top of page

Privacy Policy

The Toadstool Post — operated by Oakwell & Ink Ltd Last updated: May 2026

1. Who We Are

The Toadstool Post is a monthly snail mail subscription for children aged 3 to 8, operated by Oakwell & Ink Ltd. We are registered in England and Wales.

​

If you have any questions about this policy or how we handle your data, please contact us at hello@thetoadstoolpost.co.uk

2. Our Commitment to Children's Privacy

We take the privacy of children extremely seriously. The Toadstool Post is a product for children but our contractual relationship is always with the parent or guardian — not the child. We collect the minimum amount of information necessary to deliver our service and we never use children's personal data for commercial profiling, targeted advertising, or any purpose other than delivering your subscription.

We comply fully with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the ICO's Children's Code (Age Appropriate Design Code).

3. What Information We Collect

From parents and guardians:

​

  • Your name

  • Your email address

  • Your delivery address

  • Payment information (processed securely by our payment provider — we do not store card details)

  • ​

 

About your child:

​

  • Your child's first name (used solely to personalise their delivery envelope and story letter)

  • Your child's age range (used to ensure content is appropriate)

  • ​

Automatically collected:

​

  • Basic website analytics including pages visited and time on site (via Wix analytics)

  • Your IP address and device type for security purposes

4. How We Use Your Information

We use the information you provide to:

​

  • Process and fulfil your monthly subscription

  • Address deliveries directly to your child by name

  • Send you order confirmations, shipping notifications, and subscription updates

  • Respond to your enquiries and provide customer support

  • Send you occasional email updates about The Toadstool Post — you can unsubscribe at any time

  • Improve our product and service based on feedback

  • ​

We do not use your child's name or age for any marketing or profiling purposes whatsoever.

5. Our Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

​

Contract — processing your name, address, and payment information is necessary to fulfil your subscription.

​

Legitimate interests — sending service-related communications such as order confirmations and shipping updates.

​

Consent — sending marketing emails. You can withdraw this consent at any time by clicking unsubscribe in any email or contacting us directly.

6. Children's Data — Additional Protections

In accordance with the ICO's Children's Code we apply the following protections to your child's personal information:

​

  • We collect only your child's first name and age range — nothing more

  • We do not use your child's data for any commercial purpose beyond personalising their delivery

  • We do not share your child's data with any third party for marketing purposes

  • We do not build profiles of children based on their data

  • We apply data minimisation — if we do not need it, we do not collect it

  • Children's data is stored securely and separately from general marketing data

7. Who We Share Your Data With

We share your data only where necessary to deliver our service:

​

Payment processors — your payment is processed securely by our payment provider. We do not store your card details.

​

Email marketing platform — we use Wix to manage our email list and send communications. Your email address is stored in Wix. You can request deletion at any time.

​

Delivery services — your name and address are used by Royal Mail or our chosen delivery partner to deliver your subscription.

​

Website platform — our website is hosted on Wix which processes basic visitor data in accordance with their privacy policy.

​

We do not sell your data. We do not share your data with advertisers. We do not share your child's data with any third party beyond what is necessary to print their name on an envelope and deliver it.

8. How Long We Keep Your Data

We retain your personal data for as long as your subscription is active and for a reasonable period afterwards in case of queries or disputes. Specifically:

​

  • Active subscriber data is retained for the duration of your subscription plus 12 months

  • Email marketing data is retained until you unsubscribe or request deletion

  • Payment records are retained for 7 years in accordance with HMRC requirements

  • Your child's name and age range are deleted within 30 days of your subscription ending

​

You can request deletion of your data at any time by contacting hello@thetoadstoolpost.co.uk

9. Your Rights

Under UK GDPR you have the following rights:

​

Right of access — you can request a copy of the personal data we hold about you and your child.

Right to rectification — you can ask us to correct any inaccurate data.

Right to erasure — you can ask us to delete your data. We will action this promptly unless we are legally required to retain certain records.

Right to restrict processing — you can ask us to limit how we use your data in certain circumstances.

Right to data portability — you can ask us to provide your data in a portable format.

Right to object — you can object to our processing of your data for marketing purposes at any time.

Right to withdraw consent — where processing is based on consent you can withdraw it at any time without affecting the lawfulness of prior processing.

​

To exercise any of these rights please contact us at hello@thetoadstoolpost.co.uk. We will respond within 30 days.

If you are unhappy with how we have handled your data you have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.

10. Cookies

Our website uses cookies to provide basic functionality and analytics. We use a cookie consent banner to obtain your permission before placing non-essential cookies. You can manage your cookie preferences at any time through your browser settings.

11. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Our website uses SSL encryption. Payment processing is handled by PCI-compliant providers. Access to subscriber data is restricted to members of our team who need it to fulfil orders and respond to customer queries.

12. International Transfers

Some of our service providers — including Wix — may process data outside the UK. Where this occurs we ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

13. Changes to This Policy

We may update this privacy policy from time to time. We will notify active subscribers of any significant changes by email. The current version will always be available at thetoadstoolpost.co.uk/privacy-policy. The date at the top of this page indicates when it was last updated.

14. Contact Us

For any questions, requests, or concerns about your privacy or the privacy of your child's data please contact:

Oakwell & Ink Ltd hello@thetoadstoolpost.co.uk thetoadstoolpost.com

We aim to respond to all privacy-related enquiries within 5 working days.

bottom of page