How we collect, use, share and protect personal data, and the rights you have under the UK GDPR and the Data Protection Act 2018.
Last updated: 1 January 2026
This policy explains how 2wantis2have ("we", "us", "our") handles personal data when you visit https://2wantis2have.com, place an order, apply for a trade account or contact us. We are the data controller for that information. The responsible person is Donald Anderson and you can reach us at info@2wantis2have.com or at 39A Harlesden Gardens, London, Greater London, NW10 4EY, United Kingdom.
We do not collect or store full payment card numbers, expiry dates or security codes — these are handled entirely by our PCI-DSS compliant payment provider. We do not knowingly collect data from children under 16. We do not collect special category data (such as health data), and you should not send it to us.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Processing and delivering your order | Identity, contact, order | Performance of a contract |
| Taking payment and preventing fraud | Order, technical | Contract and legitimate interests |
| Customer service and complaint handling | Identity, contact, correspondence | Contract and legitimate interests |
| Keeping accounting and tax records | Identity, order | Legal obligation |
| Sending marketing emails | Contact, marketing preferences | Consent (withdrawable at any time) |
| Improving the website | Technical, usage | Consent for analytics cookies; legitimate interests for essential operation |
| Managing trade accounts | Business, identity, order | Contract and legitimate interests |
We only send marketing email where you have opted in, or where you have bought from us and we are contacting you about similar products under the soft opt-in rule. Every marketing email contains a one-click unsubscribe link, and you can also withdraw consent at any time by emailing info@2wantis2have.com. Withdrawing marketing consent does not affect transactional messages such as order confirmations and dispatch notices, which are necessary to perform the contract.
We never sell personal data. We share the minimum necessary with:
All processors act on our documented instructions under a written contract and may not use your data for their own purposes.
Where a service provider processes data outside the United Kingdom, we ensure an adequate level of protection through a UK adequacy regulation, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with appropriate technical safeguards.
| Record type | Retention period |
|---|---|
| Order and transaction records | 6 years after the end of the tax year, to meet HMRC requirements |
| Customer service correspondence | 24 months after the matter is closed |
| Marketing consent records | Until consent is withdrawn, then 24 months as proof of withdrawal |
| Trade account records | 6 years after the account becomes inactive |
| Website analytics data | Up to 14 months in aggregated form |
Under the UK GDPR you have the right to: be informed about how your data is used; access a copy of your data; have inaccurate data corrected; request erasure where there is no overriding reason to keep it; restrict processing; receive your data in a portable format; object to processing based on legitimate interests; object to direct marketing at any time; and withdraw consent where processing relies on it.
To exercise any right, email info@2wantis2have.com with the subject "Data request", or write to us at the address above. We respond within one month. There is no charge for a reasonable request. We may ask for proof of identity so that we do not disclose your data to someone else.
The website is served over HTTPS with TLS encryption. Access to customer data is restricted to those members of our team who need it to do their job, protected by individual accounts and strong authentication. We keep records of processing, review our suppliers, and have a procedure for identifying and reporting a personal data breach to the Information Commissioner's Office within 72 hours where the breach is likely to result in a risk to individuals.
This website uses strictly necessary cookies to function, and may use analytics cookies only with your consent. Full detail, including how to withdraw consent, is set out in our cookie policy.
If you have a concern about how we handle personal data, please raise it with us first at info@2wantis2have.com so we can put it right. You also have the right to complain to the UK supervisory authority: the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113, ico.org.uk.
We review this policy at least annually and whenever our processing changes materially. The date at the top of the page shows the current version. Where a change materially affects you, we will tell you by email if we hold your address.
