Basket 0

Privacy & cookies

This notice explains what personal data Mistfall collects, why, and what your rights are. We keep it to the minimum we need to run the shop.

Who we are

The data controller is Dragon Academy Ltd.

  • Address: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ
  • Email: please use our contact form (store email opens with our own domain)

Questions about your data, or want to use your rights? Contact us.

What we collect and why

When you place an order

  • What: your name, delivery address, email address, phone number if you give one, what you ordered and how much you paid. Card details are entered on Stripe's page; we never see your full card number.
  • Why: to take payment, deliver your order, send dispatch and tracking emails, handle returns and refunds, and keep the accounts the law requires.
  • Lawful basis: contract (to fulfil your order) and legal obligation (tax and accounting records).

When you sign up to hear when a product is available

  • What: your email address and the product you're interested in.
  • Why: to email you once when that product is in stock.
  • Lawful basis: consent. You can withdraw it at any time by emailing us or replying to the notification email, and we'll delete your details.

We won't use this to send you other marketing.

When you contact us

  • What: your name (if you give it), email address and your message.
  • Why: to reply and help with your question, order or return.
  • Lawful basis: legitimate interests (answering enquiries and providing customer service), or contract where it's about an order.

Keeping the site secure

  • What: technical data like your IP address and browser type, handled by our hosting provider.
  • Why: to keep the site working and protect it from abuse and spam.
  • Lawful basis: legitimate interests (running a secure website).

We don't use your data for automated decision-making or profiling, and we don't sell it.

Who we share it with

We use a small number of service providers who process data on our behalf:

  • Stripe for payments. Stripe holds your order and payment details. For some purposes, such as fraud prevention and meeting its own legal obligations, Stripe acts as an independent controller under its own privacy policy.
  • Cloudflare for website hosting, security and our database, which stores interest sign-ups and contact messages.
  • Our UK warehouse partner, which receives your name, delivery address and order details so it can pack and send your order. It passes the details needed for delivery to its courier.
  • An email provider, once set up, to send order and stock emails. We'll name it here when we do.

We may also share data if the law requires it, for example with HMRC.

International transfers

Stripe and Cloudflare may process data outside the UK, including in the US and the EU. Where that happens, transfers are protected by UK adequacy regulations (including the UK–US data bridge where the provider is certified) or by the UK International Data Transfer Agreement or Addendum.

How long we keep it

  • Order records: 6 years, for tax and accounting purposes.
  • Interest sign-ups: deleted once we've sent the one notification, or after 12 months, whichever comes first.
  • Contact messages: 2 years, then deleted.

Your rights

Under UK data protection law you have the right to:

  • access the personal data we hold about you;
  • rectification, to have inaccurate data corrected;
  • erasure, to have your data deleted where we no longer need it;
  • restrict how we use your data in some cases;
  • object to processing based on legitimate interests;
  • portability, to receive data you gave us in a reusable format;
  • withdraw consent at any time, where we rely on consent.

To use any of these, contact us. We'll reply within one month. It's free in most cases.

Complaints

If you're unhappy with how we've handled your data, please tell us first and we'll try to put it right.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.

Cookies and similar technologies

We don't use tracking, analytics or advertising cookies. That's why there's no cookie banner.

  • Your basket is saved in your browser's local storage, on your own device, so it remains if you leave and come back. This is strictly necessary for the basket you've asked for, so it doesn't need consent. It isn't sent to us until you check out, and you can clear it by emptying your basket or clearing your browser's site data.
  • Stripe sets its own cookies on its checkout page when you pay. They're used for fraud prevention and security. See Stripe's cookie policy.
  • Cloudflare, our host, may set a strictly necessary security cookie to tell real visitors from bots. It isn't used for tracking.

Page counts. Our server adds one to a daily counter for each page that's viewed (for example "/guides/ was viewed 12 times on 4 November"). It stores no IP address, no cookie, no identifier and nothing about you, so it isn't personal data.

If we ever add cookies that need your consent, we'll ask first and update this page.

Children

Our shop is for adults. We don't knowingly collect data from children.

Changes

We'll update this notice if how we use data changes. Last updated: 3 November 2026.