Who We Are

Finch & Hatton Ltd is the controller of the personal information described in this Privacy Notice.

We trade as Finch & Hatton and operate the website www.finchandhatton.co.uk, referred to in this notice as the “Site”.

Questions or requests relating to personal information may be sent to:

Email: info@finchandhatton.co.uk

Scope of This Notice

This notice explains how we collect, use, disclose and retain personal information when you:

• Visit or interact with the Site.
• Create or use a customer account.
• Place or attempt to place an order.
• Contact Client Care.
• Subscribe to marketing.
• Interact with our advertising or social-media presence.
• Otherwise engage with Finch & Hatton.

This notice does not treat ordinary browsing as consent to every use of personal information. Where consent is legally required, including for certain cookies and electronic marketing, we request it separately.

Information We Collect

Information you provide

We may collect:

• Your name.
• Email address.
• Billing and delivery addresses.
• Telephone number, if supplied for delivery or account purposes.
• Customer-account and authentication information processed through Shopify.
• Order history, selected products and transaction information.
• Marketing preferences.
• Messages, enquiries, complaints and other communications.
• Return, refund and delivery information.
• Information supplied when exercising a privacy right.
• Information needed to investigate a suspected fraudulent transaction or product-safety concern.

Shopify handles customer-account credentials. We do not receive your password in readable form.

Please do not send sensitive personal information through the general contact form unless we ask you to provide it for a specific and necessary purpose.

Information collected automatically

When you use the Site, we and our service providers may collect:

• IP address.
• Browser and device type.
• Operating system.
• Approximate location derived from an IP address.
• Pages viewed and links selected.
• Referral source.
• Session, basket and checkout activity.
• Cookie and consent preferences.
• Account sign-in and security events.
• Website performance and diagnostic information.
• Analytics and campaign-attribution information.

Non-essential analytics and advertising technologies are used only after consent where applicable.

Information received from others

We may receive information from:

• Shopify, which hosts and supports the store.
• Payment and wallet providers.
• Royal Mail and, where required, DHL.
• Google Analytics and Google advertising services.
• Microsoft Outlook when you correspond with us.
• Fraud-prevention and security providers.
• Professional advisers and lawful public authorities.

We do not currently use a Meta Pixel or TikTok Pixel on the Site. Advertising platforms may nevertheless provide aggregated campaign, referral and engagement reporting generated through activity on their own services.

How and Why We Use Personal Information

Orders and customer accounts

We use information to:

• Create and administer customer accounts.
• Process orders and payments.
• Send confirmations and service messages.
• Arrange delivery.
• Manage cancellations, returns and refunds.
• Provide Client Care.

Lawful basis: performance of a contract or steps taken at your request before entering a contract.

Payment processing

Payments are processed using the payment services presented at checkout, including credit or debit cards, Apple Pay and Google Pay.

Payment providers receive the information required to authorise and complete the transaction. We do not ordinarily receive or store complete card numbers or security codes.

Lawful basis: performance of a contract and our legitimate interest in receiving and administering payment securely.

Security and fraud prevention

We use information to:

• Protect customer accounts and the Site.
• Detect suspicious orders.
• Prevent fraud and misuse.
• Enforce our contractual rights.
• Maintain records of security incidents.

Lawful basis: legitimate interests in protecting customers and the business, and legal obligations where applicable.

Legal, accounting and regulatory obligations

We use and retain information where necessary to:

• Maintain tax and accounting records.
• Respond to lawful requests.
• Establish, exercise or defend legal claims.
• Meet consumer-protection and product-safety obligations.
• Report relevant safety issues where required.

Lawful basis: legal obligation and, where appropriate, legitimate interests.

Website analytics and improvement

Subject to cookie consent where required, we use Shopify analytics and Google Analytics to understand:

• How visitors reach and use the Site.
• Which pages and products receive attention.
• Website performance.
• Broad location and device information.
• Campaign and conversion performance.

This helps us improve navigation, product presentation and commercial performance.

Lawful basis: consent where required for analytics cookies; otherwise legitimate interests where the law permits.

Advertising

We advertise through services that may include Google, YouTube, Instagram and Facebook.

We may select audiences using broad location, demographic or interest criteria made available by those platforms. For example, campaigns may be directed towards particular cities or geographical markets.

We normally receive aggregated campaign results rather than the underlying personal profiles used by an advertising platform to select its users.

If Google Analytics or another advertising technology is used to measure activity on the Site, it operates according to the cookie preferences available through our consent controls.

Lawful basis: consent for advertising cookies or personalised measurement where required; otherwise legitimate interests where applicable.

Marketing communications

We send promotional emails only where:

• You have given consent; or
• Another lawful exception, such as the UK “soft opt-in” for existing customers, applies and you were given an opportunity to opt out.

Every promotional email provides an unsubscribe method. Service emails concerning an order, account, delivery or legal notice are not promotional marketing.

Lawful basis: consent or legitimate interests where the soft opt-in lawfully applies.

Cookies and Similar Technologies

We use:

• Essential cookies required for accounts, baskets, checkout, security and preference storage.
• Analytics cookies used to understand Site performance.
• Advertising or attribution technologies where enabled.
• Preference cookies used to remember choices.

Our Shopify cookie banner allows customers in relevant regions to accept, reject or manage non-essential technologies.

You can revisit your preferences through the cookie controls available on the Site.

For further information, including individual cookie purposes and durations, see our Cookie Policy.

Shopify provides further information in its Cookie Policy.

Blocking essential cookies may prevent parts of the Site, basket or checkout from working correctly.

Shopify

The Site is hosted by Shopify. Shopify processes customer and visitor information to provide hosting, checkout, account, security, analytics and related commerce services.

Shopify may process information in the United Kingdom, European Economic Area, Canada, Singapore, the United States and other locations used by its affiliates and subprocessors.

Further information is available in the Shopify Privacy Policy.

Where available, customers may also use our Privacy Choices and data-sharing opt-out.

Parties With Whom We Share Information

We may disclose necessary information to:

Commerce and website providers

• Shopify and its authorised subprocessors.
• Website hosting, security and technical-support providers.

Payment providers

• Shopify Payments and associated card processors.
• Apple Pay.
• Google Pay.
• Relevant banks and card networks.

These providers may also act as independent controllers for aspects of their services.

Delivery providers

• Royal Mail for ordinary UK and international fulfilment.
• DHL where required for particular international destinations.
• Customs, postal and border authorities where legally necessary.

Communications providers

• Microsoft, through Outlook and associated Microsoft services, for customer correspondence and business email.

Professional and legal recipients

• Accountants, insurers, solicitors and professional advisers.
• Regulators, law-enforcement bodies, courts and tax authorities.

We require service providers acting on our behalf to process information only for authorised purposes and to protect it appropriately.

Your Privacy Choices

Finch & Hatton does not sell personal information for money.

We use Shopify Network Intelligence, a Shopify service that helps improve store features, performance, personalisation, analytics and advertising measurement. Shopify may securely use information from interactions with the Site together with information held by Shopify and information from other participating merchants. This does not give other merchants access to your personal information.

In the United Kingdom, European Economic Area and other regions where consent is required, non-essential uses of this information operate according to your cookie choices. You may accept, reject or manage these technologies and may change your selection at any time through the Cookie Preferences controls.

Certain United States privacy laws use broader definitions of “sale”, “sharing” or “targeted advertising”. Where those laws apply, you may opt out through our Your Privacy Choices page. We also recognise applicable browser-based privacy signals, such as Global Privacy Control, where legally required.

Further information about Shopify’s processing and the choices available to you can be found in the Shopify Consumer Privacy Policy and Shopify Privacy Portal.

You may also contact us at info@finchandhatton.co.uk regarding your privacy choices.

International Transfers

Some providers process information outside the United Kingdom.

Where data-protection law requires a transfer safeguard, we rely on measures such as:

• UK adequacy regulations.
• The UK International Data Transfer Agreement.
• The UK Addendum to approved Standard Contractual Clauses.
• Contractual and organisational safeguards implemented by our providers.

Shopify describes its international-transfer safeguards in its Privacy Policy and Data Processing Addendum.

You may request further information about relevant safeguards by contacting us.

Retention

We retain personal information only for as long as reasonably necessary for the stated purpose, including legal, accounting, security and dispute requirements.

Our intended retention periods are:

• Orders, payments, refunds and accounting records: normally six years after the end of the relevant financial year.
• Customer accounts: while active and for up to two years following closure or inactivity, except where order or legal records must be retained longer.
• Client Care enquiries: normally two years after the enquiry is resolved.
• Abandoned or incomplete checkout information: up to twelve months unless required for security or dispute purposes.
• Marketing information: until consent is withdrawn or you unsubscribe. We may retain minimal suppression information to ensure that an opt-out continues to be respected.
• Google Analytics user-level and event-level data: fourteen months. Aggregated reports that no longer identify an individual may be retained for longer.
• Security and fraud records: for as long as reasonably necessary to protect the business and establish or defend claims.
• Product-safety records: for the period required by applicable cosmetic-product and safety law.
• Cookie information: for the durations stated in our Cookie Policy.

Information may be retained longer where required by law, regulatory investigation, litigation or a legal hold.

Security

We use appropriate technical and organisational safeguards, including access restrictions, account-security controls and security features provided by Shopify, Microsoft and our payment providers. Although no online system can be guaranteed completely secure, we regularly review the measures used to protect personal information.

Your Rights

Depending on the law applicable to you, you may have the right to:

• Request access to personal information.
• Request correction of inaccurate or incomplete information.
• Request deletion.
• Restrict particular processing.
• Object to processing based on legitimate interests.
• Object to direct marketing at any time.
• Request portability of information supplied under contract or consent.
• Withdraw consent without affecting earlier lawful processing.
• Request information about international-transfer safeguards.
• Complain to a supervisory authority.
• Appeal a refusal of a privacy request where applicable.

Rights are not absolute, and legal exceptions may apply.

To make a request, email info@finchandhatton.co.uk. We may ask for proportionate information to verify identity before disclosing or deleting personal information.

We normally respond within one month where UK data-protection law applies.

Complaints

We would appreciate the opportunity to resolve any concern directly. You also have the right to make a complaint to the Information Commissioner’s Office, the UK supervisory authority for data protection.

Children

The Site is not directed towards children under 16, and we do not knowingly collect personal information from children for marketing purposes.

If you believe a child has supplied personal information inappropriately, contact us so that we can review and, where appropriate, delete it.

Changes to This Notice

We may update this notice to reflect changes in law, technology or business operations.

The latest version will be published on the Site with a revised effective date. Where a change materially affects how information is used, we will provide additional notice where legally required.

Contact

Finch & Hatton Ltd Email: info@finchandhatton.co.uk