Privacy policy

Last updated 17 August 2026

Who we are

Glow Theory is the data controller for personal data collected through this website. You can contact us about anything on this page at hello@glowtheory-skincare.co.uk.

This policy is written to meet the UK GDPR and the Data Protection Act 2018.

What we collect

When you buy	Name, delivery address, billing address, email address, phone number if you give one, and the details of what you ordered.
Payment	Handled by our payment provider. We receive confirmation that payment succeeded, the last four digits of the card and the card type. We never see or store your full card number.
When you contact us	Your name, email address and whatever you put in your message.
When you browse	If you consent to analytics cookies: pages visited, approximate location from your IP address, device and browser type, and how you arrived at the site. Without consent, none of this is collected.
Server logs	Our hosting provider records IP addresses and request details for security and troubleshooting. These are kept for a short period and are not used to profile you.

Why we use it, and our lawful basis

To take and fulfil your order	Performance of a contract
To answer your questions	Legitimate interests — running a shop people can talk to
To keep tax and accounting records	Legal obligation
To protect the site from abuse	Legitimate interests — security
Marketing emails	Consent, which you can withdraw at any time
Analytics and advertising cookies	Consent, given through the cookie banner

Who we share it with

We share the minimum necessary with the suppliers who make the shop work:

• Payment processing — to take your payment and handle refunds.
• Fulfilment and delivery — your name and delivery address go to whoever packs and carries the parcel.
• Hosting — this site runs on third-party servers.
• Email — for order confirmations and, if you have opted in, marketing.
• Analytics and advertising — only if you consent to those cookies.

We do not sell your personal data. We will disclose data if we are legally required to.

Sending data outside the UK

Some of our suppliers process data outside the United Kingdom. Where that happens we rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum, so your data keeps essentially the same protection it has here.

How long we keep it

• Order and transaction records: six years after the end of the tax year they relate to, because HMRC requires it.
• Customer service emails: three years.
• Marketing consent records: until you unsubscribe, and then a suppression record so we do not email you again by mistake.
• Analytics data: no longer than 14 months.

Your rights

Under UK data protection law you have the right to: be told how your data is used; get a copy of it; have inaccurate data corrected; have data erased in some circumstances; restrict or object to processing; receive your data in a portable format; and withdraw consent at any time without affecting processing already carried out.

To exercise any of these, email hello@glowtheory-skincare.co.uk. We will respond within one month. There is no charge.

If you are not happy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would rather you came to us first.

Children

This shop is not intended for under-18s and we do not knowingly collect data from children.

Automated decisions

We do not make any decision about you by automated means that produces a legal or similarly significant effect.

Changes

If we change this policy we will update the date at the top of the page. If the change is significant we will tell customers by email.