Privacy information
Privacy and cookie notice
Last updated:
This notice explains what happens to information when you use Wonder Aisle, including its shops such as The Plushy Shop.
1. Who is responsible for your information?
Brightware Ltd, trading as Wonder Aisle, is the controller for the information described in this notice.
- Postal address
- 100 Church Street, Brighton, BN1 1UJ
- aps_secure@outlook.com
- Telephone
- 07890 830416
AliExpress is a separate organisation and an independent controller for the information it collects when you visit or buy through its platform. See the AliExpress Privacy Policy.
2. Information we use, why we use it and our lawful basis
| Information | Purpose | UK GDPR lawful basis |
|---|---|---|
| Technical request and security information, such as IP address, browser type, requested page, time and server events | Deliver the site, diagnose faults, prevent abuse and keep it secure | Our legitimate interests in operating and protecting the service |
| Product references saved in the encrypted saved-list cookie | Provide the list you expressly ask us to save in this browser | Our legitimate interests in providing the requested feature; the cookie is exempt from consent under PECR because it is used only for that feature |
| Product reference, shop, placement, UTC date and an aggregate count when at least 25% of a product placement becomes visible. The aggregate does not contain an IP address, user agent, browser identifier, fingerprint or account reference. | Measure catalogue usefulness and calculate product and placement click-through rates without building visitor profiles | Our legitimate interests in understanding and improving the service through privacy-minimised measurement |
| With your permission: page URL and title, referral source, approximate location, device/browser information, session and interaction events collected by Google Analytics | Understand visits, navigation and which content is useful | Your consent; Google Analytics does not load unless you accept |
| A randomly generated click ID, product reference, shop, campaign, link placement and click time | Open the requested AliExpress page, attribute affiliate activity, detect fraud and measure whether the service works | Our legitimate interests in operating and funding the affiliate service and preventing fraud |
| Limited order-attribution data supplied by AliExpress, such as sub-order reference, product, time, broad destination country, platform, order status, amount and commission | Reconcile commissions, investigate missing or invalid attribution, keep accounts and meet tax obligations | Our legitimate interests in administering the affiliate programme and our legal obligations for accounting and tax records |
| Your name, contact details and message if you contact us | Answer enquiries, rights requests and complaints, and keep an appropriate record | Our legitimate interests in corresponding with you, steps you ask us to take, and our legal obligations |
| Administrator username, security records and authentication cookie (site administrators only) | Control and audit access to the private administration area | Our legitimate interests in securing and administering the service |
We do not ask AliExpress for buyer names, delivery addresses, email addresses, payment-card details or account credentials. We do not make decisions about you that have legal or similarly significant effects.
4. Where information comes from and who receives it
We receive information from your browser, from choices you make on this site, from messages you send, and from AliExpress affiliate reports or secured server-to-server notifications.
We disclose information only where needed to:
- hosting, database and technical service providers acting for us under appropriate confidentiality and data-protection terms;
- Google, only after you accept optional analytics, to provide aggregated website measurement;
- AliExpress, when you ask to follow a link, by sending the destination and affiliate-attribution parameters needed for the redirect;
- professional advisers, insurers, courts, regulators or public authorities where necessary to obtain advice, establish or defend legal rights, or comply with law; and
- a buyer or successor if the service or its operator is reorganised, subject to appropriate safeguards.
Product images and videos are delivered from AliExpress or seller content-delivery systems. When your browser requests that media, those systems receive ordinary web-request information such as your IP address and browser details.
We do not sell personal information.
5. International transfers
Some technical providers and AliExpress group companies operate outside the UK, including in Singapore, Hong Kong, China and other countries. AliExpress acts as an independent controller for its platform. Where we make a restricted transfer to a provider acting for us, we use a lawful UK transfer mechanism and carry out the checks required by UK data-protection law. You may contact us for information about the safeguard relevant to your information.
6. How long we keep information
- The saved-list cookie expires after 90 days and is deleted sooner if you clear the list.
- Security and server records are kept for the shortest period reasonably needed to investigate faults, abuse or incidents, according to the host’s configured retention schedule.
- Daily product-impression totals do not identify a visitor. They are retained for historical trend comparison and reviewed at least annually for continued usefulness.
- The analytics consent preference lasts up to six months. Google Analytics cookies are configured for up to six months without extending the expiry on each return visit. Google controls its resulting service records under the applicable Analytics retention settings.
- Click and order-attribution records are kept through the relevant commission validation and dispute period, then deleted or anonymised unless they are still needed for fraud prevention, a legal claim or a legal obligation. We review this data at least annually.
- Accounting and tax records are normally kept for six years after the relevant financial period.
- Enquiries and complaints are kept only while needed to respond and for a reasonable period to show how the matter was handled.
7. Children’s privacy
A plush-toy catalogue may be visited by children, so we apply a high-privacy approach to everyone. There are no public accounts, direct marketing, precise location features, behavioural profiles, personalised adverts or social features. Saving a product is optional and stores only product references in that browser. Children should ask a parent or guardian to help before leaving for AliExpress or making a purchase. A child or their representative can use the rights and complaint routes below.
8. Your data-protection rights
Depending on the circumstances, you may ask us for access to your personal information, correction, deletion, restriction, or a portable copy. You may also withdraw consent where a use is based on consent (none of the current uses listed above is), and complain to us or the regulator. These rights can be limited by law; for example, we may need to retain a record to meet a legal obligation.
To exercise a right, email aps_secure@outlook.com. We may ask for information reasonably needed to verify your identity or clarify the request. We normally respond within one month; the time limit may pause while we await necessary clarification, and the law permits an extension for a complex or repeated request.
9. Data-protection complaints
Email aps_secure@outlook.com with the subject “Data protection complaint” and explain what happened and the outcome you want. We will acknowledge your complaint within 30 days, investigate it appropriately and tell you the outcome without undue delay.
You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or write to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
10. Security and changes to this notice
We use measures appropriate to the service, including HTTPS, encrypted and HTTP-only cookies, restricted administration access, database access controls and minimisation of affiliate data. No internet service can promise absolute security.
We review this notice when the service, law or our suppliers change. Material changes will be highlighted on the site and the date above will be updated. Earlier versions can be requested using the contact details in section 1.