Privacy notice
What we collect, why we are allowed to, how long we keep it, and how to make us stop.
1. Who controls your data
Crimson Luis Ltd is the data controller for personal data collected through crimsonluis.co.uk. We are registered in England and Wales, company number [COMPANY NUMBER], registered office [REGISTERED ADDRESS], and our ICO registration number is [ICO REGISTRATION NUMBER].
Data protection enquiries: privacy@crimsonluis.co.uk.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, email, telephone, delivery and billing address | You, when you order or contact us |
| Order data | Items bought, sizes, order value, order history, correspondence | Generated when you buy |
| Payment data | Last four digits and card type only | Our payment provider — we never see the full card number |
| Fit data (optional) | Measurements you send us for sizing or made-to-order | You, voluntarily |
| Technical data | IP address, browser type, device, pages viewed | Automatically, via cookies and server logs |
| Marketing preferences | Whether you have opted in, and what you have opened | You, and our email provider |
We do not knowingly collect data from children under 16, and we do not sell personal data.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Taking and fulfilling your order, delivery, returns and refunds | Performance of a contract |
| Answering enquiries and providing client care | Performance of a contract, or our legitimate interests in running the business |
| Keeping accounting, VAT and tax records | Legal obligation |
| Fraud prevention and site security | Legitimate interests in protecting the business and our customers |
| Marketing emails to existing customers about similar goods | Legitimate interests, under the soft opt-in in PECR, with an unsubscribe in every message |
| Marketing emails to anyone else | Consent |
| Analytics cookies | Consent |
Where we rely on legitimate interests, we have assessed that our interest does not override your rights. You may object at any time — see section 6.
4. Who we share it with
- Our payment provider, to take payment securely.
- Our delivery carriers, to get your order to you.
- Our website host and email provider, who process data on our instructions.
- Our accountants and, where legally required, HMRC or other authorities.
Each processor is bound by a written contract requiring them to keep your data secure and to use it only as we instruct. We do not share your data for anyone else's marketing.
5. Storage and international transfers
We store data in the UK and the European Economic Area wherever possible. Where a provider processes data outside the UK, we rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum, together with appropriate technical safeguards.
Retention: order and accounting records are kept for six years after the end of the tax year in which the order was placed, as required by HMRC. Enquiries that do not lead to an order are deleted after 24 months. Marketing data is kept until you unsubscribe, and your unsubscribe request is kept indefinitely so that we do not contact you again.
6. Your rights
Under the UK GDPR you have the right to:
- be told how your data is used, and to request a copy of it;
- have inaccurate data corrected;
- have data erased, where we no longer need it and no legal duty requires us to keep it;
- restrict or object to processing, including objecting to direct marketing at any time;
- data portability, where processing is based on consent or contract and is automated;
- withdraw consent at any time, without affecting processing already carried out.
To exercise any of these, email privacy@crimsonluis.co.uk. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
7. Complaints
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
8. Security
The site is served over HTTPS. Access to personal data is limited to people who need it, protected by individual accounts and multi-factor authentication. We keep a record of processing activities and will notify the ICO of any reportable breach within 72 hours, and you directly where the breach is likely to result in a high risk to your rights.
9. Cookies
Cookies are covered separately in our cookie notice.
10. Changes
We will post any change to this notice on this page and update the date at the top. Where a change is significant we will tell customers by email.