Privacy notice
What we hold about you when you order something, why we hold it, where it is kept, who else ever sees it, and how to have it removed. It is meant to be read, so it is written plainly and it is no longer than it needs to be.
Last updated 9 September 2026
This shop does not track you. There is no analytics on this site, no advertising, no tracking pixel and no third-party script on any page. Nothing for tracking or advertising is stored on your device, which is why you have not been shown a cookie banner — the two things this site does keep there are listed in section 5, and both exist only to stop you losing what you have typed. Nothing about you is sold, and nothing is passed to anybody for marketing.
1. Who is responsible for your information
The shop at is run by . The registered company name, its number and its registered office are in the footer of every page on this site, this one included, and that company is the data controller for everything described here.
For anything to do with your information, write to .
2. What we hold, and why
Nothing at all until you place an order. You can read every page, look at every product and fill a basket without telling us who you are, and without us recording that you were here as anything more than a line in a server log.
When you order, you give us these, and we hold them for these reasons:
| What | Why we have it |
|---|---|
| Your name | To know whose order it is, and to address the parcel |
| Your delivery address | To send you the goods |
| Your email address | To confirm the order, and to answer you about it |
| Your telephone number | Given to the carrier so it can reach you about the delivery |
| What you ordered, and the amount | To fulfil the order, and because sales records have to be kept |
| Your payment reference, and the name the transfer arrives under | To match the money to the order |
Your basket
The basket is kept in your own browser and is not sent to us until you place the order. What it holds and how to clear it is in section 5.
Server logs
The web server writes a line for each request it receives: the address it came from, the page asked for and the time. That is ordinary technical logging, and it is what shows that the site is working and shows an attack when there is one. The lines sit in a rotating buffer and are overwritten as new requests arrive. They are not archived, and they are not used to build a picture of anybody.
3. Paying by bank transfer
Payment is by bank transfer. You send the money from your own bank to ours, quoting the reference on your order, so nothing about your banking is typed into this website.
What our bank tells us is the amount, the reference you quoted and the name the payment came from. Those are what we record against the order, and they are the only thing we learn about your account.
There is nowhere on this site that asks for a card number, so we hold none and there is nothing here that could receive one.
4. Why we are allowed to hold it
- Performance of a contract — your name, address, email, telephone number and order details. We cannot deliver an order without them.
- Legal obligation — the record of the sale itself, which tax law requires us to keep for six years.
- Legitimate interests — server logs, and checking that a payment is what it appears to be. A narrow interest in a site that stays up and orders that are genuine, weighed against very little information.
We send no marketing email, so nothing here rests on your consent, and there is no list to leave.
5. Cookies, and what is kept in your browser
This site sets no cookies at all. It keeps two things on your device, and neither of them leaves it on its own:
| Name | What it holds |
|---|---|
| mnahub_basket_v1 local storage |
The product codes and quantities in your basket. Nothing in it identifies you |
| mnahub_checkout_draft_v1 session storage |
What you have typed into the checkout so far — your name, address, email, telephone and any note — so that a refresh or a mistyped page does not make you type it again. It is cleared when the order is placed, and it goes when you close the tab |
The first is there so that your basket survives a refresh or a second tab; the second so that a long checkout form does not have to be typed twice. Both stay on your own device and neither is sent to us by itself — your details reach us when you press the button that places the order, and not before. The checkout draft does hold what you have typed, so if you are on a shared computer, closing the tab clears it. Clearing this site's data in your browser removes both.
The rules that cover cookies cover storage of this kind as well. Both entries exist only to provide what you asked for — a basket that remembers, and a form that does not empty itself — and neither is used to learn anything about you or to follow you anywhere. There is nothing optional here for you to agree to, and that is why you have not been asked to. If you would rather the checkout did not remember, use a private window: the draft goes with it.
6. Where it is kept
The site and the order records behind it sit on a single server in Germany, rented from Hetzner Online GmbH. Hetzner provide the machine and the building around it; they act on our instructions and they do not use anything on it for their own purposes.
That is the case wherever you are. We deliver to the United Kingdom and the United States, and an order from the United States is handled exactly as one from the United Kingdom: your name, address and order details cross to that one server in Germany and are held there under UK and EU data protection law. There is no separate United States system, and nothing is copied to one.
We do not sell personal information, we do not share it for advertising of any kind, and there is nothing to opt out of.
7. Who else sees it
Three, and none of them for their own purposes:
- The delivery carrier — your name, delivery address and telephone number, so that the parcel reaches you and it can tell you when.
- Your bank and ours — the payment, its amount and its reference. That is what making a transfer means.
- Our accountant, and HMRC — the sales records, as tax law requires.
Beyond that, nobody. We would hand something over if the law required it, or to establish or defend a legal claim, and otherwise we do not.
8. How long we keep it
| What | Kept for |
|---|---|
| Order and payment records | Six years after the end of the tax year they fall in, as UK law requires |
| Emails you send us | While the matter is open, then deleted once there is no reason to keep them |
| Server logs | Overwritten as new requests arrive; not archived |
| Your basket | In your browser only, until you clear it |
An order record cannot be deleted before those six years are up, because keeping it is a legal obligation and not a choice of ours. Anything held beyond that we can delete, and will.
9. How it is protected
- Every page is served over HTTPS, so what you type at the checkout does not travel in the clear.
- There are no card details anywhere in this system, so there are none here to lose.
- Order records are on a server we control, and only the people who fill orders can reach them.
If something goes wrong in a way that puts your information at risk, we will tell you and the regulator, as we are required to.
10. Your rights
Under UK and EU data protection law you can ask us to:
- tell you what we hold about you, and give you a copy
- correct anything that is wrong
- delete what we are not required to keep
- stop using it, or restrict how we use it
- hand it over in a portable, machine-readable form
Write to from the address you ordered with and we will answer within one month. There is no charge. We may ask you to confirm who you are first — not to obstruct you, but so that we are not handing your details to somebody else.
Asking for deletion
Ask, and everything we are free to remove is removed. The record of the sale itself has to stay for the six years described above; what stays is the order, the amount and the address it went to, and nothing is done with it in the meantime beyond keeping it for the tax authorities.
11. How to complain
Please tell us first, so that we have a chance to put it right. If you are still not satisfied you can complain to the Information Commissioner, the United Kingdom's regulator, at ico.org.uk/make-a-complaint. If you live elsewhere you can complain to the data protection authority where you are.
12. Changes to this notice
If this notice changes, the date at the top of the page changes with it. We do not change it quietly.