Legal

Privacy Policy

Last updated: 29 August 2026

This policy explains how Skin Hobbies Ltd (“we”, “us”, “our”) collects, uses and protects your personal data when you use skinhobbies.co.uk or contact us. We are committed to handling your information responsibly and in line with UK data protection law (the UK GDPR and the Data Protection Act 2018).

1. Who we are

Skin Hobbies Ltd is the “data controller” responsible for your personal data.

2. The information we collect

We collect the following information:

• Enquiry details you give us — when you use our enquiry form or email us: your name, business or company name, email address, phone number (if provided), the product you are enquiring about, and the content of your message.
• Account details — if you create an account: your name, email address, phone number, delivery and billing addresses, and your marketing preferences.
• Order details — what you ordered, when, the amount paid and the delivery address. We never see or store your card details; payments are handled entirely by Stripe on their own secure pages.
• Trade account details — if you apply for a wholesale account: your company name, company registration and VAT numbers, business type and business address.
• Reviews — if you review a product, your review and the first name and last initial shown beside it.
• Assistant conversations — questions you ask our website assistant, so we can improve our product information.
• Technical data — automatically collected by our hosting and security providers, such as your IP address, browser type and pages visited, held in server logs for security and performance.

We do not knowingly collect data from anyone under 16, and we do not collect special-category data. Please do not send us details of a medical condition — we cannot advise on one, and we would rather not hold it.

3. How and why we use your data

• To respond to your enquiry and provide trade or wholesale information and quotes — lawful basis: our legitimate interests in dealing with enquiries, and taking steps at your request before entering into a contract.
• To take payment and fulfil your order, and to send you order confirmations and delivery updates — lawful basis: performance of a contract.
• To manage your account and any trade account — lawful basis: performance of a contract, and legitimate interests.
• To send you marketing emails, only if you have asked us to — lawful basis: consent. Every marketing email contains an unsubscribe link, and unsubscribing takes effect immediately.
• To keep our website secure and working, including spam protection on our forms — lawful basis: legitimate interests.
• To meet legal and accounting obligations — lawful basis: legal obligation.

We do not use your data for automated decision-making, and we do not sell your personal data.

4. Who we share it with

We share data only with trusted providers who help us run our business, and only as needed:

• Microsoft Azure — website hosting, database and file storage (United Kingdom).
• Stripe — card payment processing. Stripe receives your name, email and order amount directly; we never receive your card number.
• DreamHost — email hosting.
• Cloudflare — content delivery and security (DDoS and bot protection).
• Google — reCAPTCHA spam protection on our forms, and “Sign in with Google” if you choose to use it.
• Microsoft (Azure OpenAI) — powers our website assistant. Your question is sent to be answered; it is not used to train their models.
• Professional advisers (such as accountants) and authorities where required by law.

These providers act on our instructions and are bound to protect your data. Some may process data outside the UK; where they do, appropriate safeguards (such as UK or EU-approved contractual clauses) are in place.

5. How long we keep it

We keep enquiry correspondence for up to 24 months after our last contact with you, unless we are in an ongoing business relationship. Order, invoice and tax records are kept for at least 6 years to meet legal and accounting requirements. Account details are kept while your account is open. Server logs are kept for a short period for security purposes.

6. Your rights

Under UK data protection law you have the right to:

• access a copy of the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to delete your data (where there is no overriding reason to keep it);
• restrict or object to our processing of your data;
• request a portable copy of data you provided to us; and
• withdraw consent at any time, where we rely on consent.

To exercise any of these rights, email us at Email us. We will respond within one month.

7. Complaints

If you have a concern, please contact us first so we can help. You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk or on 0303 123 1113.

8. Cookies

Our website uses a small amount of functional browser storage and provider security cookies. Please see our Cookie Policy for details.

9. Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with a revised “last updated” date.

10. Contact us

For any questions about this policy or your data, email Email us or write to the address above.