Privacy policy

Last Updated: 1 JULY 2026 

This Privacy Notice explains how Last Brand Trading Co Ltd ("Company", "we", "us", "our") collects, uses, shares, and protects your personal data when you use our website, mobile apps, and related services (together, the "Services").

Last Brand, Inc. is our US parent company and may process personal data as described in this Privacy Notice to support the Services and our group operations. For individuals in the United Kingdom ("UK"), the European Economic Area ("EEA"), or Switzerland, references to "personal information" and "Collected Information" in this Privacy Notice include "personal data" as defined under applicable data protection law. Last Brand Trading Co Ltd is the controller of that personal data unless another notice states otherwise.

Please read this Privacy Notice carefully. It does not create any contractual obligation between you and us. Reading or using our Services does not constitute consent to any processing that requires your consent under applicable law. Where we rely on your consent as a lawful basis for processing, we will ask for it separately through a clear and specific mechanism, and you may withdraw it at any time as described in this Privacy Notice.

This Privacy Notice should be read alongside our Terms of Service and any other agreement governing your use of the Services. Where there is any conflict between this Privacy Notice and those terms in relation to the processing of personal data, this Privacy Notice will prevail.

Changes to this Privacy Notice

We reserve the right to modify this Privacy Notice at any time. The date at the top of this page shows when it was last updated. Where we make material changes that affect how we process your personal data, we will notify you in advance - by email or by a prominent notice on the Site - before those changes take effect. Where we rely on your consent for any processing and that processing changes in a material way, we will seek your fresh consent before the changes take effect.

We encourage you to review this Privacy Notice periodically to stay informed about how we handle your personal data.

Your information and countries outside the UK / EEA

We are a global business. Personal data we collect may be transferred to, stored in, or processed in countries outside the UK and EEA, including the United States, where our parent company Last Brand, Inc. is based. Some of these countries may not provide the same level of data protection as the UK.

Where we transfer personal data outside the UK to a country that has not received an adequacy decision from the UK Secretary of State, we use one or more of the following safeguards:

•       UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses

•       Adequacy regulations or decisions, where applicable

•       Approved certification mechanisms

•       Another lawful transfer mechanism recognised under UK data protection law

We also assess transfer risks and implement supplementary measures where appropriate, including encryption, access controls, data minimisation, role-based permissions, vendor due diligence, and contractual restrictions.

Information We Collect and How We Use and Disclose It

We will collect personal data that you provide to us, personal data collected through your use of the Services, and personal data that we receive from third-party sources where we have a lawful basis to do so. We do not seek to collect more personal data than is reasonably necessary for the purposes described in this Privacy Notice. 

You do not have to provide all of this personal data to us. However, if you choose not to, you may not be able to make purchases from the Site or receive the full customer experience.

Purposes 

In addition to the uses and sharing described above, Company and its suppliers may process Collected Information as described below. We do not use, sell, rent, or otherwise disclose Collected Information except as stated in this Privacy Notice, as required or permitted by applicable law,or where you have given any consent (if required).

Services and Purpose Collected

• Communication with You.  We process personal data to provide, administer and secure the Services; process purchases, returns, exchanges and account activity; provide customer support; respond to requests; manage user accounts; deliver transactional and service communications; and administer our business. Our lawful bases are performance of a contract with you, our legitimate interests in operating and securing the Services, compliance with legal obligations, and consent where required (for example to send you marketing emails - you may at any time opt- out from receiving these types of communications). 

• Personalisation; Advertising; Analytics. To tailor the content and information that we may send or display to you, to suggest personalised help and instructions, and to otherwise personalise your experience while visiting or using our Services. We  may collect your information and share it with our third party service providers to understand how our Services are used and to improve the Services (as described further in the “Analytics” section of the Privacy Notice below). Where we process personal data for limited service personalisation that does not require consent, our lawful basis is our legitimate interests in improving and tailoring the Services, subject to your right to object.

• Promotional Communications. We will only send you promotional communications about our products and services by email, SMS, push notification, or phone where you have given us your prior, specific, opt-in consent to do so. You may withdraw your consent and opt out of receiving promotional communications at any time by:

  • Clicking the unsubscribe link in any marketing email we send you

  • Replying STOP to any marketing SMS

  • Updating your preferences in your account settings

  • Contacting us using the details under "Contact Us"

Opting out of promotional communications will not affect transactional or service communications relating to your account or orders. Where we tailor marketing content to your preferences - using information such as your purchase history, interactions with the Services, and inferred interests - we will only do so where you have consented to receive marketing and, where profiling for marketing purposes involves non-essential tracking technologies, where you have also given your consent to those technologies through our Cookie Management Centre.

• Disclosing Collected Information. To Our Third-Party Suppliers and Service Providers: We will disclose Collected Information to our and our affiliates’ respective suppliers, vendors, and service providers as necessary for us to provide the Services and our products and services to you and to engage in the use and sharing of Collected Information as permitted by this Privacy Notice and applicable law. These third parties include, without limitation, our website management and hosting suppliers, fraud detection and other security providers, customer support providers, fulfilment and delivery partners, , cloud storage providers, marketing and advertising partners,  website analytics providers, payment processors (if and as applicable), product installers, automation service providers and email and SMS service suppliers. Our service providers are authorized to and may use and disclose Collected Information as necessary for them to provide the applicable products and services to us and as provided by their own privacy policies and our agreements with those third parties. 

• Evaluation and Improvement. We may process  Collected Information to analyse, develop, and improve the content, materials, products, and services that we provide; understand user demographics and preferences; evaluate user needs; customise Services content; troubleshoot issues; conduct statistical analysis; and assess the effectiveness of the Services. Where feasible, we use aggregated or de-identified data for these activities. Our lawful bases are our legitimate interests in improving and securing the Services and, where non-essential cookies or similar technologies are used, your consent.

• Quality Assurance. In order to perform quality assurance, customer support, fraud identification, training, troubleshooting, and service improvement, we use tools to monitor and record certain user experience information, including, without limitation, audio of customer service calls and information resulting from such calls. Where we record customer service calls, use transcripts, or use AI-enabled tools to assist customer relationship representatives, we provide notice and obtain consent where required by applicable law. 

• De-Identified and Aggregated Data. We may de-identify and/or aggregate personal information and User-Generated Content, and aggregate other Collected Information, and use and disclose that aggregate and/or de-identified data for our business purposes, in each case to the extent permitted by applicable law. To the extent we create de-identified and/or aggregate personal information, we take reasonable measures designed to maintain such information in de-identified and/or aggregate form. Once de-identified or aggregated, we will not attempt to re-identify the data (other than to confirm our de-identification and aggregation processes worked).

• Lawful Processes; Protection of Company. We may process and disclose  Collected Information in accordance with and in response to regulatory authorities, courts with competent jurisdiction, valid law enforcement requests, governmental agency requests, emergency services, and other necessary third parties for legal, protection, security, and safety purposes. We may also process and disclose Collected Information where necessary to protect the rights, safety and security of Company, our users, our employees, our agents, our customers or others; enforce our agreements, policies and terms; prevent fraud; bring or defend legal claims; protect our operations and assets; or pursue remedies. Our lawful bases include compliance with legal obligations, legitimate interests and, where relevant, the establishment, exercise or defence of legal claims. 

• Business Transactions. If Company undergoes or evaluates a change in control, acquisition, merger, reorganisation, financing, due diligence review, asset sale, insolvency, bankruptcy or similar transaction, we may disclose or transfer Collected Information to the relevant parties and advisers where necessary for that transaction. We will require recipients to protect personal data appropriately and use it only for the transaction or as otherwise permitted by applicable law. 

• With Your Consent. Where we rely on consent, we will tell you what you are consenting to before you consent. You may withdraw consent at any time, and withdrawal will not affect the lawfulness of processing carried out before withdrawal. We will not use consent as the lawful basis where another basis is more appropriate or where consent would not be freely given under applicable law.

• Disclosures to Third Parties. Consistent with the purposes described in this Privacy Notice, we disclose certain categories of personal data to third parties for business, operational, legal, analytics, advertising or other permitted purposes. These recipients may include Last Brand, Inc., group companies and personnel. Some third parties act as processors or service providers on our behalf, while others may act as independent controllers for their own processing activities as described in their privacy notices.

• Payment. Payments submitted in connection with the Services must be made via the Services by credit card, debit card, or through alternate payment methods (such as Google Pay, PayPal, etc.) where such alternate payment methods are made available as an option. Please note that alternate payment methods may be provided by third parties (e.g., Google Pay via Google), subject to that third party’s privacy policy. This Privacy Notice does not apply to such third party’s collection and use of your information where that third party acts as independent controller. Please review the applicable third party’s privacy policy. With regard to credit and debit card payment, payment information is provided directly to our third-party payment processor. To submit payment using the Services, you will need to provide your name, email address, telephone number, and your credit or debit card number, expiration date, and security code, as well as any such information as necessary to verify the applicable payment. Our payment processor will use your payment-related information in accordance with its privacy policy. Where online storefront on the Services is hosted or powered by a third party, we encourage you to review any posted terms and privacy policies.

• User-Generated Content. You are responsible for any data, information, images, messages, documents, and other content that you enter, submit, create, post, upload, transmit, or otherwise provide through or using the Services, including by providing feedback, participating in forums or discussion boards, by uploading or providing photographs, by submitting product reviews or testimonials, by commenting on blog posts, or by populating a user account or profile (where such options are made available to you). “User-Generated Content” means all data, feedback, information, images, messages, documents, and other content that is entered into, submitted to, posted on, uploaded to, transmitted, streamed, created, or displayed using, or otherwise provided via or using the Services by you or on your behalf. Please do not provide personal data about other people unless you have a lawful basis to do so. We will use and disclose User-Generated Content for the purpose for which it was provided, as indicated at the point of collection, and as otherwise described in this Privacy Notice. Where User-Generated Content is made public, cached copies, archived pages or copies stored by other users or internet archives may remain available after removal from the Services. Your privacy rights, including rights to request deletion or object to processing where applicable, continue to apply to personal data contained in User-Generated Content.

• Job Applications. If you submit a CV, job application, or related materials or other information to us or through the Services, we may use that information to evaluate your qualifications, and consider or respond to your inquiry or application. Your submission of a CV, job application, or related information does not in any way require the Company to review that information or consider you for employment. To submit a job application your application will be processed via our online career portal operated by a third party. We encourage you to review the privacy policy of that portal.

• User Activity. Automatic server-side logging - When you visit or use the Services, our web servers automatically record certain technical information that your browser or device sends as part of the connection process. This includes your IP address, browser type and version, the pages you visit on the Services, the date and time of your visit, the time spent on those pages, and HTTP response data. We collect this information as a necessary part of operating and securing the Services. Our lawful basis for this processing is our legitimate interests in maintaining the security, stability, and integrity of the Services, and in preventing fraud and unauthorised access. This logging does not require your consent as it is carried out server-side and does not involve storing or accessing information on your device. Behavioural and performance analytics - With your consent, we also collect more detailed information about how you use the Services, including the features you use, the links you click, your search parameters, your interactions within the Services, and performance statistics. This information is collected using cookies and similar client-side technologies, and helps us understand how the Services are used so we can improve them.We will only collect this information  where you have given your prior consent through our Cookie Management Centre. You can withdraw your consent at any time by visiting the Cookie Management Centre, linked in the footer of our website. Withdrawing consent will not affect the lawfulness of any collection that took place before you withdrew it. 

• Analytics. The Services may use  third-party analytics tools (e.g., Google Analytics) to collect and process data about your use of the Services, including when you visit the Services, URLs of the websites that you visit prior to visiting the Services and when you visit those websites, and IP addresses assigned to the devices from where you access the Internet. Our analytics providers may set and read cookies to collect this data  to provide us with reports that we will use to improve the Services’ structure and content. We only use analytics cookies and similar technologies where you have given consent, unless the analytics activity is essential and therefore exempt from consent. For more information on how Google uses this data, visit Google’s Privacy Notice and Google’s page on How Google uses data when you use our partners' sites or apps. To prevent this data from being used by Google Analytics, follow the instructions to download and install the Google Analytics Opt-out Browser Add-on for each browser you use. Using the Google Analytics Opt-out Browser Add-on will not prevent Company from using other analytics tools and will not prevent data from being sent to the Service itself or to Google. For more information about how Google Analytics uses cookies to measure user interactions on websites, visit Google Analytics Cookie Usage on Websites. You may disable cookies as discussed below, but that may impact your use and enjoyment of the Service. 

Advertising Networks, Personalised Advertising, Remarketing, and Retargeting. 

From time to time the Services may use or participate in advertising networks and related advertising services that are managed and provided by third-party advertising servers, advertising agencies, technology vendors, and research firms, including Google Ads, advertising services provided by Meta (sometimes referred to the Meta “tracking pixel”), and advertising services provided by TikTok (sometimes referred to as TikTok Pixels). These advertising technologies will not be used for personalised advertising, remarketing or retargeting unless you have given consent as required by applicable law. Where you have consented to personalised advertising or similar tracking, these services may collect information about your visits to and interactions with the Services and other websites, and may use that to help display, measure and improve advertisements for goods and services and to display those advertisements on other websites. The information collected may be associated with your personal information.

Advertising networks may gather data about consumers who view advertisements to make inferences about a consumer’s interests and preferences, which enables their computers to deliver advertisements directly targeted to the consumer’s specific interests. This practice is often referred to as “online behavioral advertising.” For example, a third-party advertising network might collect the type of web browser you use, the type of computer operating system you use, the domain name of a website you visit, whether or not you visit specific pages of the Services and other websites, the location of your Internet service provider, the date and time of a visit to a website, and other interactions between you and a website.We do not intentionally use special category personal data for targeted advertising, and we do not knowingly target advertising to children.

Through Google Ads and similar services, advertising partners may use your Internet searches, cookies, and similar identifiers (e.g., pixel tags) to collect information about your visits to the Service and your interaction with our products and services to generate targeted advertisements to you on other websites that you visit across the Internet. We may also enable and implement Google Analytics Advertising Features on the Services where permitted. To opt out of remarketing advertising provided through Google, customise your ad preferences, or to limit Google’s collection or use of this information, visit Google’s Ad Settings and follow Google’s personalized ad opt-out instructions. Opting out will not affect your use of the Service.

To change your preferences with respect to certain online ads and to obtain more information about third-party ad networks and online behavioral advertising, please visit the Interactive Advertising Bureau (IAB) Europe or Your Online Choices. Please remember that changing your settings with individual web browsers or ad networks will not necessarily carry over to other browsers or ad networks. As a result, depending on the opt-outs you request, you may still see our ads from time to time. Your device may also include a feature (“Limit Ad Tracking” on iOS or “Opt Out of Interest-Based Ads” on Android) that allows you to opt out of having certain information collected through apps used for behavioral advertising purposes.  You may also use the cookie management option on the Site to give, refuse or withdraw consent for non-essential cookies and similar technologies. 

Social Media. The Services may implement widgets, tools, plug-ins, APIs or applications provided by social media platforms and the Services may otherwise allow for interaction, integration, or content sharing with third-party social media platforms and companies. These features may enable the social media platform to collect information from or about you, including through cookies, registration information or online identifiers, and may allow the platform to link your interaction with your social media account. We will only collect non-essential social media cookies, pixels or other technologies where you have given consent if required. We encourage you to review the privacy policy of any social media platform that you use or visit in connection with the Services, as those platforms’ respective privacy policies will govern their collection, use, and disclosure of information they collect from you. 

The Services may also use the advertising services and networks offered by social media platforms to deliver advertising content and measure advertising performance. Use of these services may require social media platforms to implement cookies,  pixel tags or similar technologies to deliver ads to you while you are logged into the applicable social media platform. We will not use these technologies unless any required consent has been obtained. 

If you do not want social media platforms to collect information relating to you via the Services or to link information collected via the Services to your social media accounts, you may choose not to connect to or share information with social media platforms using the Services, hide social media plug-ins using an ad blocker, log out from social media platforms before visiting the Services, delete related cookies, use available platform privacy settings, and use our cookie management option where available. These steps may not prevent all social media tracking because some processing is controlled by the relevant platform.

Our Social Media Pages. We are active on social media. If you post comments, reviews, or photographs on our social media pages, we may wish to share or feature that content on our own channels or website. We will only do so where we have a lawful basis, which in most cases will be your consent. We may monitor public comments and posts that mention us in order to respond to customer feedback and protect our reputation. Our lawful basis for this is our legitimate interests in understanding customer views and managing our brand.

We may combine this information with other Collected Information (including personal information) and information obtained from third parties, where we have a lawful basis to do so, including for security, fraud prevention, service improvement and to protect our rights or the rights of others. The suppliers that we use to provide the Services may collect information about your visits to the Services in order to support our cookie management, analytics, advertising and compliance tools. We require any non-essential cookies or similar technologies to be used only where any consent required by applicable law has been obtained. These technologies are explained further below under “Cookies and Tracking Technologies.” 

Cookies and Tracking Technologies. 

The Services use cookies and similar technologies to operate the Services, remember preferences, understand how the Services are used, personalise content, measure performance, and support advertising where permitted. Cookies are small pieces of information stored on your device by your web browser. We use strictly necessary cookies without consent where they are required to provide the Services, and we use non-essential cookies and similar technologies only where you have given any consent required by applicable law.  

The Services may use both cookies that we implement and cookies implemented by our suppliers, group companies, and other third parties. “First-party” cookies allow your browser to communicate with the website that you are visiting, whereas “third-party” cookies allow your browser to communicate with third-party websites, such as advertising networks or analytics providers. We do not control all third-party cookies after tlhey are set by third parties, and those third parties may process personal data as independent controllers or processors depending on the circumstances. Click here for information on the cookies used by Meta. Click here and here for information on the cookies used by Google.

A cookie can either be a “session” cookie or a “persistent” cookie. Session cookies exist only for so long as you are visiting the applicable website. Session cookies are typically deleted or removed when you exit or quit your browser application. Persistent cookies exist for a set period of time, for example, six (6) months or one (1) year. Each time you visit a website that has implemented a persistent cookie, that cookie will remain active until its predetermined expiration date. You can also manually delete persistent cookies as discussed above.

The types of information collected by cookies and the purposes for which that information is used depends on the type of cookie. We may combine information collected by cookies with other Collected Information where we have lawful basis to do so and, where required, your consent.

• Strictly necessary cookies (also called essential cookies). These are cookies that are required for the operation of the Services. For example, these cookies may be required to identify irregular website behaviour, prevent fraudulent activity,  improve security, remember privacy choices, enable checkout, maintain a session, and allow users of the Services to make use of requested functions. Without these cookies, features and services you have requested may not be available.

• Functional cookies. These cookies allow us to offer enhanced functionality when accessing or using the Services, such as  remembering  preferences or settings, remembering if you reacted to something on or through the Services, remembering if you have used any feature of the Services before, and enabling social media components. Where functional cookies are not strictly necessary, we will only use them with your consent as required. If functional cookies are disabled, some functions of the Services may be unavailable to you or may not work as expected.

• Performance cookies (also called analytical cookies). These cookies assess the performance of the Services and help us understand how visitors use and interact with the Services, for example, which pages on our websites users visit most often. These cookies help us improve the way our websites work and provide a better, personalised user experience. We use performance cookies only with any consent required by applicable law, unless an exemption applies. 

• Advertising or targeted cookies. These cookies record your visits to the Services, the pages you visit on our websites, and the links you have clicked. They may gather information about your browsing habits and remember that you have visited a particular website. Company and its third-party advertising platforms or networks may use this information to make the Services and its content more relevant to your interests (this is sometimes called “behavioral” or “targeted” advertising and is further discussed above). These cookies are also used to limit the number of times you see an advertisement and to help measure the effectiveness of advertising campaigns. To find out more about interest-based ads and your choices, please visit the Digital Advertising Alliance, the Network Advertising Initiative, the Interactive Advertising Bureau (IAB) Europe, https://www.allaboutcookies.org, andhttps://www.youronlinechoices.com. We will only use advertising or targeted cookies with your prior consent. 

For more information about cookies, including about advertising cookies and your choices regarding cookies, we suggest you visit the following websites: https://www.consumer.ftc.gov/articles/0042-online-tracking; https://www.allaboutcookies.org; and https://www.youronlinechoices.eu. 

Browsers generally allow users to manage cookies in the browser’s settings, including rejecting cookies from certain websites, rejecting certain types of cookies, rejecting or disabling all cookies, and deleting previously stored cookies. You can also use the Cookie Management centre, where available, to give, refuse or withdraw consent for non-essential cookies. Disabling or limiting cookies may affect your use and enjoyment of the Services, for example by preventing personalisation, preference storage, account recognition or other features. Changing your cookie preferences in one browser will not necessarily carry over to other browsers, so you may need to adjust your preferences each time you get a new device, install a new browser, upgrade an existing browser, or alter or delete a browser’s cookie file.

The Services may also use the following types of tracking technologies: web beacons (also called clear GIFs), flash cookies, and pixels (also called pixel tags). Web beacons are tiny graphics with unique identifiers that function similar to how cookies function but, in contrast to cookies, web beacons are embedded invisibly on websites. Flash cookies collect and store information about your use of a website and are commonly used for advertisements and videos. Cookie management tools provided by your browser may not remove and or manage Flash cookies. Click here for information on how to manage Flash cookies. Pixel tags can be placed on websites or within emails to track your interactions with those websites and when emails are opened. We use non-essential tracking technologies, including marketing pixels in emails, only where consent required by applicable law has been obtained. Some browsers and extensions offer “do not track” or other preference signals. We will honour legally required preference signals where applicable. Our primary method for recording cookie and tracking preferences is the Cookie Management centre and non-essential cookies will not be used unless the required consent has been obtained.

Embedded Content. The Services may incorporate content, including feeds, scripts embedded in the Services’ code, and visible content (e.g., videos), provided by third parties. In some cases, those third parties collect data about how you interact with their content and may process that data under their own privacy notices. Embedded content that uses non-essential cookies, pixels or similar technologies will be loaded or activated only where any consent required by applicable law has been obtained.  The Services may also include Google Maps features and content. Google Maps features and content are subject to the then-current versions of Google Maps/Google Earth Additional Terms of Service at https://maps.google.com/help/terms_maps.html and Google Privacy Policy at https://www.google.com/policies/privacy/.

Our Services may use YouTube to make content in video format available to you. YouTube may collect or otherwise access usage data, such as what videos you access and watch, through videos embedded in the Services as further described in YouTube’s Privacy Notice. YouTube adheres to Google's privacy policies and principles, part of which allow you to control certain privacy settings and which data are collected. YouTube videos or related tracking technologies will be loaded or activated only where permitted by applicable law and any required consent has been obtained. For more information, please visit https://www.youtube.com/howyoutubeworks/user-settings/privacy/.

Information that We Obtain from Third-Party Sources. We may obtain data about users of the Services from various third-party companies and public sources, whether offline or online (e.g., marketing companies, analytics consultants, publicly available social media profiles, other public sources of information). We will do so only where we have a lawful basis, where the third party is permitted to share the information with us, and where the processing is compatible with the purposes described in this Privacy Notice.  We may combine that data with Collected Information to enhance our existing information about our users and customers, improve our ability to contact you, prevent fraud, improve marketing relevance where permitted and improve the Services. We do not knowingly obtain special category personal data from third-party sources for marketing or profiling purposes. 

Retention of Personal Information

We retain personal data only for as long as necessary for the purposes described in this Privacy Notice, including to provide the Services, maintain accounts, complete transactions, comply with legal, tax, accounting and regulatory obligations, enforce agreements, prevent fraud, maintain security, and establish, exercise or defend legal claims. Retention periods vary depending on the type of personal data, the purpose of processing, whether you have an account, the nature of our relationship with you, legal requirements and limitation periods.

When we no longer have a lawful basis or ongoing need to retain personal data, we will delete, anonymise or aggregate it. If deletion is not immediately possible, for example because personal data is stored in back-up archives, we will securely store the personal data, restrict access to it, and isolate it from further active processing until deletion or anonymisation is possible.

International Transfers and Global Support

Although Last Brand Trading Co Ltd is the controller for the processing described in this Privacy Notice, our business relies on systems, infrastructure, service providers and group personnel located outside the EEA. This means personal data may be accessed from, transferred to, processed in, or stored for purposes such as hosting, engineering, security, fraud prevention, analytics, customer support, privacy administration, cookie compliance, vendor management and business operations.

Where we transfer personal data to a country that has not been recognised as providing an adequate level of protection, we use appropriate safeguards where required, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, adequacy regulations or decisions, approved certification mechanisms, or another lawful transfer mechanism. We also assess transfer risks and implement supplementary measures where appropriate, such as encryption, access controls, data minimisation, role-based permissions, logging, vendor due diligence and contractual restrictions.

Automated Processing, AI and Profiling

Automated decision-making and profiling

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significant effects, except where:

• it is necessary for entering into or performing a contract with you;

• it is authorised by UK law and appropriate safeguards are in place; or

• you have given your explicit consent.

Where we make such decisions, you have the right to request human review, to express your point of view, and to contest the outcome. To exercise this right, please contact us using the details in the "Contact Us" section.

We use automated and AI-assisted tools to support functions including customer service, fraud detection, product recommendations, search, analytics, and advertising measurement. These tools inform but do not replace human decision-making in contexts that could significantly affect you. You have the right to object to processing of your personal data for profiling purposes at any time by contacting us as set out in the "Contact Us" section.

Where AI tools process personal data on our behalf, we put in place appropriate contractual, confidentiality, security, and access controls, and we minimise the personal data shared with those tools.

We do not use your personal data to train third-party or publicly available general-purpose AI models. If we ever seek to do so, we will provide clear advance notice and obtain your explicit consent before doing so. We do not use special category personal data or children's personal data for AI training, profiling, or targeted advertising under any circumstances.

Your Choices and Access

As a UK resident, you have the following rights under UK GDPR in relation to personal data we process about you. These rights are not absolute and may be subject to conditions, limitations, and exemptions under applicable law.

• Right of Access: You may have the right to request confirmation that we process your personal data and to receive a copy of that personal data and related information.

• Right to Rectification: You may have the right to request correction of inaccurate personal data and completion of incomplete personal data. 

• Right to Erasure: You may have the right to request deletion of personal data in certain circumstances, for example where the personal data is no longer necessary, you withdraw consent and there is no other lawful basis, or you successfully object to processing. 

• Right to Restriction: You may have the right to request that we restrict processing of your personal data in certain circumstances, for example while we verify the accuracy of the data or consider an objection.

• Right to Data Portability: You may have the right to receive personal data that you provided to us in a structured, commonly used and machine-readable format, and to request that we transmit it to another controller where technically feasible.

• Rights to Object, Withdraw Consent, Challenge Automated Decisions and Complain: You may have the right to object to processing based on legitimate interests, object to direct marketing at any time, withdraw consent where processing is based on consent, request safeguards for certain automated decisions, and lodge a complaint with us or a supervisory authority. In the UK, you may contact the Information Commissioner’s Office. In the EEA, you may contact the supervisory authority in the country where you live, work or where you believe an infringement has occurred.

To exercise these rights, please see the “Exercise Your Rights” section of this Privacy Notice below. If you have any concerns, complaints, or other issues regarding our collection, use or other processing of your personal information, please contact us using the details under  “Contact Us”. We encourage you to contact us first so that we can try to resolve your concern, but you are not required to do so before contacting a supervisory authority. 

Sharing your personal information. 

We share your data with the following categories of companies as an essential part of being able to provide our services to you:

• Group companies, as sometimes different parts of our group are responsible for different activities

• Companies that provide fulfilment and delivery services such as payment service providers, warehouses, order packers, and delivery companies

• Companies that provide security services for example, by scanning our emails to detect malware.  

• Professional service providers, such as marketing agencies, advertising and financial partners and website hosts.

• Affiliates who help us reach out to potential new customers or promote our products on their websites.

• Credit reference agencies, law enforcement and fraud prevention agencies helping us address financial crime, including, but not limited to, fraud and sanctions.

You may choose to take advantage of some of our additional services, in which case, depending on your choices we may share your data with the following categories of companies to fulfil the services you have asked for:

• Social Media sites and other companies approved by you.

• Third-party payment providers, when you choose to use their payment services.

• Partners that help us provide services such as our ‘refer-a-friend’ feature 

If you would like to know more about the third-parties we may share personal data with, or how to find out more on how they will use your data, please contact us using the details in this Privacy Notice. 

We may provide third parties, such as our marketing partners, with information about our customers and their purchases. Before we do so, we will make sure that this information does not identify you, for example by aggregating it, anonymising it or removing personal identifiers from it unless we have your consent to share your information for marketing purposes.

Additionally, you can visit our Privacy Request Form if you would like us to delete the personal information that we process about you, subject to applicable legal exceptions and retention requirements. If your request relates to cookies or similar technologies, you may need to manage your choices separately for each browser or device you use.Please note that your opt out does not apply to information sold or shared prior to the Company receiving your request. Additionally, this opt-out is specific to us and does not apply to any third party activity. If you have any questions, concerns, or would like more information on your ability to opt out, you can contact us by emailing: privacy@uk.onequince.com.

We do not knowingly sell or share for cross-contextual behavioral advertising purposes, the personal information of anyone under the age of 16 years old. See the “Children’s Privacy” section of this Privacy Notice below for more information.

Exercise Your Rights

If this Privacy Notice states  that you have certain rights, or applicable law grants you rights as it relates to this Privacy Notice and Collected Information, you may submit a request to us by:

• Emailing: privacy@uk.onequince.com

• Visiting: https://privacy-preferences.quince.com/ 

Only you or someone authorised to act on your behalf, may make a request related to your personal information. If you have someone acting on your behalf, we have the right to authenticate their authority to act. Without limiting the foregoing, the request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorised representative.

• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We may be unable to  respond to your request or provide personal information if we cannot verify your identity or authority to make the request and confirm that the  personal information relates to you.  Making a rights  request does not require you to create an account with us.  We will only use personal information provided in connection with a rights  request only to verify the requestor’s identity or authority, to process the request and maintain a record. 

We will respond to your request within the applicable timeframe required by law. For UK, EEA and Swiss individuals, we generally respond within one month of receipt of a valid request, although we may extend that period where permitted by law or where the request is complex or you make multiple requests. If we deny your request, we will explain the reason where required by law and, where applicable, describe any appeal or complaint rights. You may submit a complaint to the applicable government regulator or supervisory authority in the jurisdiction in which you are located. For UK individuals, this may include the Information Commissioner’s Office. 

Accuracy & Information Security

Personal information you provide to us should be relevant to the purposes for which it is to be used, and, to the extent necessary for those purposes should be accurate, complete, and up to date.

We have implemented reasonable and appropriate administrative, technical, physical, and organisational security measures designed to protect personal data against unauthorised access, unauthorised disclosure, loss, theft, misuse, and other unauthorised processing.  These measures may include access controls, encryption or similar protections where appropriate, role-based permissions for personnel operating outside of the EEA, vendor due diligence, contractual safeguards, monitoring, testing, employee training and incident response procedures. However, no storage or transmission method can be guaranteed to be completely secure. We do not publish all of our security measures online because this may reduce their effectiveness.  If you become aware of any breach of the Services’ security or of this Privacy Notice, please notify us at privacy@uk.onequince.com immediately.  Where required by applicable law, we will notify the relevant supervisory authority and affect individuals of a personal data breach within the required timeframe. 

Children’s Privacy

The Services are not directed at children under 16 years of age. Company does not knowingly collect or use information from children under 16 through the Services. We do not knowingly sell or share children’s personal information, use children’s personal data for targeted advertising, or use children’s personal data for AI training or profiling. If a parent or legal guardian becomes aware that a child under the age of 16 has provided information to us through the Services, the parent or legal guardian should contact us using the information below under “Contact Us” and we will take reasonable steps to delete that information, unless we are legally required or permitted to retain it.

Mobile SMS / MMS Marketing Program

We respect your privacy. In connection with our Mobile Message Program, we will use information you provide to transmit mobile messages, respond to you, administer your preferences, maintain suppression lists, and comply with applicable law. This includes sharing information with platform providers, phone companies, and other vendors who assist us in delivering mobile messages. For individuals in the UK, EEA or Switzerland, we will send marketing SMS, MMS or similar mobile messages only where you have opted in or where another lawful marketing basis applies, and you may opt out at any time using the instructions provided in the message or by contacting us. 

Third-Party Websites and Services

The Services may link to, or be linked to, websites, applications, or services not maintained or controlled by the Company. The Company is not responsible for the privacy policies or practices of any third parties or any third-party websites, applications, or services. This Privacy Notice does not apply to any third-party websites, applications, or services or to any personal or other information that you may provide to third parties. You should read the privacy policy for each website, application, and service that you visit or use.

Contact Us

If you have any questions or concerns regarding this Privacy Notice, contact us by email at privacy@uk.onequince.com.