PRIVACY POLICY

CIROA BEAUTY UK

Privacy Policy

1. Who We Are

Jamesly Ltd (company number 16517492) trades as Ciroa Beauty UK. We are registered in England and Wales with our registered office at C/O Paul Beare Ltd, 100 Bollo Lane, London, W4 5LX.

In this Privacy Policy, “we”, “us” and “our” refers to Jamesly Ltd trading as Ciroa Beauty UK.

We are the data controller for the personal data collected through our website ciroabeauty.co.uk and related services. This means we are responsible for deciding how your personal data is collected, held and used.

We are committed to protecting your personal data and processing it in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and applicable privacy and electronic communications laws.

2. Personal Data We Collect

We may collect and process the following categories of personal data about you:

•       Identity Data: your name and age.

•       Contact Data: your postal address, email address and telephone number.

•       Financial Data: payment card details, processed securely by our third-party payment processor. We do not store full card details.

•       Transaction Data: details about your purchases, payments, order history, shipping information and returns.

•       Technical & Usage Data: your IP address, browser type and version, location data, operating system, device information, pages visited, time spent on pages, products viewed, links clicked, cart activity, purchase activity, session activity, how you arrived at our website, interactions with our emails, SMS messages and advertisements, and information collected through cookies, pixels and similar tracking technologies.

•       Marketing & Communications Data: your preferences for receiving marketing from us and your communication preferences.

•       Marketing, Advertising & Tracking Data: information about your marketing preferences, email and SMS engagement, advertising interactions, customer segments, browsing behaviour, purchase history, abandoned cart activity, product preferences and interactions with our marketing campaigns.

•       Account Data: your username and password if you create an account with us.

Sensitive Personal Data

We do not intentionally collect sensitive personal data, which includes information about racial or ethnic origin, political opinions, religious beliefs, health, biometric data or sexual orientation. If we ever need to collect such data, we will seek your explicit consent first.

3. How We Collect Your Personal Data

We collect personal data through the following means:

•       Directly from you, when you place an order, create an account, subscribe to our newsletter, enter a competition or contact us.

•       Automatically, as you interact with our website, through cookies, pixels and similar tracking technologies.

•       From third parties, such as payment processors, analytics providers, social media platforms, advertising partners, ecommerce platforms and marketing platforms.

•       From publicly available sources.

4. Legal Bases for Processing Your Personal Data

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following:

•       Contract (Article 6(1)(b)): where processing is necessary to fulfil your order, manage your account, provide after-sale support or otherwise perform a contract with you.

•       Legitimate Interests (Article 6(1)(f)): where processing is necessary for our legitimate interests, such as fraud prevention, improving our services, running our business, understanding customer behaviour, and marketing to existing customers, where these interests are not overridden by your rights.

•       Consent (Article 6(1)(a)): where you have given clear consent, for example to receive certain marketing communications, or to place non-essential cookies and similar tracking technologies on your device.

•       Legal Obligation (Article 6(1)(c)): where processing is necessary to comply with a legal or regulatory obligation, such as maintaining accounting records.

5. How We Use Your Personal Data

We use your personal data for the following purposes:

•       To process and fulfil your orders and arrange delivery.

•       To manage your customer account.

•       To respond to your enquiries, complaints or support requests.

•       To send you transactional communications, such as order confirmations and shipping notifications.

•       To send you marketing communications where you have consented, where the soft opt-in applies, or where otherwise permitted by law. You can opt out at any time.

•       To personalise your website experience, product recommendations, offers and marketing communications.

•       To measure the performance of our email, SMS, advertising and marketing campaigns.

•       To create customer segments and audiences for marketing, retargeting, analytics and advertising purposes.

•       To understand how customers use our website, including through heatmaps, session recordings, click tracking and website behaviour analytics.

•       To carry out analytics and improve our website, products and services.

•       To run promotions, competitions and loyalty programmes.

•       To detect and prevent fraud, abuse, security issues and technical issues.

•       To support internal business operations using artificial intelligence, automation and similar tools, including customer service, marketing, analytics, reporting, website optimisation, product recommendations and internal administration.

•       To comply with our legal and regulatory obligations.

6. Who We Share Your Personal Data With

We may share your personal data with trusted third parties in the following circumstances:

•       IT and hosting providers: companies that provide our website infrastructure, data storage and technical services.

•       Payment processors: such as Shopify Payments, Clearpay or other payment providers, who process payments securely on our behalf.

•       Delivery and logistics providers: couriers and fulfilment services used to deliver your orders.

•       Marketing, advertising and CRM providers: including Klaviyo and other email, SMS, CRM and marketing automation platforms used to send marketing communications, manage customer segments, analyse campaign performance and track email, SMS and website engagement.

•       Analytics and behaviour analytics providers: including Google Analytics, Microsoft Clarity, Hotjar and similar tools used to understand website performance, visitor behaviour, heatmaps, clicks, scrolling, session recordings and customer experience.

•       Advertising platforms and pixels: including Google Ads, Meta, TikTok, Microsoft Advertising and similar platforms used for advertising, retargeting, conversion tracking, audience matching and campaign measurement.

•       Ecommerce and website platforms: including Shopify and related apps or service providers used for website hosting, checkout, order management, analytics, fraud prevention and ecommerce functionality.

•       Professional advisers: including solicitors, accountants, auditors and insurers.

•       Business transfers: if we sell or transfer all or part of our business, your personal data may be transferred to the buyer.

•       Regulatory and law enforcement bodies: where required by law, court order or to protect our legal rights.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not sell your personal data to third parties.

7. International Transfers of Personal Data

Some of our third-party service providers are based outside the UK. When we transfer your personal data outside the UK, we ensure that appropriate safeguards are in place in accordance with UK GDPR, including:

•       Transfers to countries with UK adequacy regulations in place.

•       Use of the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs).

•       Other legally recognised transfer mechanisms.

You may contact us for more information about the specific safeguards we use.

8. How Long We Keep Your Personal Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting or reporting requirements.

•       Order and transaction records: 6 years from the date of the transaction to comply with tax and accounting laws.

•       Customer account data: until you close your account, or after 3 years of inactivity, whichever comes first.

•       Marketing preferences: until you unsubscribe or withdraw consent.

•       Technical and usage data: up to 26 months, unless a shorter or longer retention period is required for security, legal or operational reasons.

When it is no longer necessary to retain your personal data, we will securely delete or anonymise it.

9. Cookies and Similar Tracking Technologies

Our website uses cookies and similar tracking technologies. Cookies are small text files stored on your device. Similar technologies may include pixels, tags, scripts, SDKs, APIs, local storage and device identifiers.

We use the following types of cookies and similar technologies:

•       Strictly necessary cookies: required for the website to function, including checkout, cart, account login, security and fraud prevention. These cannot be disabled through our cookie preference tool.

•       Analytics cookies: used to understand how visitors use our website and to improve website performance and customer experience.

•       Behaviour analytics tools: used to understand website behaviour, including heatmaps, click tracking, scroll tracking and session recordings.

•       Marketing and targeting cookies: used to measure advertising performance, build audiences, retarget visitors and show relevant advertising on our website, search engines, social media platforms and other websites.

•       Functional cookies: used to remember your preferences, such as country, region, language or other website settings.

We may use third party tools for these purposes, including Klaviyo, Microsoft Clarity, Hotjar, Google Analytics, Google Ads, Meta, TikTok, Microsoft Advertising, Shopify and other advertising, analytics, ecommerce and marketing platforms.

When you first visit our website, we will ask for your consent before placing non-essential cookies or using similar non-essential tracking technologies. This includes analytics cookies, advertising cookies, retargeting pixels, heatmaps and session recording tools.

You can change your cookie preferences at any time through our cookie settings or by adjusting your browser settings. Disabling certain cookies may affect the functionality of our website.

To opt out of Google Analytics tracking, you can use the Google Analytics Opt-out Browser Add-on available from Google.

10. Artificial Intelligence and Automation

We may use artificial intelligence, automation and similar tools to support our business operations. This may include customer service, marketing, analytics, reporting, website optimisation, product recommendations, content generation and internal administration.

Where these tools process personal data, we use them in accordance with this Privacy Policy and applicable data protection laws.

We do not use artificial intelligence or automated tools to make decisions that have a legal or similarly significant effect on you without human involvement, unless we notify you or are otherwise permitted by law.

11. Your Rights Under UK GDPR

Under UK GDPR, you have the following rights in relation to your personal data:

•       Right of access: you may request a copy of the personal data we hold about you, also known as a Subject Access Request.

•       Right to rectification: you may ask us to correct inaccurate or incomplete personal data.

•       Right to erasure: you may ask us to delete your personal data in certain circumstances, also known as the “right to be forgotten”.

•       Right to restriction of processing: you may ask us to restrict how we process your data in certain circumstances.

•       Right to data portability: you may request that we transfer your personal data to you or another service provider in a structured, commonly used format.

•       Right to object: you may object to our processing of your personal data based on our legitimate interests, or for direct marketing purposes.

•       Rights related to automated decision-making: you have the right not to be subject to solely automated decisions that significantly affect you.

•       Right to withdraw consent: where processing is based on your consent, you may withdraw that consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us using the details in Section 13. We will respond within one month of receiving your request. We may need to verify your identity before processing your request.

You will not normally be charged a fee for exercising your rights, unless your request is clearly unfounded or excessive.

12. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration or disclosure. These include SSL/TLS encryption on our website, restricted access to personal data, and regular security reviews.

Where we use third-party processors, we ensure they maintain adequate security standards. However, please be aware that no method of transmitting data over the internet is completely secure, and we cannot guarantee the absolute security of data transmitted to or from our website.

13. How to Contact Us

If you have any questions about this Privacy Policy, wish to exercise your rights, or have a concern about how we handle your personal data, please contact us:

Jamesly Ltd trading as Ciroa Beauty UK

Company number: 16517492

Registered office: C/O Paul Beare Ltd, 100 Bollo Lane, London, W4 5LX

Email: hello@ciroabeauty.co.uk

Website: ciroabeauty.co.uk

14. Right to Complain to the ICO

You have the right to make a complaint to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), if you believe we have not handled your personal data in accordance with data protection law.

We would, however, appreciate the opportunity to address your concerns before you contact the ICO, so please contact us first.

ICO website: www.ico.org.uk  |  ICO helpline: 0303 123 1113

© 2026 Jamesly Ltd trading as Ciroa Beauty UK. All rights reserved.