Privacy Policy
Privacy Policy
UK GDPR · Transparency · Your Rights
This Privacy Policy explains how Olivia & Sophia London collects, uses and protects your personal data. If you have any questions about data protection, please contact us at support@oliviasophia-london.com.
Information About the Collection of Personal Data & Controller Contact Details
1.1 We're glad you're visiting our website and thank you for your interest. Below we explain how we handle your personal data when you use our website. Personal data means any information that can be used to identify you personally.
1.2 The controller responsible for data processing on this website, within the meaning of the UK GDPR and the Data Protection Act 2018, is Olivia & Sophia London. The controller is the person or organisation that determines the purposes and means of processing personal data. Our full contact details are set out in section 15 below.
1.3 For security reasons, and to protect the transmission of personal data and other confidential content (for example orders or enquiries sent to us), this website uses SSL/TLS encryption. You can recognise an encrypted connection by the “https://” prefix and the padlock symbol in your browser bar.
Data Collected When You Visit Our Website
If you use our website purely for information — that is, if you do not register or otherwise send us information — we only collect the data your browser transmits to our server (so-called “server log files”). When you visit our website, we collect the following data, which is technically necessary for us to display the site to you:
- The page visited
- Date and time of access
- Volume of data sent, in bytes
- The source or referral from which you reached the page
- The browser and operating system used
- The IP address used (in anonymised form where applicable)
This processing is carried out under Article 6(1)(f) UK GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used for any other purpose. We do, however, reserve the right to review server log files retrospectively if there are concrete indications of unlawful use.
Hosting: This website runs on the Shopify platform (Shopify International Ltd., Victoria Buildings, 1–2 Haddington Road, Dublin 4, Ireland). Shopify processes the data described above as our processor under a written data processing agreement in line with Article 28 UK GDPR.
Cookies
To make visiting our website appealing and to enable certain functions, we use so-called cookies on various pages. These are small text files stored on your device. Some of the cookies we use are deleted at the end of your browser session, once you close your browser (session cookies). Others remain on your device and allow us or our partner companies (third-party cookies) to recognise your browser on your next visit (persistent cookies).
When cookies are set, they collect and process certain user information such as browser and location data as well as IP address values, to an individual extent. Persistent cookies are deleted automatically after a set period, which may vary from cookie to cookie.
In some cases, cookies are used to simplify the ordering process by saving your settings — for example, remembering the contents of your basket for a later visit. Where personal data is also processed by individual cookies we have implemented, that processing is carried out under Article 6(1)(b) UK GDPR for the performance of the contract, or under Article 6(1)(f) UK GDPR to safeguard our legitimate interests in the best possible functionality of the website.
Consent: Cookies that are not strictly necessary — in particular marketing and analytics cookies — are only set on the basis of your express consent, in accordance with Regulation 6 of the Privacy and Electronic Communications Regulations (PECR) and Article 6(1)(a) UK GDPR. You can withdraw your consent at any time, with effect for the future, through the cookie settings on our website.
Browser Cookie Settings
- Microsoft Edge: support.microsoft.com/microsoft-edge
- Firefox: support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop
- Chrome: support.google.com/chrome/answer/95647
- Safari: support.apple.com/en-gb/guide/safari
- Opera: help.opera.com/en/latest/web-preferences/#cookies
Please note: You can set your browser to notify you when cookies are set and decide individually whether to accept them, or to block cookies in certain cases or altogether. Every browser manages cookie settings differently. Please be aware that the functionality of our website may be limited if cookies are not accepted.
Contacting Us
When you contact us (for example via a contact form or by email), personal data is collected. Where a contact form is used, the data collected is set out in that form. This data is stored and used solely for the purpose of responding to your enquiry, contacting you and the associated technical administration.
The legal basis for this processing is our legitimate interest in responding to your enquiry under Article 6(1)(f) UK GDPR. If your enquiry relates to entering into a contract, the additional legal basis is Article 6(1)(b) UK GDPR. Your data is deleted once your enquiry has been dealt with conclusively, unless we are subject to a legal retention obligation.
Data Processing When Opening a Customer Account & Contract Processing
In accordance with Article 6(1)(b) UK GDPR, personal data continues to be collected and processed when you provide it to us for the performance of a contract or when opening a customer account. The data collected is set out in the relevant input forms.
You may delete your customer account at any time by sending a message to the contact address given above. We store and use the data you provide in order to process your contract. Once the contract has been fully performed, or your customer account deleted, your data is restricted with regard to tax and commercial retention periods and deleted once those periods expire, unless you have expressly consented to further use of your data.
Use of Your Data for Direct Marketing
6.1 — Email Newsletter Sign-Up
If you sign up for our email newsletter, we will send you regular information about our offers. The only mandatory information for sending the newsletter is your email address. We use the double opt-in procedure, which means we will only send you a newsletter once you have expressly confirmed that you consent to receiving it.
By activating the confirmation link, you give us your consent to use your personal data under Article 6(1)(a) UK GDPR. When you sign up, we store the IP address assigned by your Internet Service Provider, together with the date and time of registration. You can unsubscribe at any time using the link provided in every newsletter. After unsubscribing, your email address is removed from our mailing list immediately.
6.2 — Email Newsletter to Existing Customers
If you have given us your email address when purchasing goods or services, we reserve the right to send you regular offers for similar goods or services from our range by email. We rely on the “soft opt-in” exemption under Regulation 22(3) PECR, so separate consent is not required. This processing is carried out solely on the basis of our legitimate interest in personalised direct marketing under Article 6(1)(f) UK GDPR. You may object to the use of your email address for marketing purposes at any time, with effect for the future, and every message we send includes a simple means of opting out.
Data Processing for Order Fulfilment
7.1 The personal data we collect is passed on to the carrier commissioned to make the delivery, as part of contract processing and insofar as this is necessary to deliver the goods. We pass your payment data to the relevant financial institution as part of payment processing, insofar as this is necessary for that purpose. The legal basis for these transfers is Article 6(1)(b) UK GDPR.
International transfers: Because some of our goods are shipped through international logistics partners, your delivery details (name, address, telephone number) may be transferred to service providers outside the United Kingdom. Any such transfer is made in accordance with Chapter V of the UK GDPR, solely for the purpose of delivering your order, and is necessary for the performance of your contract under Article 49(1)(b) UK GDPR.
7.2 — Payment Service Providers
Review Reminder
We use your email address to send you a single reminder to leave a review of your order in the review system we use, provided you gave us your express consent to do so under Article 6(1)(a) UK GDPR during or after your order. You may withdraw your consent at any time by contacting us.
Use of Social Media: Social Plugins
Our website uses so-called social plugins for the social networks Facebook and Instagram, operated by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
To improve the protection of your data when you visit our website, these buttons are not embedded as unrestricted plugins but only as HTML links (the so-called Shariff solution). This ensures that no connection is made to Meta's servers when you open a page on our website containing such buttons. Only when you click the button does a new browser window open and load the relevant page, where you can interact with the plugins.
Online Marketing
10.1 — Google Ads Conversion Tracking
This website uses the online advertising programme Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and its conversion tracking. We use Google Ads to draw attention to our offers on external websites. A conversion tracking cookie is set when a user clicks on an ad served by Google. These cookies usually expire after 30 days and are not used to identify you personally.
10.2 — Google Marketing Platform
This website uses the online marketing tools of the Google Marketing Platform (formerly DoubleClick). It uses cookies to serve users relevant ads, improve campaign performance reporting, and avoid showing a user the same ads repeatedly.
Legal basis: This processing is carried out solely on the basis of your express consent under Regulation 6 PECR and Article 6(1)(a) UK GDPR. You can withdraw your consent at any time through our cookie settings.
Web Analytics Services
Google Analytics 4
This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited. Google Analytics uses cookies that allow us to analyse how you use the website. In Google Analytics 4, IP addresses are anonymised and truncated by default, which rules out any direct personal reference.
Google uses this information on our behalf to evaluate your use of the website, compile reports on website activity, and provide further services relating to website and internet usage. The IP address transmitted by your browser as part of Google Analytics is not merged with other Google data.
This website also uses Google Analytics for cross-device analysis of visitor flows, carried out via a User ID. A unique, permanent and anonymised ID is assigned on your first visit and set across devices. The User ID contains no personal data and does not transmit any to Google. You may object to collection and storage via the User ID at any time, with effect for the future.
This processing is carried out solely on the basis of your consent under Article 6(1)(a) UK GDPR.
Retargeting / Remarketing / Recommendation Advertising
Meta Pixel (Facebook Custom Audience)
This website uses the “Meta Pixel” provided by Meta Platforms Ireland Ltd. Where express consent is given, user behaviour can be tracked after a user has seen or clicked on a Meta advert. This serves to evaluate the effectiveness of adverts for statistical and market research purposes. The data collected is anonymous to us, but is stored and processed by Meta. Processing takes place only with your express consent under Article 6(1)(a) UK GDPR. Consent to the use of the Meta Pixel may only be given by users aged 13 or over.
Google Ads Remarketing
Our website uses Google Ads remarketing functions. Google sets a cookie in the browser on your device which automatically enables interest-based advertising using a pseudonymous cookie ID, based on the pages you have visited. This processing is carried out on the basis of your consent under Article 6(1)(a) UK GDPR. Any further processing only takes place if you have agreed with Google that your internet and app browsing history may be linked to your Google account.
Your Rights as a Data Subject
13.1 UK data protection law gives you extensive rights in relation to the processing of your personal data:
13.2 — Right to Object
Right to object: Where we process your personal data on the basis of our overriding legitimate interest following a balancing of interests, you have the right to object to that processing at any time, with effect for the future, on grounds relating to your particular situation. If you exercise your right to object, we will stop processing the data concerned. We may nevertheless continue processing where we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or where the processing serves the establishment, exercise or defence of legal claims.
Direct marketing: Where we process your personal data for direct marketing purposes, you have an absolute right to object at any time to the processing of your data for such marketing. If you exercise this right, we will stop processing the data concerned for direct marketing purposes.
How Long We Keep Your Personal Data
How long we store personal data depends on the applicable statutory retention period — for example commercial and tax retention obligations, which generally require records to be kept for six years. Once that period expires, the corresponding data is deleted as a matter of routine, provided it is no longer required for the performance or initiation of a contract and we no longer have a legitimate interest in continued storage.
Contact
To exercise your rights, or if you have any questions about how we handle your data, please contact us:
Olivia & Sophia London
Complaints: If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk. We would appreciate the opportunity to resolve your concern directly first.