Who we are
This website is operated by Marlene Mash. You can reach us at marlenemash43@gmail.com or through our Contact page.
We are the controller of the personal data described in this policy, which means we are responsible for deciding how and why it is used.
If you are in Uganda, we also handle your personal data in line with Uganda's Data Protection and Privacy Act, 2019.
If you have any questions about this policy or your personal data, contact us at marlenemash43@gmail.com.
The information we collect
We collect the following personal data when you browse our website, place an order, create an account, join our mailing list or contact us:
- Identity and contact data: your name, billing and delivery addresses, email address and phone number.
- Order data: the items you buy, sizes, colourways, order value, delivery choices and exchanges.
- Payment data: payments are handled securely by Pesapal, our payment partner. We never see or store your full card number. For mobile money payments, we receive the mobile number used and the payment status.
- Account data: your login details, saved items and preferences.
- Communications: messages you send us, including fit or styling enquiries and complaints.
- Marketing preferences: whether you have opted in to marketing emails and how you engage with them.
- Technical data: IP address, device and browser type, and how you use our site, collected through cookies and similar technologies (see section 4).
We don't knowingly collect special category data, such as health information. Please don't send it to us.
How we use your data and our lawful bases
Under UK GDPR, we must have a lawful basis for each way we use your personal data:
| Purpose | Lawful basis |
|---|---|
| Processing and delivering your order, including passing your details to our delivery partners (DHL or FedEx) | Performance of a contract |
| Handling exchanges, store credit and customer service enquiries | Performance of a contract; legal obligation |
| Sending service emails (order confirmations, dispatch and tracking updates) | Performance of a contract |
| Sending marketing emails about new collections, offers and events | Consent, or for existing customers, our legitimate interests under the "soft opt-in" in the Privacy and Electronic Communications Regulations (PECR). You can opt out at any time. |
| Preventing fraud and keeping our website secure | Legitimate interests; legal obligation |
| Keeping accounting and tax records | Legal obligation |
| Improving our website, products and services through analytics | Consent (for non-essential cookies); legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. Where we rely on consent, you may withdraw it at any time. Withdrawing consent doesn't affect anything we did lawfully before you withdrew it.
International transfers
Some of our service providers, including our carriers for international deliveries, may process your data outside the UK. When this happens, we make sure appropriate safeguards are in place. These include UK adequacy regulations, the International Data Transfer Agreement (IDTA), and the UK Addendum to the EU Standard Contractual Clauses.
How long we keep your data
- Order and transaction records: six years from the end of the financial year they relate to, to meet HMRC and accounting requirements.
- Account data: for as long as your account is open, then for no longer than necessary after closure.
- Marketing data: until you unsubscribe. After that, we keep your email on a suppression list so we don't contact you again.
- Customer service records: up to two years after your last contact with us, unless we need them for longer to deal with a claim.
Keeping your data secure
We use appropriate technical and organisational measures to protect your personal data, including encrypted (HTTPS) connections, restricted access, and PCI DSS-compliant payment processing. If there's ever a personal data breach that is likely to put your rights at risk, we will tell you and the ICO where the law requires it.
Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Rectification: ask us to correct inaccurate or incomplete data
- Erasure: ask us to delete your data in certain circumstances
- Restriction: ask us to limit how we use your data
- Data portability: receive your data in a portable format
- Object to processing based on legitimate interests, and to direct marketing at any time
- Withdraw consent at any time, where we rely on consent
To use any of these rights, email marlenemash43@gmail.com. Exercising your rights is usually free, and we will respond within one month. We may need to confirm your identity first.
Complaints
If you have a concern, please contact us first and we'll do our best to put things right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or write to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Children
Our website is not intended for children and we don't knowingly collect data from anyone under 16. You must be 18 or over to place an order.
Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated shown at the top.
