Privacy policy
Abbey Essentials | Privacy Policy
This policy explains how Abbey Essentials collects, uses, shares and protects personal information when you visit our website, contact us or purchase from us. It applies to customers and website visitors in the UK and internationally. We use personal information to operate our store, fulfil orders, arrange deliveries and customs clearance, comply with legal obligations and provide customer support.
01. Company information and privacy contact
Abbey Essentials is a trading name of AE Cosmetics Limited, registered in England and Wales under company number 09627087.
Registered office: 69 Bethel Street, Norwich, Norfolk, NR2 1NR, United Kingdom.
AE Cosmetics Limited is the data controller for personal information it handles in operating Abbey Essentials. Some organisations, including Shopify, may also be responsible for particular processing activities in their own right.
For privacy enquiries or requests concerning your information, use our Contact Us page and identify your message as a privacy or data protection enquiry.
02. Information we collect
Information you provide: Your name, billing and delivery addresses, email address, telephone number, order and account details, messages to us, returns information and any marketing choices you make. We receive payment confirmations and transaction references, while payment-card details are processed by payment providers.
Information collected automatically: Shopify and connected website services may collect technical and usage information, including IP address, browser and device details, pages viewed, basket activity, cookie identifiers and related interaction events, according to the privacy choices and rules described in section 07.
Information received from others: We may receive payment status, fraud-risk assessments, delivery and tracking updates, customs information and relevant support information from Shopify, payment providers, delivery companies and other providers involved in a transaction.
Information needed for an order: We need enough information to process payment, identify and fulfil your order, contact you when necessary and deliver your goods. International delivery can require accurate email and telephone contact details and customs information. If essential information is missing or incorrect, we may be unable to fulfil an order or its delivery may be delayed. Marketing subscription is optional.
03. How and why we use your information
We process personal information for the following purposes and lawful bases under UK data protection law:
Contract: Processing purchases, payments, orders, deliveries, returns and order-related customer support.
Legal obligation: Maintaining legally required records, customs declarations and responding to lawful requests.
Legitimate interests: Protecting the store and customers against fraud, maintaining security, resolving disputes and improving customer service, after considering the impact on individuals.
Consent: Where required for optional cookies, advertising technologies or particular marketing communications. Consent can be withdrawn without affecting earlier lawful processing.
We use automated fraud-risk checks. Orders classified as high risk may be rejected or cancelled automatically, using order, payment and related risk indicators. The consequence may be that we cannot complete the purchase. If you believe a decision was made in error, you can contact us and request a review. Where the decision is subject to statutory safeguards for solely automated decisions, you can make representations, request human involvement and contest the decision, as explained in section 12.
For marketing, we use consent or, where the separate legal conditions are met, the existing-customer soft opt-in for our own similar products. In the latter case, legitimate interests may be the data-protection lawful basis. Details are in section 08. Consent is not required for every processing activity, such as using information needed to fulfil a purchase.
04. Orders, deliveries and international customs
To dispatch your order, we share information reasonably needed with delivery providers, including Royal Mail, relevant delivery partners and customs agents.
For international shipments, this may include your name, delivery address, email address, telephone number, order details, product descriptions, values, quantities, weights, country of origin and customs classifications.
Customs authorities, import agents and local delivery partners may use these details to process the parcel, assess import duties or taxes, request information or contact you about clearance and delivery. Depending on the destination, contact may take place by telephone, text message or email, including a payment link where charges are payable by the recipient.
Accurate email and telephone details are particularly important for recipient-paid international deliveries. Missing or incorrect details may prevent the carrier or customs authority from contacting you, delaying or preventing delivery.
05. Who we share information with
We share information as needed with:
Payment providers, to process payments, verification and refunds.
Delivery providers, including Royal Mail, international carriers and customs agents.
Customs, tax and other public authorities, where needed for shipments or legal obligations.
Professional and technical providers, where needed for accounting, website services and security.
Shopify, for the operation and security of our store, checkout and customer services.
Connected advertising and review services, including Facebook & Instagram, Google & YouTube, Microsoft Channel, Pinterest and Judge.me Reviews. These integrations can process relevant website, shopping, order or review information according to their purpose, configuration and applicable privacy choices.
We may also disclose information to investigate fraud, protect legal rights or manage a lawful business transfer. Some recipients are independent controllers of information they process for their own purposes.
06. Our Website and Technology Providers
Our online store is hosted by Shopify. Shopify processes information about your visits, shopping activity, transactions and use of its services. Depending on the activity, Shopify processes information on our behalf or for purposes for which it is independently responsible. Shopify Network Intelligence is enabled for our store. This allows Shopify to use information from interactions with Abbey Essentials, together with interactions with Shopify and other merchants, to provide enhanced services. These can include improving store services and personalisation, analysing performance and improving the relevance or measurement of advertising, subject to applicable privacy choices and legal requirements. Customers can manage optional tracking through our Shopify cookie preferences. Shopify also provides controls for limiting certain advertising uses of information. Where applicable, consent choices and relevant opt-outs are respected in Shopify Network Intelligence. Other merchants cannot directly access our customer information through this feature. For further information, read the Shopify Consumer Privacy Policy. The Shopify Privacy Portal allows customers to request access to or erasure of information Shopify holds and limit certain advertising uses. For requests concerning information controlled by Abbey Essentials, use our Contact Us page.
07. Cookies, analytics and advertising
Cookies and similar technologies are used to operate the website and, where permitted, to understand or measure how customers use it.
Essential technologies support the basket, checkout, security and remembering privacy choices. They are used where an applicable legal exception permits this without consent.
Analytics technologies help assess website usage and performance. Optional analytics ordinarily require consent unless a specific legal exception applies, such as the narrowly defined statistical-purpose exception with the required notice and objection option.
Advertising technologies may measure advertising performance or help show relevant advertising. Technologies used for non-essential advertising tracking normally require consent before being used on your device.
Our store uses Shopify's cookie banner and its standard privacy preferences controls. Where the banner appears, you can accept or reject optional tracking. You can review or change your selection using the Cookie preferences link in the website's policy or footer area. Your browser may provide additional controls, but some essential site functions need cookies to work.
We use Shopify-connected services including Facebook & Instagram, Google & YouTube, Microsoft Channel, Pinterest and Judge.me Reviews. Their actual processing depends on the features in use, the information involved and applicable privacy choices. We do not assume every service uses advertising cookies in every situation.
08. Marketing communications
Customers can choose to subscribe to marketing when signing up or during checkout. We may send promotional messages where we have appropriate consent or where the existing-customer soft opt-in is available under the UK electronic marketing rules.
The soft opt-in applies only where we obtained contact details directly during a sale or discussion of a sale, the messages concern our own similar products, and a simple opt-out was offered when the details were collected and in every subsequent message.
You can unsubscribe at any time using the link in a marketing message or by using our Contact Us page. We will stop processing your personal information for direct marketing if you object. We may retain a limited record of that preference so we can respect it. We may still send necessary transactional messages about orders, delivery, returns or account security.
09. International transfers
Personal information may be processed outside the UK through Shopify and other service providers, or shared with overseas delivery and customs organisations to complete international orders.
Where UK law restricts a transfer, an appropriate lawful arrangement is needed, such as an applicable UK adequacy regulation or a recognised contractual safeguard. The mechanism depends on the recipient and the transfer. You can contact us for further information about transfers relevant to your data.
10. How long we keep information
We retain personal information for as long as reasonably needed for orders, customer support, legal obligations, security and disputes.
Order and accounting records are retained for applicable tax and record-keeping periods. Customer accounts are retained while they remain relevant to the services used and any associated legal obligations. Customer service and delivery correspondence is retained for as long as needed to resolve enquiries or claims. Marketing preferences may be retained to respect unsubscribes and objections. Technical and analytics information is kept according to its purpose and the retention settings of the relevant services.
Personal information should not be retained longer than necessary, subject to legal requirements and the operation of service-provider systems.
11. Security
We take reasonable measures to protect personal information and use established providers for online-store and payment functions. No online system or method of transmission is entirely risk-free.
Please avoid sending complete payment-card details or other unnecessary sensitive information through our contact form.
12. Your privacy rights
Subject to the conditions and exceptions under applicable data protection law, you may have rights to:
Access the personal information we hold about you.
Correct inaccurate information.
Request erasure in appropriate circumstances.
Restrict or object to processing in certain circumstances, including processing based on legitimate interests.
Receive or transfer certain information under the right to data portability.
Withdraw consent where consent is the legal basis.
Object to direct marketing at any time, without charge.
We use automated fraud-risk checks and may automatically decline high-risk orders. If you believe such a decision is incorrect, contact us to request that it be reviewed. Where a solely automated decision has a legal or similarly significant effect, the law provides safeguards including information about the decision, the opportunity to make representations, to obtain human intervention and to contest the outcome.
Use our Contact Us page for privacy requests. We may request reasonable identity verification. We normally respond within one month, subject to permitted extensions or pauses. We will explain where an exemption applies. Requests are normally free of charge.
13. Children's privacy
Our website is not directed at children. We do not knowingly seek children's personal information where parental authorisation is required. If you believe a child has supplied personal information inappropriately, please contact us.
14. Complaints
If you believe we have handled your personal information improperly, you may make a data protection complaint through our Contact Us page or write to our registered office. Please include enough information for us to identify and investigate the concern.
Under the Data Protection Act 2018 as amended, we must acknowledge a data protection complaint within 30 days of receiving it, take appropriate steps to investigate, keep you informed of progress where appropriate and communicate the outcome without undue delay. The 30-day requirement relates to acknowledgement, not necessarily completion of the investigation.
You may also raise concerns with the ICO, the UK's data protection regulator. You do not lose your right to contact the ICO by raising a complaint with us first.
15. Changes to this policy
We may update this policy to reflect changes to our services, providers, legal duties or use of personal information. We will give additional notice where the law requires it.
16. Contact
For privacy questions, access or erasure requests, objections to marketing or data protection complaints, please use our Contact Us page.