Privacy policy
Privacy Policy
1. WHO WE ARE AND HOW TO CONTACT US
Thank you for visiting our website. This Privacy Policy explains how we collect and use your personal data when you use our website and buy from us. Personal data is any information that can be used to identify you.
The controller responsible for processing your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 is Hazel & Maud Harrogate. You can contact us about anything in this policy at info@hazelmaudharrogate.uk.
Our website uses SSL/TLS encryption to protect personal data and other confidential information you send us, such as orders and enquiries. You can recognise an encrypted connection by "https://" and the padlock symbol in your browser's address bar.
2. DATA COLLECTED WHEN YOU VISIT OUR WEBSITE
When you simply browse our website without registering or otherwise sending us information, we only collect the data your browser automatically sends to our server ("server log files"). This includes:
- The page you visited
- The date and time of access
- The amount of data sent in bytes
- The website that referred you to us
- The browser you use
- Your operating system
- Your IP address (where possible in anonymised form)
We process this data on the basis of our legitimate interest in keeping our website stable and working properly (Article 6(1)(f) UK GDPR). We do not share or use this data for any other purpose, but we may review log files if there are specific indications of unlawful use.
3. COOKIES
We use cookies to make our website work and to make your visit more convenient. Cookies are small text files stored on your device. Some are deleted when you close your browser (session cookies); others stay on your device for a set period and allow us or our partners to recognise your browser on your next visit (persistent cookies).
Strictly necessary cookies, such as those that remember the contents of your shopping cart, are used to perform our contract with you (Article 6(1)(b) UK GDPR) and our legitimate interest in a working website (Article 6(1)(f) UK GDPR). Analytics and marketing cookies are only placed with your consent (Article 6(1)(a) UK GDPR), which you can give or withdraw at any time through our cookie banner.
You can also set your browser to notify you when cookies are set, to accept them only in certain cases, or to block them completely. How to do this is explained in your browser's help section:
- Chrome: https://support.google.com/chrome/answer/95647
- Firefox: https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop
- Safari: https://support.apple.com/guide/safari/manage-cookies-sfri11471/mac
- Edge: https://support.microsoft.com/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09
If you block cookies, some features of our website may not work properly.
4. CONTACTING US
When you contact us by email or through our contact form, we collect the personal data you provide (such as your name, email address and message). We use this data only to respond to your enquiry. Our legal basis is our legitimate interest in answering your question (Article 6(1)(f) UK GDPR) and, if your enquiry relates to an order or a purchase, the performance of a contract (Article 6(1)(b) UK GDPR). We delete this data once your enquiry has been fully dealt with, unless we are legally required to keep it.
5. CUSTOMER ACCOUNTS AND ORDERS
When you place an order or create a customer account, we collect the data needed to process your order, such as your name, delivery and billing address, email address, phone number and order details. We process this data to perform our contract with you (Article 6(1)(b) UK GDPR).
You can delete your customer account at any time by emailing us. Once your order has been completed or your account has been deleted, we keep your data only for as long as required by tax and accounting law, after which it is deleted, unless you have agreed to further use.
Our online store is hosted by Shopify, which processes your data on our behalf to run the store, take payments and fulfil orders. More information: https://www.shopify.com/legal/privacy
6. EMAIL MARKETING
Newsletter. If you sign up for our newsletter, we will send you regular emails about our products and offers. Only your email address is required; any other details are optional and used to personalise our emails. We process this data on the basis of your consent (Article 6(1)(a) UK GDPR). When you sign up, we store your IP address and the date and time of sign-up so we can prove your consent if needed.
Existing customers. If you have given us your email address when buying from us, we may send you emails about similar products, unless you opted out when you gave us your address. This is based on our legitimate interest in direct marketing (Article 6(1)(f) UK GDPR) and is permitted under the Privacy and Electronic Communications Regulations (PECR).
You can unsubscribe at any time via the link in every email or by emailing us. Your email address will then be removed from our mailing list straight away.
7. SHARING DATA TO PROCESS YOUR ORDER
To deliver your order, we share your name, address and contact details with our suppliers and the delivery companies that ship your parcel. To process your payment, we share your payment details with our payment provider. Our legal basis is the performance of our contract with you (Article 6(1)(b) UK GDPR).
Payment providers we use:
- Card payments are processed securely through Shopify Payments and its payment partners. We never see or store your full card details.
8. REVIEW REMINDERS
If you have given your consent during or after your order, we will use your email address to send you a single reminder to review your purchase (Article 6(1)(a) UK GDPR). You can withdraw your consent at any time by emailing us.
9. SOCIAL MEDIA LINKS
Our website contains links to our social media pages, such as Facebook and Instagram (operated by Meta Platforms Ireland Ltd.). These are simple links, not plugins: no data is sent to these platforms when you visit our website. Only when you click a link will you be taken to the platform, where its own privacy policy applies: https://www.facebook.com/privacy/policy
10. ANALYTICS AND ADVERTISING
The tools below are only used if you have given your consent through our cookie banner (Article 6(1)(a) UK GDPR). You can withdraw your consent at any time.
Meta Pixel. We use the Meta Pixel from Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. It allows us to measure the effectiveness of our Facebook and Instagram ads and to show relevant ads to people who have visited our website. Meta may link this data to your Meta account and use it for its own advertising purposes. More information: https://www.facebook.com/privacy/policy
Google Analytics and Google Ads. We may use Google Analytics and Google Ads from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand how visitors use our website and to measure and improve our advertising. Google uses cookies for this and may process your IP address. More information: https://policies.google.com/privacy. You can opt out of personalised ads at https://adssettings.google.com and install the Google Analytics opt-out add-on at https://tools.google.com/dlpage/gaoptout
You can also manage interest-based advertising from many companies at https://www.youronlinechoices.com/uk/
11. INTERNATIONAL TRANSFERS
Some of our service providers (such as Shopify, Meta and Google) and our suppliers may process your data outside the United Kingdom, including in the United States and Asia. Where this happens, we make sure appropriate safeguards are in place, such as UK adequacy regulations (including the UK-US Data Bridge) or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.
12. YOUR RIGHTS
Under UK data protection law you have the following rights:
- Right of access: to ask for a copy of the personal data we hold about you and information about how we use it.
- Right to rectification: to have inaccurate data corrected or incomplete data completed.
- Right to erasure: to have your data deleted, unless we need to keep it, for example to meet a legal obligation or to establish or defend legal claims.
- Right to restrict processing: to ask us to limit how we use your data in certain circumstances.
- Right to data portability: to receive the data you have given us in a structured, commonly used, machine-readable format, or to have it sent to another controller.
- Right to withdraw consent: to withdraw any consent you have given at any time, without affecting processing carried out before you withdrew it.
- Right to complain: to lodge a complaint with the Information Commissioner's Office (ICO), https://ico.org.uk, telephone 0303 123 1113. We would appreciate the chance to deal with your concerns first, so please contact us before going to the ICO.
To exercise any of these rights, email us at info@hazelmaudharrogate.uk. We will respond within one month.
13. RIGHT TO OBJECT
Where we process your personal data on the basis of our legitimate interests, you have the right to object at any time on grounds relating to your particular situation. If you do, we will stop processing that data unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.
Where we process your personal data for direct marketing, you can object at any time and we will stop using your data for that purpose.
14. HOW LONG WE KEEP YOUR DATA
We keep personal data only for as long as needed for the purposes described above, or as long as required by law (for example, tax and accounting record-keeping periods). After that, the data is routinely deleted.
15. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. The latest version will always be available on this page.