Privacy Policy

1. What We Collect

Information you give us

When you register, place an order, leave a review, or contact us, we collect:

• Name and email address
• Shipping address
• Payment details (processed securely by Stripe -- we never store your full card number)
• Phone number (optional, for delivery notifications)

Information collected automatically

When you browse our site we may collect your IP address, browser type, device info, pages visited, and referring website.

2. How We Use It

• Fulfil your orders -- process payments, ship products, send confirmations. Your shipping address is processed to deliver your order.
  Lawful basis: Contract (GDPR Article 6(1)(b)) -- necessary to fulfil your order.
• Run your account -- manage registration and login.
  Lawful basis: Contract.
• Send you our newsletter -- new arrivals, styling tips, and exclusive offers. We collect your email address when you sign up. You will receive a verification email (double opt-in) before your subscription is active. Every email includes an unsubscribe link. We use Resend as our email delivery service to send these emails.
  Lawful basis: Consent (GDPR Article 6(1)(a)). You can withdraw consent at any time by clicking the unsubscribe link in any email.
• Improve our site -- track errors via Sentry (only with your consent).
  Lawful basis: Consent.
• Meet legal obligations -- tax records, fraud prevention.
  Lawful basis: Legal obligation.
• Abandoned cart reminders -- we may send you reminder emails if you leave items in your shopping cart without completing your purchase. This processing is based on our legitimate interest in recovering abandoned orders. You can opt out of these reminders by contacting us at [email protected].
  Lawful basis: Legitimate interest (GDPR Article 6(1)(f)).

3. Who We Share It With

We share data only with service providers who help us run the business:

• Stripe -- payment processing (US)
• Klarna -- buy now, pay later processing (Sweden)
• Clearpay -- buy now, pay later processing (UK)
• Royal Mail / DPD -- delivery (UK)
• Google -- if you sign in with Google (US)
• Cloudinary -- product image hosting (US/Israel)
• Sentry -- error tracking, with your consent (US)
• Resend -- transactional emails (US)

Where providers are based outside the UK, transfers are protected by Standard Contractual Clauses or equivalent safeguards. We never sell or rent your data.

4. Data Security

We use SSL encryption, secure password hashing, and limited access controls to protect your data. No system is 100% secure, but we take reasonable steps to keep your information safe.

5. Your Rights (UK GDPR)

You have the right to access, correct, delete, restrict, port, or object to processing of your data, and to withdraw consent at any time.

You can do some of this yourself from your Profile page:

• Export My Data -- download a copy of your personal data in JSON format
• Delete My Account -- permanently remove your account and anonymise order history

For anything else, email [email protected] and we will respond within one month. If you are not happy with our response, you can complain to the ICO (0303 123 1113).

6. Contact Form Data

When you use our contact form, we collect your name, email address, and message content so we can respond to your enquiry. This data is processed under our legitimate interest in providing customer support and is retained for up to 2 years.

7. Cookies

We use essential cookies to keep your cart and login session working. We also use analytics cookies (Sentry) with your explicit consent via our cookie banner. You can change your preferences any time using the "Cookie Settings" link in the footer.

8. Data Retention

• Account data: kept until you delete your account
• Order history: 7 years (HMRC tax and legal requirements)
• Contact form enquiries: 2 years
• Abandoned carts: deleted after 30 days
• Newsletter subscription: your email address is retained until you unsubscribe

9. Children

Our site is not intended for anyone under 16. If you believe we have collected data from a child, please contact us immediately.

10. Changes and Contact

We may update this policy from time to time. Changes will be posted here with an updated date.

The data controller for your information is:

• Itunu Daniel trading as Hytee Hairven
• Address: Waterloo Terrace Main Road, Ashford, TN25
• Email: [email protected]
• ICO Registration: C1885382