Privacy Policy

Last updated: 23 September 2026

This policy explains how Arcana Living Ltd (“Arcana”, “we”, “us” or “our”) uses personal information when you visit www.arcanaliving.com, buy physical or standalone digital products from us, join a Curiosity Companions subscription (Curiosity Crew, designed for children aged approximately 4-7, or Curiosity Club, designed for children aged approximately 7-12), contact us, receive marketing, or deal with us as a supplier or business contact. We currently sell and ship to the United Kingdom only. This policy should be read together with our Terms and Conditions of Sale and our Cookie Policy. Purchases made through third-party marketplaces such as Etsy, or through our wholesale arrangements, are covered by separate terms and privacy information.

1. Who we are

Arcana Living Ltd is the controller of the personal information described in this policy.
We are registered in England and Wales under company number 14399047. Our registered office is The Barn, Meadow Court, Faygate Lane, Faygate, Horsham, West Sussex RH12 4SJ.
For privacy questions or to exercise your rights, email care@arcanaliving.com.

2. Information we collect

Depending on how you interact with us, we may collect:

Identity and contact information, such as your name, email address, telephone number, billing address, delivery address and account details.
Order, download and subscription information, such as physical or digital products purchased, download or access status, checkout consent records, subscription plan, minimum commitment, renewal dates, pause or skip requests, scheduled end instructions, delivery history, returns, refunds and customer-service correspondence.
Payment information, such as payment status, transaction reference and limited payment-method details supplied by our payment providers. We do not normally receive or store your complete card number.
Gift-message information that you choose to provide. Please avoid including unnecessary or sensitive personal information in a gift message.
Marketing information, such as whether you have agreed to or opted out of marketing, and your interaction with our emails.
Website and device information, such as IP address, browser, device, approximate location, pages viewed, referral source and cookie identifiers, subject to your cookie choices.
Business-contact information supplied by our retailers, suppliers, professional advisers and other commercial contacts.
Information you give us when you make an enquiry, enter a promotion, leave a review, respond to a survey, contact us through social media or make a complaint.

We do not intentionally collect special-category information, such as health information, through our ordinary sales process. Please do not send it unless it is necessary for us to address a specific request.

3. Children’s information

Our Curiosity Companions subscriptions - Curiosity Crew (for children aged approximately 4-7) and Curiosity Club (for children aged approximately 8-12) - together with some archive editions and some standalone digital resources, are designed for children to use with their families. Purchases, downloads, subscriptions and website accounts are for adults aged 18 or over, and the subscription account and contract are always held by an adult. We do not knowingly collect personal information directly from children.

An adult account holder may choose to give us limited information about the child who will use a subscription - for example a first name or age range - so that we can supply an age-appropriate package. That information is provided and managed by the adult account holder, who can update or remove it by contacting us, and we ask only for the minimum information needed for this purpose.

We do not use children’s information for marketing and we do not send marketing to children. We treat the best interests of the child as a primary consideration and apply data minimisation, consistent with the UK GDPR and the ICO’s Age Appropriate Design Code (Children’s Code).

A purchaser may voluntarily include a child’s name or other information in a gift message. We use that information only to prepare and deliver the message as requested. The purchaser should have authority to provide it and should not include more information than necessary.

If we learn that a child has directly provided personal information through the website, we will take appropriate steps to delete it or contact the child’s parent or guardian where necessary.

4. How we use information and our lawful bases

We use personal information for the following purposes:

Purpose	Main lawful basis
To accept payment, fulfil a physical or digital order, record any request for immediate digital supply and acknowledgement of the loss of the cancellation right, provide download access, manage a subscription, send renewal and payment messages, provide the customer portal, deliver packages and handle returns	Performance of our contract with you; and compliance with legal obligations where applicable
To answer enquiries and provide customer support	Performance of our contract or our legitimate interests in providing support
To maintain transaction, tax and accounting records and respond to lawful requests	Compliance with legal obligations
To prevent fraud, secure accounts, troubleshoot systems and protect our business and customers	Our legitimate interests and, where applicable, legal obligations
To improve products, services and website performance using permitted analytics	Our legitimate interests where the law allows; otherwise consent
To send promotional email marketing	Consent or, where every legal condition is met, the customer soft opt-in and our legitimate interests
To personalise and measure advertising using non-essential cookies or similar technologies	Consent
To manage suppliers, retailers and professional relationships	Performance of a contract and our legitimate interests in operating the business
To establish, exercise or defend legal claims	Our legitimate interests and legal obligations

Where we rely on legitimate interests, we consider whether the use is necessary, proportionate and within your reasonable expectations. You can contact us for more information about this assessment.

We will not use personal information for a materially incompatible purpose without explaining the new purpose and identifying an appropriate lawful basis.

5. Service and renewal communications

Subscription reminders, payment receipts, order confirmations, digital-download messages, dispatch notifications, safety notices and account messages are service communications rather than marketing. We send them because they are necessary to administer your purchase or subscription. You cannot opt out of essential service messages while the relevant order or subscription remains active.

6. Marketing

Where required, we ask separately for permission to send marketing. Agreeing to marketing is not a condition of buying from us. We market only to adults and do not send marketing to children.

In some circumstances, the law permits us to email existing customers about our own similar products using the customer “soft opt-in”. We use this only where we obtained the contact details during a sale or genuine sales negotiation, offered a clear opt-out when collecting them, and include an easy opt-out in every subsequent message.

You can unsubscribe using the link in any marketing email or by contacting care@arcanaliving.com. We will stop sending marketing, but may retain a minimal suppression record so that we honour your request.

7. Cookies and online advertising

We use necessary technologies to operate the website and, with your permission, may use analytics and advertising technologies. Our Cookie Policy and cookie preference centre provide more information and allow you to change your choices.

Non-essential cookies and similar technologies are not intended to operate before the required consent has been obtained. Withdrawing consent does not affect processing that occurred lawfully before withdrawal.

8. Who receives information

We disclose personal information only where necessary and subject to appropriate protections. Recipients may include:

Shopify, including its Digital Products service, which hosts our online shop, provides digital-download links, and supports ordering, accounts and payment processing;
e-commerce and checkout-functionality providers, where needed to display and record required choices or acknowledgements at checkout;
Appstle, which provides subscription management, renewal and customer-portal functionality;
Shop Pay, Stripe and PayPal, as applicable to the payment method selected;
Klaviyo, which provides email and customer-communication services;
Gillards, Trident Works, Marsh Lane, Temple Cloud, Bristol BS39 5AZ, which fulfils and dispatches orders and processes authorised returns;
our weaving partner in the United States, which makes our woven-to-order blankets. We provide the weaving partner only with the product specifications needed to make each blanket and do not share any customer personal information with it. The finished blankets are sent to us, imported and quality-checked by us, and dispatched to you from the United Kingdom;
CookieScript, which manages cookie information and preferences;
Google Analytics, where enabled with the required permission, for website analytics;
Meta and Pinterest, where enabled with the required permission, for advertising, measurement or social-media functions;
delivery companies, including Royal Mail (including its Tracked 48 service);
IT, hosting, security, accounting and professional-advisory providers;
regulators, courts, law-enforcement bodies, insurers or other parties where disclosure is required or permitted by law; and
a purchaser or successor if we sell, transfer or reorganise all or part of the business, subject to appropriate confidentiality and data-protection safeguards.

Some providers act as independent controllers for parts of their services, particularly payment, advertising and social-media providers. Their own privacy information may also apply.

We do not sell personal information.

9. International transfers

Although we sell and ship within the United Kingdom only, some of our providers may process personal information outside the UK, including in the United States and, for certain platform or support services, potentially in other countries such as Canada. Where UK data-protection law requires a transfer safeguard, we rely on UK adequacy regulations where they apply, or we put in place the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, carry out a transfer risk assessment, and consider whether supplementary measures are appropriate.

Our woven-to-order blankets are made by our weaving partner in the United States. No customer personal information is transferred to the weaving partner: we send it only the product specifications needed to make each blanket. The finished blankets are delivered to us, imported and quality-checked by us, and then dispatched to you from the United Kingdom.

You can contact us for more information about the safeguard relevant to a particular provider.

10. How long we retain information

We retain information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, fraud-prevention and dispute-resolution requirements.

In general:

order, payment and accounting records are normally retained for up to six years after the end of the relevant financial year or customer relationship;
active subscription and account information is retained while the subscription or account remains active, then limited or deleted in accordance with our legal and operational needs;
ordinary customer-service correspondence is periodically reviewed and deleted when no longer needed, subject to any complaint or legal claim;
marketing information is retained until you unsubscribe or we determine that it is no longer appropriate to contact you, while a minimal suppression record may be kept thereafter;
gift-message content is retained only for as long as needed to fulfil the order and resolve associated enquiries; and
cookie and analytics information is retained for the periods shown in the cookie preference centre or relevant provider settings.
digital-product delivery records, such as the email address used for delivery, download or access status and any download-limit or access-monitoring records, are retained for as long as needed to provide and support the product and to maintain the transaction and accounting records referred to above; and
any limited child-related information (such as a first name or age range) is retained only while the relevant subscription is active and is then deleted or anonymised, unless we must keep it to handle a query, complaint or legal claim.

We may retain information for longer where a dispute, investigation or legal obligation requires it. We may retain anonymised information that can no longer identify you.

11. Security

We use appropriate organisational and technical measures intended to protect personal information. Access is limited to people and providers that need it for an authorised purpose. No internet service is completely secure, but we investigate suspected breaches and notify affected people and the Information Commissioner’s Office where the law requires it.

You are responsible for keeping your account password and access links confidential.

12. Your rights

Depending on the circumstances, you may have the right to:

receive a copy of your personal information;
correct inaccurate or incomplete information;
ask us to delete information;
restrict how we use information;
object to processing based on legitimate interests;
object at any time to direct marketing;
receive certain information in a portable format;
withdraw consent at any time; and
complain to the Information Commissioner’s Office.

These rights are subject to legal conditions and exemptions. We may request information needed to verify your identity. We normally respond within one month and do not charge a fee unless a request is manifestly unfounded or excessive.

Data Complaints: We are committed to treating your personal information with respect, transparency and care. If you ever have questions or concerns about how your data is used, we want to hear from you, and we will do our best to resolve things quickly and fairly. Under the Data (Use and Access) Act 2025, you have the right to raise a complaint with us about how your personal information is handled. Here is how:

Step 1: Email us at care@arcanaliving.com with a brief description of your concern. You do not need to use legal language — just tell us what is worrying you.

Step 2: We will acknowledge your message and respond without undue delay, usually within 10 working days.

Step 3: If you are not satisfied with our response, you can escalate your concern to the Information Commissioner’s Office (ICO) at www.ico.org.uk.

13. Third-party links

Our website may link to websites or services we do not control. Their privacy policies apply to their collection and use of information.

14. Changes to this policy

We may update this policy to reflect changes in our services, providers or legal obligations. We will publish the updated version on our website and identify the revision date. Where a change materially affects how we use personal information, we will provide additional notice where appropriate.