Privacy policy

Privacy Policy

Last updated: 16 July 2026

1. Who We Are

EverSealed is a trading name of Slim and Smart Ltd, a company registered in England and Wales.

Company name: Slim and Smart Ltd
Company number: 10291692
VAT registration number: GB 250 2982 14
Registered office: 156c High Road, Beeston, United Kingdom, NG9 2LN
Correspondence address: 16 Commerce Square, Lace Market, Nottingham, NG1 1HS, United Kingdom
Email: support@eversealed.co.uk

Slim and Smart Ltd, trading as EverSealed, is the data controller responsible for deciding how and why personal information is used in connection with the EverSealed website, store, customer accounts, products, subscriptions, letter preservation services, future delivery services, and related communications.

Our online store is powered by Shopify, which provides the e-commerce infrastructure used to operate the website, checkout, customer accounts, and related store functions.

2. Scope of This Privacy Policy

This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you:

visit or use our website
create or use a customer account;
purchase a product or preservation service;
enter into or manage a subscription;
send a sealed letter or other approved item to EverSealed;
request a return, replacement, address update, cancellation, or release;
act as a recipient, verification contact, or authorised representative;
Contact us by email, through the website, or through customer support.

This Privacy Policy applies to personal information held electronically and to administrative records connected with physical items stored by EverSealed.

3. Important Information About Sealed Letters

EverSealed stores physical, sealed letters. We do not routinely open, read, scan, photograph, copy, or otherwise review the contents of sealed letters.

The contents of a sealed letter remain private and are not used for marketing, profiling, analytics, or advertising.

We handle the outside of the sealed recipient envelope only as reasonably necessary to:

identify the correct EverSealed Reference Number;
register the physical item;
store it securely;
process an authorised return, replacement, or release;
dispatch it to the authorised recipient at the appropriate time.

We will only access or disclose sealed contents where such action is required by law, a valid court order, or an immediate and overriding safety obligation.

4. Personal Information We Collect

Depending on how you interact with EverSealed, we may collect and process the following categories of personal information.

Customer and account information

full name;
email address;
telephone number;
customer account details;
billing address;
shipping address;
communication preferences;
account authentication and security information.

Order, payment, and subscription information

products and services purchased;
order number and EverSealed Reference Number;
order date and transaction history;
selected preservation period or future delivery date;
subscription status, renewal history, cancellation, and payment status;
refunds, returns, replacement requests, and applicable fees;
payment confirmation and limited payment-related information.

Shopify and the relevant payment provider generally process complete payment card details. EverSealed does not require customers to send full payment card details by email.

Preservation and service records

reference numbers assigned to stored items;
date a letter or item was received;
storage start date and current storage status;
scheduled delivery or dispatch date;
return, replacement, cancellation, and release requests;
authorised changes and address history;
delivery confirmations and tracking information;
administrative notes necessary to manage the service;
audit records showing when and by whom a change was authorised.

Recipient information

recipient's full name;
Future Delivery Address;
email address and telephone number, where provided;
delivery instructions;
relationship to the customer, where relevant;
updates to recipient or delivery details.

The Future Delivery Address is stored separately from the customer's billing, shipping, or residential address.

Verification contact information

full name;
email address;
telephone number;
relationship to the customer;
verification status;
communications relating to a release condition;
confirmation or supporting documentation provided during verification.

The customer may provide verification contact details rather than the verification contact directly.

Communications

customer support emails and messages;
questions, complaints, and feedback;
instructions connected with an order or stored item;
records of any authorised address changes or service requests.

Website, device, and usage information

IP address;
browser and device type;
device identifiers;
cookie and consent preferences;
website activity and interaction information;
security, fraud-prevention, and diagnostic information.

5. Information About Other People

A customer may provide personal information about another person, including a recipient, a child recipient, a verification contact, a family member, or an authorised representative.

Customers should only provide information that is reasonably necessary for the EverSealed service and should ensure they are permitted to do so. They should not provide unnecessary, excessive, or highly sensitive information.

Where required by law, EverSealed will provide recipients, verification contacts, or other individuals with relevant privacy information within the applicable period or when we first contact them, unless a lawful exemption applies.

6. Sources of Personal Information

We may obtain personal information:

directly from you when you create an account, purchase, subscribe, complete a form, update your details, or contact us;
from a customer who nominates you as a recipient, verification contact, or authorised representative;
from verification contacts, recipients, representatives, or other people who communicate with us;
automatically through cookies, website technologies, security tools, and your use of the Services;
from Shopify, payment providers, subscription applications, delivery companies, customer-support providers, and other service providers;
from official, legal, government, court, probate, medical, hospital, funeral-director, or similar sources where verification is reasonably required.

7. How We Use Personal Information

We use personal information for the following purposes:

to create and manage customer accounts;
to process purchases, payments, subscriptions, renewals, and refunds;
to provide products, kits, prepaid labels, and return instructions;
to register, identify, securely store, and manage sealed items;
to assign and maintain EverSealed Reference Numbers;
to calculate and record preservation and dispatch dates;
to manage recipient information and Future Delivery Addresses;
to record authorised updates and maintain an address history;
to arrange secure return, replacement, release, and delivery;
to manage Legacy Preservation verification contacts and release conditions;
to verify that a release condition has been satisfied;
to prevent unauthorised, mistaken, or fraudulent release;
to send operational emails, reminders, confirmations, and service updates;
to respond to questions, complaints, and customer-support requests;
to protect our website, customers, stored items, and business systems;
to detect and prevent fraud, abuse, unauthorised access, and security incidents;
to maintain accounting, tax, legal, and business records;
to establish, exercise, or defend legal claims;
to comply with legal and regulatory requirements;
to improve the reliability and operation of the Services;
to send marketing communications where legally permitted.

8. Legal Bases for Processing

Where the UK GDPR applies, we rely on one or more of the following legal bases.

Performance of a contract

Processing is necessary to enter into or perform our contract with you, including processing an order, managing a subscription, storing a sealed item, arranging future delivery, and handling an authorised return or replacement.

Legitimate interests

We may process personal information where necessary for our legitimate interests or those of another person, provided those interests are not overridden by the individual's rights and freedoms.

Our legitimate interests may include:

operating and improving EverSealed responsibly;
protecting customers, recipients, verification contacts, and stored items;
maintaining accurate reference, address, and audit records;
preventing unauthorised or fraudulent release;
protecting website and account security;
responding to enquiries and resolving disputes;
maintaining appropriate business and service records.

Legal obligation

We process information where necessary to comply with tax, accounting, consumer-protection, data-protection, court, regulatory, or other legal obligations.

Consent

We rely on consent where required, including certain marketing communications and non-essential cookies. Consent may be withdrawn at any time without affecting processing that occurred lawfully before withdrawal.

Vital interests

In exceptional circumstances, we may process or disclose limited information where necessary to protect someone's life or physical safety.

9. When Information Is Required

Certain information is required to process an order or provide a preservation service, including customer contact details, selected service details, payment confirmation, recipient information, and a delivery address.

If required information is missing or inaccurate, we may be unable to:

accept or complete an order;
register or identify a stored item;
manage a subscription;
verify a release condition;
return, replace, release, or deliver a letter;
provide customer support in relation to the service.

10. Death Verification and Supporting Documentation

Legacy Preservation items will not be released solely on the basis of an unverified request. We may request reasonable evidence before we authorise the release of the items.

Evidence may include:

a death certificate;
probate or Letters of Administration;
a funeral director's confirmation;
official government or court documentation;
hospital or medical confirmation where reasonably necessary;
confirmation from nominated verification contacts;
other reliable evidence that is appropriate to the circumstances.

We may request additional evidence where it is reasonably necessary to prevent fraud, mistaken identity, or unauthorised release.

Where possible, we record the verification result rather than retaining complete copies of supporting documents for longer than necessary.

11. Special Category and Sensitive Information

We do not ask customers to provide detailed health, medical, religious, political, biometric, sexual, or other special category information through ordinary store, account, or product forms.

Some verification documents may incidentally contain health information or other sensitive personal information relating to a living individual. Please redact information that is not necessary for the verification request before sending a document to us.

If it becomes necessary for EverSealed to process special-category personal information relating to a living individual, we will:

limit the information to what is reasonably necessary;
identify an appropriate UK GDPR Article 6 legal basis;
identify and document an applicable Article 9 condition;
apply additional access and security controls;
retain the information only for as long as necessary;
not use the information for advertising or general marketing.

12. How We Share Personal Information

We do not sell personal information.

We may share personal information with the following categories of recipients where reasonably necessary:

Shopify, which hosts and powers our e-commerce store, checkout, customer accounts, and related store services;
payment and subscription providers that process payments, renewals, payment status, and subscription management;
delivery, postal, fulfilment, and courier providers that supply labels, tracking, collection, returns, and delivery;
IT, hosting, security, analytics, communication, and support providers that help us operate and protect the Services;
professional advisers, including accountants, insurers, lawyers, auditors, and compliance advisers;
verification contacts and authorised parties where necessary to verify or complete a release;
recipients where necessary to arrange or complete delivery;
courts, regulators, law-enforcement bodies, and public authorities where disclosure is legally required or reasonably necessary to protect rights, safety, property, or stored items;
prospective purchasers or successor organisations in connection with a genuine merger, acquisition, restructuring, financing, or business transfer, subject to appropriate confidentiality and data-protection safeguards.

Service providers are permitted to use personal information only for authorised purposes and are required to protect it in accordance with applicable law and their contractual obligations.

13. International Data Transfers

Some technology and service providers, including Shopify and connected providers, may process information outside the United Kingdom.

Where a transfer is subject to UK international transfer restrictions, we use an appropriate legal mechanism where required, such as:

UK adequacy regulations;
the UK International Data Transfer Agreement;
the UK Addendum to approved standard contractual clauses;
another safeguard recognised under UK data-protection law.

Where required, we also assess whether additional contractual, technical, or organisational protections are necessary.

14. Cookies and Similar Technologies

We use cookies and similar technologies to:

operate the website and checkout;
keep customer accounts secure;
remember choices and preferences;
prevent fraud and maintain security;
understand website performance and usage;
support analytics, personalisation, or advertising where permitted.

Strictly necessary cookies may be used without consent where permitted by law because they are required to provide a service requested by the user or to operate essential website functions.

Where required, non-essential analytics, advertising, or personalisation cookies are not used until you provide consent. You can accept, reject, or change non-essential cookie preferences through our cookie banner or privacy preferences tool.

Further details may be provided in a separate Cookie Policy or cookie preferences panel.

15. Marketing Communications

We may send marketing emails or messages where:

you have provided valid consent; or
Another legal permission applies, such as the limited existing-customer exception, and we offer you a clear opportunity to opt out.

You can unsubscribe at any time by using the unsubscribe link in a marketing message or by contacting support@eversealed.co.uk.

Unsubscribing from marketing does not stop essential order, subscription, security, storage, verification, address confirmation, or delivery messages.

16. Automated Decision-Making

EverSealed does not intentionally use personal information to make decisions based solely on automated processing that produces legal or similarly significant effects.

Shopify, payment providers, or fraud-prevention providers may use automated tools to assess transactions or security risks in accordance with their policies. Where appropriate, we may manually review suspicious or declined transactions.

17. Data Security

We use reasonable and proportionate technical and organisational measures designed to protect personal information against:

unauthorised access;
accidental loss;
unlawful disclosure;
alteration or destruction;
fraudulent or mistaken release;
inappropriate use.

Measures may include:

restricted access based on business need;
account authentication and access controls;
audit records for important changes;
secure storage and controlled handling procedures;
secure technology and reputable service providers;
staff confidentiality and data-protection procedures;
identity and reference checks before sensitive actions.

No internet transmission, electronic system, or storage method can be guaranteed to be completely secure. Please do not send full payment card details, passwords, or unnecessary sensitive information by email.

18. Data Retention

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including service delivery, security, legal compliance, dispute resolution, and enforcement of agreements.

Active preservation services

Customer, recipient, reference, address, subscription, storage, and service records are kept for the duration of the active preservation service and until the stored item has been delivered, returned, replaced, released, or otherwise lawfully resolved.

Address history and audit records

Authorised address changes and related audit records may be retained for the duration of the service and for up to 24 months afterwards where necessary to protect customers, resolve disputes, document instructions, or prevent fraud.

Closed or cancelled services

Operational, security, support, return, replacement, and cancellation records may normally be retained for up to 24 months after the service ends, unless a longer period is necessary for legal claims, fraud prevention, or another lawful purpose.

Verification records

Verification information is retained only for as long as reasonably necessary to assess, document, and defend the release decision. Where practicable, complete supporting documents are deleted once they are no longer required, and a limited record of the verification decision is retained.

Failed delivery or release attempts

Where a stored item cannot be released or delivered and no authorised person can be reached, relevant contact and service records may be retained for up to 24 months after the last meaningful contact or delivery attempt.

Order, tax, and accounting records

Order, invoice, payment, refund, VAT, tax, and accounting records may be retained for at least six years from the end of the relevant financial year, or for longer where required by law, a tax enquiry, litigation, or an ongoing transaction.

Marketing records

Marketing preferences are retained until consent is withdrawn, an objection is received, or the information is no longer reasonably necessary. We may retain a minimal suppression record to ensure that an opt-out continues to be respected.

Stored physical items

Stored physical letters and approved items are retained in accordance with the purchased service, our Terms of Service, and the customer's authorised instructions.

If reasonable delivery, release, and contact attempts fail, an unresolved physical item may eventually be returned or securely and confidentially destroyed in accordance with the applicable service terms and documented procedures.

When personal information is no longer required, it is securely deleted, destroyed, or anonymised where appropriate.

19. Your Data-Protection Rights

Depending on the circumstances and applicable law, you may have the right to:

request access to your personal information;
request correction of inaccurate or incomplete information;
request deletion of personal information in certain circumstances;
request restriction of processing in certain circumstances;
object to processing based on legitimate interests;
object to direct marketing at any time;
request data portability where applicable;
withdraw consent where processing is based on consent;
request information about applicable international transfer safeguards;
complain about how your information has been handled.

These rights are not absolute. For example, we may need to retain information to comply with law, maintain accounting records, establish or defend legal claims, protect another individual, or complete an active contractual service.

To exercise a right, email support@eversealed.co.uk. Please state that your request relates to data protection and provide enough information for us to identify the relevant records.

We may request reasonable evidence of identity or authority before disclosing, changing, deleting, or transferring personal information.

We will respond within the period required by applicable data-protection law. Requests are normally handled without charge, although a reasonable fee may be permitted where a request is manifestly unfounded, excessive, or repetitive.

20. Children's Information

EverSealed products and services are for adults to purchase and manage. We do not knowingly allow children to create customer accounts, purchase services, or enter into subscriptions directly.

An adult customer may provide limited information about a child who is the intended future recipient of a letter. We collect only the information reasonably necessary to identify the recipient and complete the future delivery.

Customers should not provide unnecessary or sensitive information about a child through product forms, account fields, or unsecured communications.

If you believe a child has submitted personal information directly without appropriate authority, please contact us.

21. Data-Protection Complaints

If you have a concern about how EverSealed has collected or used personal information, please contact us first so we can investigate and resolve it.

Email: support@eversealed.co.uk

You also have the right to complain to the Information Commissioner's Office, the United Kingdom's data-protection supervisory authority.

Information Commissioner's Office
Telephone: 0303 123 1113
Website: ico.org.uk

22. Third-Party Websites and Services

The Services may contain links to third-party websites, applications, payment services, delivery services, or social-media platforms.

EverSealed is not responsible for the privacy practices of independent third parties. You should review their privacy information before submitting personal information directly to them.

23. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in law, technology, service providers, products, business operations, or the way we process personal information.

The updated version will be published on this page with a revised “Last updated” date. Where a change is material, we may also provide additional notice by email, through My Account, or through a prominent website notice.

24. Contact Us

For privacy questions, complaints, or requests relating to your personal information, contact:

Slim and Smart Ltd trading as EverSealed
16 Commerce Square
Lace Market
Nottingham
NG1 1HS
United Kingdom

Email: support@eversealed.co.uk

Registered office:
156c High Road
Beeston
United Kingdom
NG9 2LN