Privacy Policy
PRIVACY NOTICE
5Elements Gifts
A trading name of 5Elements Services Ltd
Version: 1.0
Effective Date: 30 June 2026
Last Reviewed: 30 June 2026
Next Scheduled Review: June 2027
Introduction
Welcome to 5Elements Gifts (“we”, “our”, “us”), a trading name of 5Elements Services Ltd.
We are committed to protecting your privacy and ensuring that your personal information is processed lawfully, fairly, transparently and securely.
This Privacy Notice explains how we collect, use, store, share and protect your personal information whenever you:
visit our website;
browse our online shop;
purchase products;
contact us with an enquiry;
subscribe to marketing communications;
or otherwise interact with our website or services.
We recognise that when you shop with us, you trust us to look after your personal information responsibly.
We process personal information in accordance with:
the UK General Data Protection Regulation (“UK GDPR”);
the Data Protection Act 2018;
the Data (Use and Access) Act 2025;
the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), where applicable; and
where applicable, the EU General Data Protection Regulation (“EU GDPR”).
By using our website, you acknowledge that you have read this Privacy Notice.
Definitions
For the purposes of this Privacy Notice, the following terms shall have the meanings set out below.
Personal Data
Any information relating to an identified or identifiable living individual.
Processing
Any operation performed on personal data including collecting, recording, storing, organising, using, sharing, restricting, erasing or destroying personal information.
Data Controller (Controller)
The individual responsible for determining the purposes and means of processing personal data.
For the purposes of this Privacy Notice, the Data Controller is:
Nadia Maria Ochoa
Director
5Elements Services Ltd
Trading as 5Elements Gifts
Data Subject
The individual to whom the personal information relates.
Consent
Any freely given, specific, informed and unambiguous indication of an individual’s wishes by which they agree to the processing of their personal information.
Applicable Data Protection Legislation
Collectively refers to the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) and, where applicable, the EU General Data Protection Regulation (EU GDPR).
Who We Are
5Elements Gifts is the online retail division of 5Elements Services Ltd.
We specialise in handcrafted and carefully selected spiritual gifts, including:
gemstone bracelets;
mala beads;
gemstone trees; and
other jewellery and gift items that may be introduced from time to time.
Products are available for customers within the United Kingdom and internationally.
Data Controller
For the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation (EU GDPR), the Data Controller responsible for processing your personal information is:
Nadia Maria Ochoa
Director
5Elements Services Ltd
Trading as 5Elements Gifts
Telephone:
0330 333 8429
Email:
If you have any questions regarding this Privacy Notice or the way your personal information is processed, please contact the Data Controller using the details above.
Purpose of this Privacy Notice
This Privacy Notice explains:
who is responsible for processing your personal information;
what personal information we collect;
why we collect it;
the lawful bases upon which we process it;
who we may share it with;
how long we retain it;
how we keep it secure;
your rights under applicable data protection legislation; and
how to make a complaint if you are unhappy with the way your personal information has been processed.
Personal Information We Collect
Depending on your interaction with our website and online shop, we may collect the following categories of personal information.
Identity Information
Full name.
Contact Information
Billing address.
Delivery address.
Email address.
Telephone number (where voluntarily provided).
Order Information
Products purchased.
Order number.
Order history.
Delivery instructions (where provided).
Communications relating to your order.
Payment Information
Payments are securely processed through trusted third-party payment providers, including:
Stripe;
Square; and
PayPal.
We do not store or have access to your full debit or credit card details.
Technical Information
When you use our website, we may automatically collect:
Internet Protocol (IP) address;
browser type;
operating system;
device information;
website usage information;
cookies and similar technologies;
diagnostic information used to improve website functionality and security.
Marketing Preferences
Where you choose to receive marketing communications, we may process:
newsletter subscriptions;
marketing preferences; and
communication preferences.
Correspondence
We may retain copies of:
emails;
customer enquiries;
website contact forms;
reviews;
testimonials; and
other correspondence voluntarily provided by you.
If You Do Not Provide Your Personal Information
Where we require certain personal information to fulfil your order or comply with our legal obligations, and you choose not to provide that information, we may be unable to:
process your order;
deliver your products;
respond to your enquiry; or
comply with our legal obligations.
Where this applies, we will explain the reasons wherever reasonably practicable.
How We Collect Your Personal Information
We may collect your personal information:
directly from you when placing an order;
when you contact us by email or via our website;
through WooCommerce during the checkout process;
through our secure payment providers solely to confirm successful transactions;
through cookies and similar technologies used on our website;
from publicly available sources where permitted by law; and
from third parties where you have authorised the disclosure or where we are otherwise legally entitled to receive the information.
Where personal information is obtained from a third party, we will inform you of the source where required by applicable legislation.
10. How We Use Your Personal Information
We may use your personal information for the following purposes:
Purpose
Lawful Basis
Processing and fulfilling orders
Performance of a Contract
Processing secure online payments
Performance of a Contract
Delivering purchased products
Performance of a Contract
Responding to customer enquiries
Legitimate Interests
Providing customer support
Legitimate Interests
Managing refunds, exchanges and returns
Performance of a Contract
Maintaining business records
Legal Obligation
Complying with taxation and accounting requirements
Legal Obligation
Preventing fraud and protecting our business
Legitimate Interests
Improving our website and services
Legitimate Interests
Sending newsletters and marketing communications (where you have opted in)
Consent
Establishing, exercising or defending legal claims
Legitimate Interests and Legal Obligation where applicable
Where processing is based upon your consent, you may withdraw that consent at any time.
11. Sharing Your Personal Information
We do not sell, rent or trade your personal information.
Where necessary to operate our business, fulfil your order or comply with our legal obligations, we may share your personal information with trusted third-party providers including:
Squarespace – website hosting, website infrastructure, website security and operation of our online shop.
Stripe – secure online payment processing and fraud prevention.
Royal Mail, courier or postal service providers – delivery of your orders.
Professional advisers including accountants, insurers, auditors and legal advisers.
Information technology and cybersecurity providers who support our systems.
Regulatory authorities, courts, law enforcement agencies or other public authorities where disclosure is required or permitted by law.
All third-party providers are required to process personal information securely and in accordance with applicable data protection legislation.
Where a third-party provider acts as an independent Data Controller, their processing will also be governed by their own Privacy Notice.
12. International Transfers
As we sell products to customers within the United Kingdom and internationally, your personal information may occasionally be transferred to, stored or processed outside the United Kingdom.
Where this occurs, we will ensure that appropriate safeguards are implemented in accordance with Chapter V of the UK GDPR and, where applicable, Chapter V of the EU GDPR.
These safeguards may include:
transfers to countries recognised as providing an adequate level of protection;
the UK International Data Transfer Agreement (IDTA);
the UK Addendum to the European Commission’s Standard Contractual Clauses (SCCs); or
other lawful transfer mechanisms recognised under applicable legislation.
Some trusted third-party providers, including Squarespace and Stripe, may process personal information outside the United Kingdom.
Where this occurs, those providers are responsible for implementing appropriate safeguards in accordance with applicable data protection legislation.
Further information regarding international transfers is available upon request.
13. International Customers
5Elements Gifts welcomes customers from both the United Kingdom and overseas.
Where products are sold directly to individuals located within the European Economic Area (EEA), certain processing activities may also be subject to the EU General Data Protection Regulation (EU GDPR).
This Privacy Notice has therefore been prepared to comply with both UK GDPR and, where applicable, the EU GDPR.
14. Data Security
Protecting your personal information is one of our highest priorities.
We implement appropriate technical and organisational measures designed to protect your personal information against accidental loss, unauthorised access, disclosure, alteration or destruction.
These measures include, where appropriate:
secure password management;
secure payment processing through Stripe;
encrypted communications where appropriate;
restricted access to personal information;
secure cloud-based systems;
multi-factor authentication where available;
regular software updates; and
confidentiality obligations imposed upon authorised persons processing personal information.
Although we implement appropriate safeguards, no electronic transmission or storage system can be guaranteed to be completely secure.
We continually review our security measures to ensure they remain appropriate to the nature of the personal information we process.
15. Personal Data Breaches
We maintain procedures for identifying, investigating and responding to suspected personal data breaches.
Where required under UK GDPR or other applicable legislation, we will notify the Information Commissioner’s Office (ICO) and affected individuals without undue delay.
If you believe your personal information may have been compromised, please contact us immediately.
Email:
16. Automated Decision-Making and Profiling
5Elements Gifts does not make decisions about individuals solely by automated means, including profiling, which produce legal effects or similarly significant effects.
Should this position change in the future, this Privacy Notice will be updated accordingly.
17. Retention of Personal Information
We will retain your personal information only for as long as is reasonably necessary to fulfil the purposes for which it was collected, including complying with legal, taxation, accounting and regulatory obligations.
Retention periods vary depending upon the type of information processed.
As a general guide:
Record Type
Typical Retention Period
Customer enquiries
Up to 2 years
Order records
Up to 6 years
Financial and accounting records
Minimum 6 years in accordance with HM Revenue & Customs (HMRC) requirements
Marketing preferences
Until consent is withdrawn or no longer required
Website enquiries
Up to 2 years
Where legal proceedings, complaints or regulatory investigations are ongoing, we may retain personal information for an appropriate additional period.
When personal information is no longer required, it will be securely deleted or permanently anonymised.
18. Your Rights
Under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation (EU GDPR), you have the following rights:
the right to be informed;
the right of access;
the right to rectification;
the right to erasure (“the right to be forgotten”);
the right to restrict processing;
the right to data portability;
the right to object;
rights relating to automated decision-making and profiling;
the right to withdraw consent where processing is based upon consent; and
the right to lodge a complaint with the Information Commissioner’s Office (ICO).
These rights are subject to certain exemptions under applicable legislation.
19. Subject Access Requests (SAR)
You have the right to request confirmation as to whether we process your personal information and, where applicable, obtain a copy of that information.
You may submit a Subject Access Request (SAR) by contacting us in writing, including by email.
Although we provide a Subject Access Request form for convenience, you are not required to use it.
Your request should clearly state that you are requesting access to your personal information.
Before releasing any personal information, we may request sufficient evidence to verify your identity.
We will normally respond within one calendar month of receiving your request and verifying your identity.
Where permitted by law, this period may be extended by up to a further two months where requests are particularly complex or numerous.
Subject Access Requests are generally provided free of charge unless the request is manifestly unfounded or excessive.
To submit a Subject Access Request, please contact:
Data Controller
Nadia Maria Ochoa
Email:
20. Consent
Where we rely upon your consent to process your personal information, you have the right to withdraw that consent at any time.
Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.
You may withdraw your consent by contacting us directly via email.
Where consent is withdrawn, we will cease processing your personal information for that purpose unless another lawful basis applies.
21. Marketing Communications
We will only send you marketing communications where:
you have provided your consent;
we are otherwise permitted to do so under the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR); or
another lawful basis applies.
Marketing communications may include information relating to:
new jewellery collections;
gemstone bracelets;
mala beads;
gemstone trees;
exclusive offers;
product launches;
seasonal promotions; and
newsletters.
You may withdraw your consent at any time by:
clicking the “unsubscribe” link contained within our emails; or
contacting us directly.
Withdrawing consent for marketing will not affect communications relating to existing orders.
22. Right to Object
You have the right to object to certain processing activities including:
direct marketing;
legitimate interests;
public interest tasks (where applicable); and
scientific or historical research (where applicable).
Where you object to direct marketing, we will stop processing your personal information for that purpose immediately.
23. Third-Party Websites
Our website may contain links to third-party websites or social media platforms.
This Privacy Notice applies solely to 5Elements Gifts, a trading name of 5Elements Services Ltd.
We are not responsible for the privacy practices, security or content of external websites and encourage you to read their privacy policies before providing any personal information.
24. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in:
legislation;
regulatory guidance;
technology;
our services;
business practices; or
third-party service providers.
The latest version will always be published on our website.
25. Data Protection Complaints Procedure
If you have any concerns regarding the way we process your personal information, we encourage you to contact us first so that we have the opportunity to investigate and resolve your concerns.
Email:
Postal Address:
5Elements Gifts
A trading name of 5Elements Services Ltd
2nd Floor Katherine House
11 Wyllyotts Place
Darkes Lane
Potters Bar
EN6 2JD
To assist us in investigating your complaint, please include:
your name;
your contact details;
details of your concern;
any relevant dates or correspondence; and
the outcome you are seeking.
We aim to acknowledge complaints within 30 days, investigate them fairly and provide a written response without undue delay.
If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO).
Further information is available at:
https://ico.org.uk/make-a-complaint/
Nothing within this procedure affects your legal right to complain directly to the ICO at any time.
26. Contact Us
If you have any questions regarding this Privacy Notice, please contact:
Data Controller
Nadia Maria Ochoa
Director
5Elements Services Ltd
Trading as 5Elements Gifts
Telephone:
0330 333 8429
Email:
27. Governing Law
This Privacy Notice shall be governed by and interpreted in accordance with the laws of England and Wales.
Nothing within this Privacy Notice limits or excludes any rights afforded under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) or, where applicable, the EU General Data Protection Regulation (EU GDPR).
28. Document Review
This Privacy Notice will be reviewed regularly to ensure it remains accurate, up to date and compliant with applicable legislation and business practices.
Document Control
Version: 1.0
Effective Date: 30 June 2026
Last Reviewed: 30 June 2026
Next Scheduled Review: June 2027
Document Owner: Nadia Maria Ochoa
Director
5Elements Services Ltd