Privacy Policy

Last updated: July, 2025

Thank you for visiting glowness.co.uk (the "Site"), which is owned and operated by Glowness UK Ltd ("Glowness", "we", "us" or "our").

We value the trust you place in us when you share your personal data and we are committed to being transparent, fair and accountable in the way we handle it.

This Privacy Policy explains how we collect, use, disclose, store and protect your personal information when you:

browse or purchase products on the Site;
create an account or sign up to our marketing list;
engage with our social‑media, affiliate or influencer programmers; or
otherwise interact with us, whether online or offline.

This Policy is governed by the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using the Site you acknowledge that you have read and understood the practices described below.

1. WHO WE ARE

Glowness UK Ltd is registered in England and Wales under number 15800152 with its registered office at 142–143 Parrock Street, Gravesend, DA12 1EY, United Kingdom. We are the "controller" of your personal data for the purposes of the UK GDPR.

If you have any questions about this Policy or your rights, please contact us by email at support@glowness.co.uk.

2. WHAT INFORMATION WE COLLECT & WHY

We collect personal information in the situations listed below. Each collection is limited to what is necessary and processed under a specific lawful basis set out in Article 6 UK GDPR.

Account & Order Data (Contractual necessity)

When you create an account or place an order we ask for your name, billing and delivery addresses, e‑mail address and telephone number. We use this information to process and fulfil your order, provide receipts, handle returns and offer customer support.

Payment Information (Contractual necessity / Legitimate interest)

Payments are handled securely by Shopify Payments and Stripe. We receive a payment confirmation token only; full card details are never stored on our servers. We keep transaction identifiers for accounting, fraud prevention and tax compliance purposes.

Marketing & Preference Data (Consent / Legitimate interest)

If you sign up for our newsletter or choose to receive personalised offers, we collect your e‑mail address, purchase history and browsing behaviour to tailor content.

You may withdraw consent at any time by clicking "unsubscribe" in any marketing email.

Analytics & Cookies (Consent / Legitimate interest)

We use first‑party cookies and third‑party analytics tools (Google Analytics 4) to understand how visitors navigate the Site, diagnose technical issues and improve performance.

Influencer & Affiliate Programme Data (Contractual necessity / Legitimate interest)

If you join our influencer or affiliate schemes, we collect contact details, social‑media handles, payout information and performance statistics to administer the programme, track referrals, and issue commission payments.

Customer Service Records (Legitimate interest)

When you contact us by e‑mail or social‑media we keep a record of the correspondence to resolve your query and improve our services.

Legal & Security Information (Legal obligation / Legitimate interest)

We may process information necessary to comply with legal requests, enforce our terms or protect the security of the Site, our customers and the public.

1. HOW LONG WE KEEP YOUR DATA

We retain personal data only for as long as necessary for the purpose it was collected, after which it is securely deleted or anonymised.

• Order records:

6 years after the end of the financial year in which the transaction occurred (statutory accounting period).

• Marketing subscribers:

until you withdraw consent or after 24 months of inactivity, whichever is sooner.

• Support tickets:

24 months from last interaction unless a longer retention is required to resolve an ongoing dispute.

• Influencer / affiliate agreements:

6 years after the contract ends (limitation period for commercial claims).

• Cookie identifiers:

up to 24 months, subject to your cookie preferences.

2. HOW WE SHARE INFORMATION

We never sell your personal data. We do, however, share it with trusted service providers who perform services on our behalf, strictly under data‑processing agreements:

• E‑commerce platform & hosting:

Shopify International Ltd (Ireland)

• Payment processors:

Stripe Payments UK Ltd; PayPal (Europe) S.à r.l.

• Fulfilment & logistics:

Amazon UK Services Ltd (FBA) for warehousing, pick/pack and delivery

• Email marketing & CRM:

Klaviyo Inc. (USA)

• Analytics & site optimisation:

Google LLC (USA)

All providers are contractually bound to use the data only for the specified purpose and to implement appropriate security measures. Where a provider is located outside the UK/EEA, transfers are protected by UK Addendum standard contractual clauses or an adequacy decision.

We may also disclose information when required by law, for example to HM Revenue & Customs, courts, regulators or law‑enforcement agencies.

3. YOUR RIGHTS Under the UK GDPR you have rights to:

Access a copy of the personal data we hold about you;
Request rectification of incomplete or inaccurate data;
Request erasure where there is no lawful reason for us to continue processing.
Object to or restrict certain processing (e.g., direct marketing).
Port your data to another service provider;
Withdraw consent at any time where processing is based on consent.

To exercise any of these rights please e‑mail support@glowness.co.uk. We respond within 30 days.

4. SECURITY

We employ industry‑standard technical and organisational measures—including TLS encryption, access controls, and regular vulnerability assessments—to safeguard your data against unauthorised access, loss or alteration.

5. CHILDREN

The Site is not directed to children under 16 and we do not knowingly collect their personal data. If you believe we have inadvertently collected such information, please contact us for deletion.

6. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. Any material changes will be posted on this page with a new "Last updated" date and, where appropriate, notified to you by e‑mail at least 14 days before taking effect.