Last updated: 19/09/2026

Pongo Handmade ("we", "us", "our") is committed to protecting your privacy. This policy explains what personal information we collect, why, and how we handle it, in line with UK GDPR and the Data Protection Act 2018.

Who we are

Pongo Handmade is a sole trader business based in Basingstoke, Hampshire, UK. For any questions about this policy or your data, contact us at soapspongo@gmail.com.

What information we collect

• Contact details: name, email address, phone number, postal address — when you place an order, book a workshop, or contact us.

• Order information: products purchased, payment confirmation (we do not store your card details — these are processed securely by our payment provider).

• Booking information: workshop date, number of participants.

• Health and allergy information: when you book a workshop, we ask about allergies, skin sensitivities, or medical conditions (including pregnancy) relevant to handling lye, fragrance oils, or essential oils safely. This is special category data under UK GDPR.

• Marketing preferences: if you opt in to our mailing list or newsletter.

• Website usage data: via cookies (see our separate Cookie Policy).

Why we collect it, and our legal basis

• Processing orders and payments — legal basis: contract

• Managing workshop bookings — legal basis: contract

• Ensuring participant safety during workshops (allergy/health info) — legal basis: explicit consent

• Sending marketing emails (if opted in) — legal basis: consent

• Legal and accounting records — legal basis: legal obligation

We only use this information to keep you safe during a workshop — for example, ensuring appropriate precautions are taken if you disclose a fragrance allergy or pregnancy. It is:

• Only accessible to the person(s) running your session

• Never used for marketing or shared with third parties

• Retained only for as long as needed to plan and run your session, and then deleted (see Retention below)

• Collected with your explicit consent via the booking form checkbox

You may withdraw consent or ask us to delete this information at any time by contacting us, though we may need to decline your booking if we can't ensure your safety without it.

Who we share information with

• Payment providers (e.g. Wix Payments, PayPal, Stripe) — to process payments securely.

• Wix — our website and booking platform host.

• Email/marketing tools — if you've opted in to receive updates.

We do not sell your data to third parties.

Retention

• Order and booking records: kept for 6 years for accounting and legal purposes.

• Health/allergy information: deleted within 4 weeks of your workshop date, unless you book again.

• Marketing data: kept until you unsubscribe.

Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you

• Request correction or deletion of your data

• Withdraw consent at any time

• Object to how we process your data

• Lodge a complaint with the Information Commissioner's Office (ICO) if you believe we've mishandled your data

To exercise any of these rights, contact us at soapspongo@gmail.com.

Changes to this policy

We may update this policy from time to time. The current version will always be available on this page.