Privacy Policy

Last Updated: October 2026

Welcome to Pretty Potions. We are committed to respecting and protecting your privacy. This Privacy Policy outlines how we collect, use, store, and protect your personal data when you visit our website, create an account, purchase our handcrafted bathing and personal hygiene cosmetic products, or contact us.

We process all personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), and relevant cosmetic safety regulations.

1. Who We Are (Data Controller)

Pretty Potions is the data controller responsible for your personal information.

• Business Name: Pretty Potions

• Trading Address: Address TBC

• Email Contact: privacy@prettypotions.co.uk / hello@prettypotions.co.uk

• Website: [https://www.prettypotions.co.uk]

If you have questions about this policy or wish to exercise any of your data rights, please contact us using the details above.

2. The Information We Collect

We only collect data necessary to provide you with our products and customer care. The types of personal data we collect include:

• Identity & Contact Details: First and last name, billing address, shipping address, email address, and contact telephone number.

• Order & Transaction Data: Products purchased, order amounts, fulfillment and dispatch logs, and product batch numbers assigned to your order.

  Note: We never process, store, or view your full debit/credit card details on our servers. All payments are handled directly by PCI-DSS compliant payment gateways (such as Stripe or PayPal).

• Technical & Usage Data: IP address, browser type and version, device identifier, time zone, and session browsing activity captured via our secure server logs and Odoo sessions.

• Customer Support & Regulatory Inquiries: Records of any correspondence with us, customer reviews, or voluntary health/sensitivity information you disclose when reporting an adverse reaction or asking about product ingredients.

• Marketing Preferences: Your preferences regarding receiving email newsletters and product updates.

3. How and Why We Use Your Personal Data

Under UK data protection law, we must have a lawful basis for processing your data. We rely on the following bases:

4. Cosmetic Safety & Adverse Reaction Reporting

As a manufacturer and retailer of bath, body, and personal hygiene cosmetics:

• Batch Traceability: We record the specific batch numbers associated with each order to ensure swift action in the unlikely event of a product recall or quality audit.

• Cosmetovigilance: If you contact us regarding a skin irritation, allergy, or adverse reaction, we will document the product, batch number, date, and reported reaction. This data is processed strictly to assess product safety, uphold our obligations under UK cosmetics safety legislation, and provide clinical or safety advice where appropriate.

5. Who We Share Your Data With

We never sell, rent, or trade your personal information. We only share necessary data with trusted third parties who support our business operations:

• Delivery Couriers: Parcel delivery providers (e.g., Royal Mail, DPD, Evri) to fulfill and deliver your orders.

• Payment Gateways: Encrypted third-party payment providers (e.g., Stripe, PayPal) to process card transactions safely.

• Hosting & Technical Infrastructure: Our web server hosting providers, content delivery networks (CDNs) and firewall layers (such as Cloudflare), and automated backup storage.

• Transactional & Communication Services: Providers supporting order confirmations, dispatch notifications, and opt-in newsletters.

• Regulatory Authorities: Public bodies (such as the Office for Product Safety and Standards or HMRC) if legally required.

All third-party processors are contractually required to maintain appropriate security measures and process data solely under our instructions.

6. Cookies & Tracking Technologies

Our website uses cookies and similar technologies to function properly and enhance your user experience:

• Essential Cookies: Necessary for the technical operation of the website, including managing your shopping basket, login sessions, and checkout workflows. These cannot be switched off.

• Analytical & Functional Cookies: Used only with your explicit permission to analyze traffic and visitor behavior to improve website layout.

You can modify your preferences at any time via the cookie settings banner located at the bottom of our site or through your browser settings.

7. International Data Transfers

When our technical service providers (such as cloud hosting, CDN, or backup infrastructure) store data outside the United Kingdom or European Economic Area (EEA), we verify that appropriate transfer safeguards are implemented—such as the UK International Data Transfer Agreement (IDTA), standard contractual clauses, or an adequacy decision.

8. Data Retention

We retain your personal data only as long as necessary to fulfill the purposes for which it was collected:

• Order & Financial Records: Retained for 6 years following the end of the relevant tax year to comply with HMRC statutory requirements.

• Cosmetic Safety & Batch Logs: Retained in alignment with product shelf-life and regulatory cosmetic record-keeping guidelines.

• Marketing Subscribers: Stored until you unsubscribe or withdraw your consent.

• Inactive Accounts: Account profiles inactive for over 3 years are routinely reviewed and safely anonymized or deleted.

9. Your Legal Rights

Under UK data protection law, you hold several rights regarding your personal information:

• Right of Access: Request a copy of the personal data we hold about you (Subject Access Request).

• Right to Rectification: Request correction of any inaccurate or incomplete data. You can also edit your address directly in your Odoo account portal (/my/account).

• Right to Erasure: Request the deletion of your personal data ("right to be forgotten"), provided we are not legally obligated to retain it for tax, legal, or product safety reasons.

• Right to Restrict or Object: Object to processing based on legitimate interests, or request restrictions on processing while a dispute is resolved.

• Right to Withdraw Consent: Unsubscribe from our newsletter at any time by clicking the "Unsubscribe" link in any promotional email.

• Right to Data Portability: Request an electronic copy of data you provided to us in a structured, commonly used format.

To exercise any of these rights, email us at privacy@prettypotions.co.uk. We respond to all legitimate requests within one calendar month.

10. How to Complain

If you have concerns about how we handle your personal data, please contact us first so we can resolve the issue promptly.

You also have the right to lodge a formal complaint with the UK supervisory authority:

• Information Commissioner’s Office (ICO)

• Website: www.ico.org.uk

• Helpline: 0303 123 1113