Privacy policy

Last updated 27 August 2026.

This Privacy Policy explains what personal data Layaway Depot Pty Ltd trading as Layaway UK ("we", "us") collects when you use layawayuk.com, why we collect it, who we share it with, and the rights you have under the UK GDPR and the Data Protection Act 2018.

1. Who is responsible for your data, and how to reach us

Layaway Depot Pty Ltd trading as Layaway UK is the data controller. We are an Australian company selling to customers in the United Kingdom.

Who you are contracting with: Layaway Depot Pty Ltd trading as Layaway UK, a company incorporated in Australia.

Australian Company Number: 165 233 947

Email: contact@layawayuk.com

Our UK representative. Because we are established outside the UK, we are required to appoint a representative in the UK under Article 27 of the UK GDPR. You may contact them instead of us on any matter relating to your personal data.

We are in the process of appointing this representative. Until then, contact us directly at contact@layawayuk.com on any matter relating to your personal data.

2. What we collect

Information you give us. Your name, email address, mobile number, date of birth, delivery address, the payday you select, your typed and drawn signature, and the items you choose. We ask for date of birth to confirm you are 18 or older, and for a signature because a Layaway Purchase Agreement is a signed document.

Payment information. Your card details are entered directly into Stripe's payment form and are stored by Stripe, not by us. We never see or hold your full card number. We keep a token that lets us charge the agreed instalments, plus the card brand and last four digits so you can recognise it.

Information collected automatically. Pages you view, the items you add, your IP address, browser and device, and the advert or link that brought you here. Your IP address, browser and the time are also recorded against your signature, because that is what makes an electronic signature evidence.

3. Why we use it, and our lawful basis

• To create and administer your layaway plan — taking the instalments you agreed to, sending payment reminders and receipts, and ordering and delivering your goods. Lawful basis: performance of a contract.
• To provide your signed agreement and your contract page. Lawful basis: performance of a contract.
• To answer your questions and handle cancellations and refunds. Lawful basis: performance of a contract.
• To confirm you are 18 or over. Lawful basis: legitimate interests — selling only to adults.
• To detect and prevent fraud and payment abuse. Lawful basis: legitimate interests — protecting our business and our customers.
• To meet our legal, tax and accounting obligations. Lawful basis: legal obligation.
• To measure and improve our advertising — see section 5. Lawful basis: consent, given through our cookie banner and withdrawable at any time.
• To send you marketing, if you asked us to. Lawful basis: consent. You can stop at any time using the unsubscribe link in any marketing email, by replying STOP to a text, or by emailing us.

Where we rely on legitimate interests, you have the right to object — see section 8.

4. Who we share it with

We do not sell your personal data. We share it only with service providers who process it on our instructions, under contract, and only for these purposes:

• Stripe — payment processing and card storage.
• Shopify — our online store platform and order records.
• Supabase — the database holding your plan, payments and contract.
• Email and SMS providers — to send the messages described above.
• Google — address autocomplete when you type your delivery address.
• Meta (Facebook and Instagram) — advertising measurement; see section 5.
• Suppliers and carriers — your name, address and phone, so your order can be delivered.
• Professional advisers, and authorities where the law requires it.

5. Where your data goes, and how it is protected

We are an Australian company, so your data is transferred to and stored in Australia, and some of our providers process it in the United States and the European Economic Area.

The UK has not made an adequacy decision for Australia. We therefore rely on the ICO's International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses) as the safeguard required by Article 46 of the UK GDPR, together with a transfer risk assessment. You can ask us for a copy of the safeguards by emailing us.

6. Advertising and cookies

We advertise on Meta. If you consent, we send Meta event information — including a hashed (scrambled) version of your email address, and your browsing identifiers — so Meta can tell us which adverts work and show our adverts to people like you.

We use cookies and similar technologies. Cookies that are strictly necessary to make the site work — keeping your basket and session, remembering your progress through the signup form — are set without consent, as the Privacy and Electronic Communications Regulations permit. Analytics and advertising cookies are set only if you consent to them, and you can change or withdraw that consent at any time through the cookie settings link on the site, or by blocking cookies in your browser. Withdrawing consent does not affect your plan, your price or your agreement in any way.

7. How long we keep it

We keep your plan and payment records for as long as your agreement is active and then for six years afterwards, because tax, accounting and consumer-protection law require it. Your signed agreement is kept as a frozen record and is never edited. If your plan ends with money owing to you that we cannot return, we keep enough information to contact you and to return it. Marketing lists are cleared when you unsubscribe.

8. Your rights

Under the UK GDPR you have the right to:

• be told what personal data we hold about you and get a copy of it (a subject access request);
• have inaccurate data corrected;
• have your data erased, where we are not required to keep it (see section 7);
• restrict how we use your data, or object to us using it where we rely on legitimate interests;
• receive your data in a portable format, or have it sent to another provider;
• withdraw consent at any time, where we rely on consent; and
• object to direct marketing at any time — this one is absolute, and we will always stop.

Email contact@layawayuk.com and we will respond within one month. It is free. We will never refuse you service or change your price because you exercised a data protection right. We may need to confirm who you are before we act, so that we do not hand your data to someone else.

You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather you came to us first, but you do not have to.

9. Automated decisions

We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you. Your plan is not credit, and we do not credit-score you or share your data with credit reference agencies.

10. Security

Access to your data is restricted to people who need it, connections to our site and systems are encrypted, and card details are held by Stripe under its own security standards rather than by us. No system is perfect; if a breach affects your data we will report it to the ICO and, where the risk to you is high, tell you directly.

11. Children

Layaway UK is for adults. You must be 18 or older to start a plan, and we do not knowingly collect data from children. If you believe a child has given us their data, email us and we will delete it.

12. Changes

If we change this policy we will update the date at the top and publish the new version here. Changes are not retrospective: the Layaway Purchase Agreement you signed keeps the terms it was signed under.

13. Contact us

Questions, requests or complaints about privacy: contact@layawayuk.com. A person reads every message.