Privacy Policy

Last updated: July 2026

1. Introduction

Myth Smiths' Supplies ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our websites at mythsmiths.co.uk and dungeon-builder.mythsmiths.co.uk, and when you interact with us through our online stores or other channels.

2. Information We Collect

We may collect information about you in a variety of ways, including:

  • Personal Data: Name, email address, shipping address, and payment information when you place an order.
  • Account Data: Email address when you create an account on Dungeon Builder (dungeon-builder.mythsmiths.co.uk).
  • Usage Data: Dungeon designs, saved projects, user preferences, and interaction data within the Dungeon Builder application.
  • Derivative Data: Information automatically collected when you visit our websites, such as your IP address, browser type, operating system, and browsing behaviour.
  • Communications: Any messages you send to us directly, including via email or social media.

3. How We Use Your Information

We use the information we collect to:

  • Process and fulfil your orders.
  • Provide and maintain the Dungeon Builder service.
  • Communicate with you about your orders, products, and services.
  • Improve our websites, products, and customer experience.
  • Comply with legal obligations.

4. Legal Basis for Processing

We process your personal data on the following lawful bases:

  • Performance of a Contract – Processing your order data and account data to fulfil orders and provide the Dungeon Builder service.
  • Legitimate Interests – Improving our websites, products, and customer experience, and communicating with you about our services. We have assessed this processing to ensure it does not override your rights and interests.
  • Legal Obligation – Retaining order data for tax, accounting, and regulatory compliance.

5. Sharing Your Information

We do not sell your personal information. We may share your data with two categories of third parties:

Data Processors – Third-party providers that process personal data on our behalf under contract and in accordance with our instructions. These include payment processing, hosting, database, and email delivery providers. For a full list, please refer to our Data Usage Policy.

Independent Third Parties – External platforms and service providers that operate as independent data controllers with their own privacy policies. These include our sales channels and shipping providers. For a full list, please refer to our Data Usage Policy.

6. Data Source Disclosure

Where you place an order through one of our sales channels (such as Etsy, eBay, or TikTok Shop), we receive your personal data indirectly from that platform rather than directly from you. This may include your name, delivery address, and order details as necessary to fulfil your order.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

  • Order Data: Retained for a minimum of six years to comply with UK tax regulations.
  • Account Data: Retained until you delete your account.
  • Dungeon Designs & Usage Data: Retained until you delete them or your account.
  • Communications: Retained for two years from the date of last interaction.

For full details on our retention periods, please refer to our Data Usage Policy.

8. Cookies & Tracking

Dungeon Builder (dungeon-builder.mythsmiths.co.uk) uses JWT-based authentication cookies to manage your session and maintain your login state. These cookies are strictly necessary for the service to function and are not used for tracking or analytics purposes.

The main Myth Smiths' Supplies website (mythsmiths.co.uk) does not currently use cookies, analytics tools, or tracking pixels. Should any analytics or tracking technologies be introduced in the future, this policy will be updated accordingly and appropriate consent mechanisms will be provided.

9. International Transfers

Some of our data processors may transfer and store personal data outside the United Kingdom and the European Economic Area (EEA). Where this occurs, we ensure that appropriate safeguards are in place to protect your personal data, such as Standard Contractual Clauses (SCCs) or adequacy decisions as recognised under UK GDPR.

10. Data Security

We have implemented appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used, altered, disclosed, or accessed in an unauthorised way. These measures include:

  • Encryption of personal data in transit and at rest where appropriate.
  • Access controls to limit access to personal data to those who have a business need to know.
  • Regular testing, assessment, and evaluation of the effectiveness of our security measures.
  • Procedures for dealing with any suspected personal data breach.

While we take all reasonable precautions, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your personal data. If we become aware of a personal data breach, we will notify you and the ICO where we are legally required to do so, in accordance with Articles 33 and 34 of the UK GDPR.

11. Your Rights

Under UK data protection law, you have the following rights in relation to your personal data:

  • Right of Access – You have the right to request a copy of the personal data we hold about you.
  • Right to Rectification – You have the right to request correction of any inaccurate or incomplete personal data.
  • Right to Erasure – You have the right to request deletion of your personal data, where there is no compelling reason for its continued processing.
  • Right to Restriction of Processing – You have the right to request that we limit how we use your personal data.
  • Right to Object to Processing – You have the right to object to the processing of your personal data where we rely on legitimate interests as our lawful basis.
  • Right to Data Portability – You have the right to request that we transfer the personal data you provided to us to another organisation, or to you, in a structured, commonly used, and machine-readable format.

If you make a request, we will respond to you without undue delay and in any event within one month. To exercise any of these rights, please contact us at info@mythsmiths.co.uk.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you are dissatisfied with how we handle your personal data. For more information, visit ico.org.uk.

12. Dungeon Builder Audience

Dungeon Builder (dungeon-builder.mythsmiths.co.uk) is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at info@mythsmiths.co.uk and we will take steps to remove such information.

13. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on our users.

14. Contact Us

If you have any questions about this Privacy Policy, please contact us at info@mythsmiths.co.uk.

Myth Smiths' Supplies
London North Studios, Hub B.32
The Ridgeway, London
England, NW7 1RP