.g., UK Addendum/IDTA with the EU SCCs), plus additional technical/organisational measures.

You can contact us for details of current transfer mechanisms.

9. Data retention

We keep data only as long as necessary for the purposes above:

Orders, invoices, tax records: typically 7 years.
Customer accounts: while active, then routinely reviewed and anonymised or deleted after inactivity.
Marketing: until you unsubscribe or withdraw consent; we keep minimal suppression records to honour your choice.
Customer service messages: typically up to 12 months, unless needed longer for disputes, legal or product safety reasons.

10. Your rights

You have the following rights under UK GDPR:

Access to your personal data and copies.
Rectification of inaccurate or incomplete data.
Erasure (“right to be forgotten”) in certain circumstances.
Restriction of processing in certain circumstances.
Portability of data you provided to us, where processing is by consent or contract and carried out by automated means.
Object to processing based on legitimate interests (including profiling) and to direct marketing at any time.
Withdraw consent where processing relies on it.

To exercise your rights, email [email protected]. We may need to verify your identity. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

11. Children

Our Sites are not intended for children under 13. We do not knowingly collect personal data from children.

12. Security

We use appropriate technical and organisational measures to protect personal data (access controls, encryption in transit, secure hosting, role-based access, staff training). No system is 100% secure; please keep your account credentials confidential and tell us if you suspect misuse.

13. Links to other sites

Our Sites may link to third-party websites we don’t control. Their privacy policies apply to their services.

14. Changes to this policy

We may update this policy from time to time. The latest version will always be on our Sites. Material changes will be highlighted where appropriate.

15. Contact us

Data protection contact:
James McIntosh Omnimedia Limited
42 Denman Road, London, SE15 5NR, United Kingdom
Email: [email protected]