Privacy Policy

Privacy Policy

Last updated: October 2026

This policy explains what personal information we collect when you use galaxy-fireworks.co.uk, shop in one of our stores or open a trade account with us, why we collect it, who we share it with, how long we keep it, and the rights you have.

1. Who we are

• Business: galaxy-fireworks.co.uk is owned and run by 1st Galaxy Group Ltd, a company registered in England and Wales, company number 03842899.
• Registered office: 213 Valley Road, Sherwood, Nottingham, NG5 3BG.
• VAT number: GB737845983.
• Email: sales@1stgalaxy.co.uk
• Phone: 0115 855 9000

1st Galaxy Group Ltd is the data controller for the personal information described in this policy. In this policy “we”, “us” and “our” mean 1st Galaxy Group Ltd.

This policy covers galaxy-fireworks.co.uk and our firework stores. Bookings for professional firework displays are covered by the privacy information on our displays website.

2. The information we collect

Information you give us

• Your name, email address, phone number and billing and delivery addresses, when you place an order, create an account, sign up to our newsletter or contact us.
• The name and address of someone else, if you ask us to deliver to them.
• Your order details, including products bought, delivery or Click & Collect choices and any notes you add at checkout.
• Confirmation that you are 18 or over, and, where we or our courier check it, the type of photo ID shown on delivery, collection or in store. We do not keep copies of ID documents.
• Trade account details, such as your business name, contact details and VAT number, if you apply for wholesale pricing.
• Messages you send us by email, phone or through our enquiry form.
• Your wishlist, if you save products to it.

Information collected automatically

• Usage data, such as your IP address, browser and device type, the pages you visit and how you found us. This is collected through cookies and similar technology, only with your consent where the law requires it. See section 8.

Payment information

• We do not collect, see or store any card, bank or other payment details, online or in store.
• Online payments are made directly with Stripe, PayPal and Revolut, on their own secure systems. In our stores, card payments go straight through our card terminal provider. In every case we receive only confirmation that payment has been made.

3. How we use your information, and our lawful basis

• To process, pack and deliver your order, arrange Click & Collect, and serve you in store. Lawful basis: performance of our contract with you.
• To check you are 18 or over, and to keep the records the law requires for selling explosives and for tax and accounting. Lawful basis: legal obligation.
• To set up and run trade accounts. Lawful basis: contract.
• To answer enquiries and handle complaints, cancellations and returns. Lawful basis: contract or legitimate interests (good customer service).
• To send you offers and news by email if you have bought from us and didn’t opt out. Lawful basis: legitimate interests, as allowed by UK electronic marketing rules.
• To send our newsletter to people who signed up without buying. Lawful basis: consent.
• To understand how our website is used, and to show you our adverts on other sites. Lawful basis: consent, given through our cookie banner.
• To keep our stores secure, prevent fraud, and establish or defend legal claims. Lawful basis: legitimate interestsand, where relevant, legal obligation.

4. Under-18s

We only sell fireworks to adults, and our website is not intended for anyone under 18. We do not knowingly collect personal information from children. If you think a child has given us their details, please email us and we will delete them.

5. Marketing

We never sell your details. You can stop marketing emails at any time by clicking “unsubscribe” in any email or emailing sales@1stgalaxy.co.uk. We’ll still email you about any order you place.

6. Who we share your information with

We only share what each party needs:

• Specialist couriers, who need your name, delivery address and phone number to deliver your fireworks and may check your age.
• Payment providers: Stripe, PayPal and Revolut online, and our card terminal provider in store. Your card and account details go straight to them and never reach us.
• Website hosting and email providers: ProWeb and Kinsta, who host our website and WooCommerce shop, and Microsoft and Zoho, who run our email.
• Analytics and advertising providers: Google (Analytics, Ads and YouTube) and Meta (Facebook and Instagram) [confirm], only if you accept these cookies.
• Our accountants and professional advisers, where needed to run the business.
• Police, Trading Standards, HMRC or other authorities, where the law requires us to.

All of these may only use your information as we allow, or as the law requires. We never sell your personal information.

7. Information sent outside the UK

Some of our providers, such as Google, Meta, Stripe, PayPal, Revolut, Kinsta, Microsoft and Zoho, may process information in the United States or elsewhere outside the UK. Where they do, the transfer is protected by an approved safeguard under UK law, such as the UK–US Data Bridge or the UK’s International Data Transfer Agreement.

8. Cookies

• Essential cookies keep the site working: your basket, login, wishlist and secure checkout. These are always on.
• Analytics cookies, such as Google Analytics, tell us how visitors use the site. Only set if you accept them.
• Advertising and video cookies, such as Google Ads, Meta Pixel and embedded YouTube videos, let us show you our adverts elsewhere and play product videos. Only set if you accept them.

You can change your choice at any time using the cookie settings on our site or by clearing cookies in your browser. Full details are on our Cookies page.

9. How long we keep your information

• Orders, invoices and delivery records: 6 years from the end of the tax year they relate to. Records needed under our explosives licences are kept for as long as those licences require.
• Customer and trade accounts: until you ask us to close your account, or after 3 years of no activity.
• Enquiries that don’t lead to an order: 2 years.
• Marketing preferences: until you unsubscribe. We then keep your email on a suppression list so we don’t contact you again.
• Analytics data: normally no more than 14 months.

10. How we keep it safe

Our website uses an encrypted (HTTPS) connection, payments are handled by secure payment providers, and only people who need your information to do their job can access it.

11. Your rights

Under UK data protection law you have the right to:

• Access a copy of the personal information we hold about you.
• Correct information that is wrong or incomplete.
• Delete your information, where we have no legal reason to keep it.
• Restrict how we use your information in some situations.
• Object to us using your information on the basis of legitimate interests, and to direct marketing at any time.
• Move information you gave us to another organisation (data portability).
• Withdraw consent at any time, where we rely on it.

To use any of these rights, email sales@1stgalaxy.co.uk. It’s free, and we will respond within one month. We may need to confirm your identity first.

12. Complaints

If you’re unhappy with how we’ve handled your information, please contact us first. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint.

13. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date at the top.

14. Contact us

1st Galaxy Group Ltd 213 Valley Road, Sherwood, Nottingham, NG5 3BG Email: sales@1stgalaxy.co.uk · Phone: 0115 855 9000 · Send an enquiry