Leafys Privacy Policy

Last updated: 16 October 2026

This policy explains what personal data we collect when you visit www.leafys.co.uk or buy from us, why we use it and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).

1. Who we are

Leafys is a trading name of ATPATH LTD, a company registered in England and Wales (company number 16722631). ATPATH LTD is the controller of your personal data. Contact us about anything in this policy at store@leafys.co.uk.

2. What we collect

• Order details: your name, email address, delivery and billing address, phone number if you give it, and what you bought. Card details are handled by our payment provider; we never see or store your full card number.
• Account details: if you create an account, your email address, sign-in details, order history and anything you add to your Passport or travel map (such as the countries you have marked as visited).
• Messages: anything you send us, for example to start a return or ask a question.
• Newsletter: your email address, if you sign up for our postcards.
• Technical data: basic information your browser sends when you visit, such as your IP address, device and browser type.

3. Why we use it, and our lawful basis

• To take, make and deliver your order, handle returns and keep your account working. Basis: performing our contract with you.
• To keep records for tax and accounting. Basis: legal obligation.
• To keep the site secure and working and prevent fraud. Basis: our legitimate interests.
• To send you our newsletter. Basis: your consent, which you can withdraw at any time with the unsubscribe link in every email or by emailing us.

4. Who we share it with

We only share what each partner needs to do its job, and we do not sell your data.

• Wix.com, which runs our shop, checkout, accounts and emails.
• Our payment providers, which process your payment.
• Our print and delivery partners (such as Prodigi and the couriers they use), which receive your name and delivery address to print and send physical orders.
• Professional advisers and authorities, where the law requires it.

Some of these partners store or process data outside the UK. Where they do, the transfer is protected by safeguards recognised under UK law, such as UK adequacy regulations or the International Data Transfer Agreement.

5. Cookies and local storage

We use only the cookies and browser storage the site needs to work: keeping your basket, keeping you signed in and remembering your Passport stamps. We do not use advertising cookies. Our fonts load from Google Fonts, which receives your IP address when the page loads.

6. How long we keep it

• Order and accounting records: 6 years after the end of the financial year of your order, as tax law requires.
• Account details: until you close your account, or after 3 years without any sign-in or order.
• Newsletter: until you unsubscribe.
• Messages: up to 2 years, or longer if they relate to an order we must keep.

7. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. Email store@leafys.co.uk and we will reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to put it right first.

8. Children

Our shop is for adults. We do not knowingly collect data from children under 13.

9. Changes to this policy

We may update this policy from time to time. The latest version is always on this page, with the date it was last updated.