Last updated: 12 September 2026
handl is a trading name of Kareem Chouiki, a sole trader based in London, United Kingdom. This page explains what happens to your information when you visit this site, buy something, sign up for emails, or send a message.
The data controller is handl, Kareem Chouiki, 152 Tillermans Court, Grenan Square, Greenford, London UB6 0FS. For anything on this page, including a request about your own data, email hello@gethandl.co.uk.
The short version
Buying something and emailing handl work with no cookies and no tracking at all. Measurement and advertising are both switched off until you press a button saying otherwise, and they are separate choices — you can allow one and refuse the other. Nothing about you is ever sold.
What is collected, and when
If you buy something
Checkout is handled entirely by Stripe. You enter your name, email, delivery address and card details on Stripe's own page, not on this website. handl never sees or stores your full card number.
What handl receives from Stripe is what's needed to send your order and account for the sale: your name, delivery address, email address, phone number, what you bought, and the last four digits of your card. The phone number is asked for so Royal Mail can let you know about a delivery and so a problem with an order can be sorted out quickly; it is optional at checkout. Orders are read back out of Stripe when they need to be looked at; they are not copied into a second database on this website.
Stripe also records baskets that were started and never paid for, which is how handl can tell whether something went wrong at checkout.
If you put something in your basket
Your basket is kept in your own browser, not on a server, and not in a cookie. Nothing about it leaves your device unless one of two things happens.
- You type your email address into the basket and tick the box asking me to send it to you. Then the basket, your address, the date you agreed and the wording you agreed to are saved, I email it to you straight away, and if you have not come back after about four hours I send one reminder. Never more than one, and every email has a one-click link that stops them for good.
- Or you have already agreed to measurement, in which case an anonymous copy of the basket is saved so I can see which packs get abandoned and fix whatever is putting people off. There is no address attached to those and nothing is ever sent to them.
Baskets are deleted automatically after 45 days. If you buy, the basket is marked as bought and no reminder is sent.
If you message on WhatsApp
There are two ways to use the green button. Open WhatsApp hands you over to WhatsApp itself. Or message me here is a form on this site, for people who don't use WhatsApp: it asks for your name, a mobile number and an email address, and the message goes straight to my inbox so I can reply. Your number is asked for only so I can answer on WhatsApp; leave it blank and I will reply by email instead. Your details are remembered in your own browser so you are not asked twice, and messages are kept for six months and then deleted.
The green button opens a chat with me. It is an ordinary link — pressing it runs no WhatsApp or Meta code on this site, and nothing about your visit reaches Meta because of that button unless you press it. Once you do, the conversation is on WhatsApp and is covered by WhatsApp's own privacy policy; I can see your phone number and whatever you write. Messages stay on my phone and I delete them once whatever you asked about is sorted.
If you email
Your message and email address arrive in an inbox and stay there. If you send a photo of your pump for a custom fit, that photo is kept only as long as it takes to make the part.
If you ask for emails
There is a sign-up box on some pages. You are only added if you tick the box yourself — buying something does not add you, and there is no pre-ticked box anywhere on this site. What is stored is your email address, your first name if you gave one, the date you agreed, the exact wording you agreed to, and the country your browser connected from. The date and wording are kept because UK marketing law requires handl to be able to show that you agreed, not merely to say so.
Every email has an unsubscribe link that works immediately, with no login. Once you unsubscribe, your address is marked as unsubscribed rather than deleted, so that you are not accidentally added again later. Ask and it will be erased completely.
If you just visit
When a page loads for the first time, a notice appears at the bottom offering three options: Essential only, Accept, or Choose, which lets you tick measurement and advertising separately. Until you answer, nothing is stored on your device and nothing is sent anywhere. The shop works identically whichever you pick, and your answer is remembered for six months.
If you allow measurement, two things happen:
- Google Analytics counts visits and pages. It is configured to anonymise your IP address, and Google's advertising and personalisation signals stay switched off unless you also allow advertising.
- handl's own visit log records one row per visit, not one per page view. It holds a random visit number, the time it started and ended, the pages you looked at in order, the website that sent you here, the country your browser connected from, whether you were on a phone or a computer, and whether you clicked through to checkout. If you later type your email address into a form on the site, that visit is linked to your address so that a question about your order can be answered properly. Your IP address is not stored. The whole record deletes itself automatically after 90 days.
The visit log is used to see which pages are doing their job, to fix the ones that aren't, and to decide who to send an offer or a discount to. It is not used to make any automated decision about you.
If you allow advertising, a Meta (Facebook and Instagram) pixel loads. It tells Meta that a browser visited this site and, if you buy, that a purchase happened, so that handl can advertise to people who looked but didn't order and to people with similar interests. This is a genuine advertising tracker and it does set cookies. It loads only after you have said yes, and it never loads at all if you choose Essential only. When you buy something, we also send a record of that purchase to Meta from our own servers as well as from your browser, so the sale is still counted if the browser tag is blocked. That record contains the value and currency of the order, the time you placed it, a reference code for the order, the address of the confirmation page, the Meta cookies already on your device, your IP address and your browser's user agent. It does not contain your name, email address, phone number or postal address. It is sent only if you agreed to advertising, and only once payment has been confirmed. If you have not agreed to advertising, nothing is sent from either place.
To change your mind, clear this site's cookies in your browser and the notice will appear again.
The site is served by Cloudflare, which processes standard server request data (including your IP address) to deliver pages and block attacks, regardless of your cookie choice, because a website cannot be delivered without it. Fonts are served from this website itself, so loading a page makes no request to Google or to any other font service.
To stop automated abuse of sign-in, checkout, messaging and sign-up forms, the site also turns your connecting address into a short one-way hash and uses it only as a temporary request counter. The address itself is not stored in that counter, it is not joined to visit analytics, and the counter expires automatically after no more than 48 hours.
Why it's held, on what legal basis, and for how long
| Information | Legal basis | Kept for |
|---|---|---|
| Name, address, email, order | Contract — making and posting your order | 6 years, as HMRC requires for business records |
| Baskets started but not paid for | Legitimate interest — spotting checkout problems | Held by Stripe under Stripe's own retention |
| Email correspondence | Legitimate interest — answering you and resolving problems | Deleted once the matter is closed |
| Photos sent for custom fits | Contract — to make your part | Deleted after your order ships |
| Basket, where you asked me to email it | Consent | 45 days, then deleted automatically |
| Anonymous basket, where you agreed to measurement | Consent | 45 days, then deleted automatically |
| Messages sent through the chat box, and the name, number and email with them | Legitimate interest — answering you | 6 months, then deleted automatically |
| WhatsApp messages | Legitimate interest — answering you | Deleted once the matter is closed |
| Marketing list entry, and the record of your consent | Consent | Until you unsubscribe, plus a suppression record so you aren't re-added |
| Partner payment details — how a partner has asked to be paid, and the record of what was paid and when | Contract — paying you what you have earned | 3 years, which is long enough to answer a question about a payment |
| Partner applications — your name, email, where you post, roughly how many people you reach, and what you wrote. If you accept the partner agreement, we also keep the name you typed as your signature, the version you accepted and a fingerprint of its exact wording, the date and time, your connecting IP address and your browser’s user-agent string. Those last two are kept because an agreement acceptance is only worth anything if it can be shown to be genuine, and they are removed if you ask to be erased | Legitimate interest — considering you for the partner programme and replying to you | 2 years, then deleted automatically. Sooner if you ask |
| Temporary hashed request counter | Legitimate interest — protecting the shop, customers and messaging services from automated abuse | No more than 48 hours |
| Visit log | Consent | 90 days, then deleted automatically |
| Advertising pixel data | Consent | Held by Meta under Meta's own retention |
Cookies
| Cookie | What it does | Set when | Kept for |
|---|---|---|---|
handl_consent | Remembers what you chose, so you're not asked again | The moment you answer, whichever way you answer | 6 months |
handl_admin | Keeps the shop owner signed in to the admin page. Never set for a visitor | Only when handl signs in to manage the shop | 12 hours |
handl_s | A random number that ties the pages of one visit together. Not linked to any account and not readable by anyone else | Only if you allow measurement | 30 minutes |
_ga, _ga_* | Google Analytics — counts visits and pages | Only if you allow measurement | Up to 2 years |
_fbp | Meta pixel — advertising and measuring adverts | Only if you allow advertising | Up to 3 months |
handl_partner | Keeps a partner signed in to their own partner page, where they can see what their link has earned. Never set for a customer | Only when a partner opens the sign-in link sent to their email | 30 days |
handl_ref | Remembers which partner’s link brought you here, so that partner is credited if you order. It holds their code, not anything about you | Only if you arrive through a partner link, of the form /a/CODE | 90 days |
| handl_customer | Keeps you signed in on your own orders page, so you can look up something you have already bought. It holds a random number and nothing about you. Never set unless you ask for a sign-in link and open it | Only when you open the sign-in link sent to your email | 7 days |
If you use the chat box, your name, number and email are also kept in your browser under handl_contact, so the form does not ask you again. Clearing this site’s data removes it.
Your basket is kept in your browser’s own storage under the name handl_cart. That is not a cookie — it is never sent to the server on its own — but it is your data, so it is listed here for completeness. Clearing this site’s data removes it. Only if you allow measurement, two more names are kept in the same place: handl_src, which remembers which site linked you here and any campaign tag that was on the link, so that an order can be matched to where it came from; and handl_ga_sent, which holds the order numbers already counted, so that reloading your confirmation page does not count your order twice. Neither holds anything about you, neither is a cookie, and you are never asked where you came from — there is no such question anywhere on this site.
Nothing else. Stripe sets its own cookies on its checkout page, which is covered by Stripe's privacy policy.
Who else sees it
- Stripe Payments Europe Ltd — payment processing, and the record of your order.
- Royal Mail — your name and address, on the parcel.
- Cloudflare — website hosting, and storage of the visit log and marketing list.
- Forward Email — forwarding email sent to gethandl.co.uk.
- Google — email inbox provider, web fonts, (only if you allow measurement) Google Analytics, and Google Customer Reviews on the order confirmation page. See below.
- Resend — sends the emails this shop sends, and sees the address each one went to and whether it was delivered. See “Emails I send you” at the foot of this page.
- Meta Platforms Ireland Ltd — only if you allow advertising, which covers both the pixel and the Instagram video in the review, or if you choose to message on WhatsApp.
Your details are never sold or rented. Nothing is shared with an advertiser unless you have agreed to advertising cookies, and even then what Meta receives is activity on this site and the value of a purchase you have made — not your order history, your name or your address.
Google and Meta are American companies. Where your data reaches the United States it does so under the UK extension to the EU–US Data Privacy Framework or standard contractual clauses, which is the safeguard UK law requires for that transfer.
Google Customer Reviews
After you pay, the confirmation page offers to sign you up for a review survey. To show you that offer, the page sends Google your order number, the email address you gave at checkout, the delivery country, and the estimated delivery date. It sends nothing else, and it happens only on that one page — no other page on this site contacts Google Customer Reviews.
Be aware of the order of events: those details reach Google when the page loads, which is before you decide. Ticking the box is what tells Google to email you later and ask what you thought; leaving it alone means no survey is sent. If you would rather Google did not receive them at all, email hello@gethandl.co.uk and I will ask Google to delete them, and turn the feature off for your order.
The lawful basis is legitimate interest — a shop with no customer reviews cannot tell anyone whether the thing works, and honest feedback is how that changes. It is balanced against sending the smallest set of details that makes it function: no name, no address, no items, and no payment information. Your answers, if you give any, are published by Google as a rating and are not sent to me individually.
The review badge — a star rating Google can display on a shop’s
pages — is switched off. It was on for one day, 8 to 9 August 2026,
on the home page and the product pages. While it was on it loaded around 450 KB
of files from Google onto those two pages and set one Google cookie,
NID, from a Google frame inside the page. It has been removed
because it was slowing the site down to show a rating that does not exist yet,
and because that cookie was being set before you had been asked.
Nothing else about Google Customer Reviews reaches any page except the confirmation page described above. If the badge is ever switched back on, this section will say so and will say what it loads.
Your rights
Under UK GDPR you can ask for a copy of what's held about you, ask for it to be corrected, ask for it to be deleted (where there's no legal duty to keep it), object to how it's used, withdraw a consent you gave earlier, or ask for it in a portable format. Withdrawing consent is as easy as giving it: press unsubscribe, or clear this site's cookies and answer the notice differently. Email hello@gethandl.co.uk and any request will be dealt with within one month, free of charge. You can also sign in at gethandl.co.uk/account to read your own orders and messages, download a copy of them, and ask for your account to be closed — that last one records your request and sends it to me, and I do it by hand; nothing is erased by a machine, and your orders stay for the six years HMRC requires.
No decision about you is made automatically, and there is no profiling that produces a legal or similarly significant effect. Deciding who to send a discount code to is the only thing the visit log feeds into.
If you're unhappy with how a request was handled, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes
If this policy changes, the date at the top changes with it.
If you write a review
There is a review form on this site. What you write, the name you choose to show with it, the star rating and the fitting you say you have are all published on the pack pages exactly as you sent them, once I have read it. Do not put an address, a phone number or anything else private into the review box, and please use a first name or a nickname rather than a full one — it goes on a public page.
The form also asks for your email address, and it is optional. It is used for one thing: to help me work out which order your review belongs to, so that it can show as a confirmed purchase and count towards the star rating. It is never published, never shown beside your review, never added to the marketing list and never used to email you. Leave it blank and your review is still published in full — it simply is not counted in the rating. The legal basis is legitimate interest, in making sure a published rating reflects people who really bought something, and the address is kept with the review for as long as the review is on the site.
If you came to the form from the link in one of my emails, that link carries a reference to your order, which is how the review is tied to it without your having to tell me anything. Nothing about you is copied into the review itself — it stores the order reference, and your name and address stay where they already are, with the order. Ask me and I will change your review, take it down, or remove the email address from it.
If you send a photograph with your review it is optional, and there may be up to three. The location tag your phone writes into a photo is stripped off on arrival, before anything is stored — a photo taken indoors otherwise carries the coordinates of the house. Nothing is published until I have looked at it, and I look at every one specifically for people, children, and anything with a name or an address on it. Photos are kept in private storage in Western Europe for as long as the review is on the site. Write to me at hello@gethandl.co.uk and I will delete a photograph, which deletes the file itself rather than hiding it.
Emails I send you
Order confirmations, invoices, a basket you asked me to send, and the one or two emails asking whether the PALM fitted all go out through Resend. Resend records whether each one was accepted and delivered, which is how I can tell you whether your invoice arrived. Resend does not rewrite the links in them. The button in the review email points at this website, so following it is a request to this site like any other page, and the only thing kept is a note against your order that the link was used — which is what stops the shop asking you again. None of it is joined to the visit log, used for advertising, or shared with anyone; it is held by Resend under Resend’s own retention, and the record for an email is deleted with that email. The lawful basis is legitimate interest, in knowing whether my own emails are arriving and are any use to you.
Nothing counts whether you opened an email. That is normally done with a tiny invisible image, and it is switched off here. If that ever changes, this page will say so and will say it before it happens rather than after. Every email also has a way to stop them, and it works immediately; write to hello@gethandl.co.uk and I will erase what has been recorded against your address.