Privacy policy
Privacy Policy
Glorenna
Last updated: 14 August 2026
This Privacy Policy explains how Glorenna collects, uses, shares and protects your personal data when you visit our website, buy our products, or contact us.
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where we use cookies or send electronic marketing, we also comply with the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).
This policy tells you what we collect, why we collect it, the legal basis on which we rely, how long we keep it, who we share it with, and the rights you have — including your right to complain to the Information Commissioner's Office.
1. Who we are
Glorenna is the data controller for the personal data described in this policy. This means we decide how and why your personal data is processed.
| Trading name | Glorenna |
| Address | 600 Heron Close, Rickmansworth, WD3 1NF, United Kingdom |
| info@glorenna.com | |
| Telephone | +44 7418 604305 |
Customer service hours
Monday to Friday: 8:00am – 5:00pm
Saturday and Sunday: 9:00am – 4:00pm
We aim to respond to all enquiries within 12 hours.
We are not required to appoint a Data Protection Officer. If you have any question about this policy or about how we handle your personal data, please contact us using the details above.
2. Who this policy applies to
This policy applies to:
- Visitors — people who browse our website;
- Customers — people who place an order, request or receive products from us, or open an account;
- Enquirers — people who contact us through our website, by email, by telephone or by any other means;
- Subscribers — people who sign up to receive marketing from us.
3. The personal data we collect
3.1 Information you give us
| Category | Data |
|---|---|
| Identity | Full name; username; account password (stored in encrypted form) |
| Contact | Email address; telephone number; billing address; delivery address |
| Order | Products ordered, order value, order history, delivery preferences |
| Payment | Payment method and the last four digits and expiry date of your card. We do not store your full card number or security code — payment details are collected and processed directly by our payment providers |
| Communications | The content of your emails, messages, enquiries, reviews and any other information you choose to give us |
| Marketing | Your marketing preferences and whether you have consented to receive marketing |
3.2 Information we collect automatically
| Category | Data |
|---|---|
| Technical | IP address, browser type and version, device type and identifiers, operating system, time zone and language settings |
| Usage | Pages viewed, products viewed, time spent on pages, referring website, clicks and navigation paths |
| Cookies | Information collected through cookies and similar technologies — see section 8 |
3.3 Information we receive from others
We may receive information from our payment providers (confirming whether a payment succeeded and the results of fraud checks), from our delivery partners (delivery status), and from analytics and advertising providers where you have consented to those cookies.
3.4 If you do not provide certain data
Some data is necessary for us to perform our contract with you — for example your name, delivery address, email address and payment details. If you do not provide it, we will not be able to accept your order or deliver your products. Other data is optional and you may choose not to give it.
3.5 Special category data and children
We do not seek to collect special category data (such as data revealing health, racial or ethnic origin, religious beliefs, or sexual orientation). Please do not send us such information unless we specifically ask for it.
Our website and products are not directed at children. We do not knowingly collect personal data from anyone under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.
4. Why we use your personal data and our lawful basis
Under the UK GDPR we must have a lawful basis for every use of your personal data. The table below sets out what we do, and why we are allowed to do it.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Process and fulfil your order, take payment, arrange delivery, issue refunds | Identity, Contact, Order, Payment | Performance of a contract with you |
| Create and manage your account | Identity, Contact | Performance of a contract with you |
| Send service messages — order confirmations, dispatch and delivery notifications, and messages about problems with your order | Identity, Contact, Order | Performance of a contract with you |
| Respond to your enquiries, complaints and requests, and provide customer service | Identity, Contact, Communications | Performance of a contract, or our legitimate interests in responding to people who contact us |
| Handle returns, cancellations and consumer law claims | Identity, Contact, Order | Performance of a contract, and legal obligation under consumer protection law |
| Keep accounting, tax and transaction records | Identity, Contact, Order, Payment | Legal obligation (HMRC and company record-keeping requirements) |
| Prevent, detect and investigate fraud and misuse of our website | Identity, Contact, Payment, Technical | Legitimate interests in protecting our business and our customers from fraud, and legal obligation where applicable |
| Keep our website and systems secure and available | Technical, Usage | Legitimate interests in maintaining the security and integrity of our systems |
| Analyse how our website is used and compile usage statistics | Technical, Usage, Cookies | Consent (where analytics cookies are used) |
| Improve our website, products and service based on feedback and usage | Usage, Communications, Order | Legitimate interests in improving what we offer |
| Personalise your experience and show you relevant content | Usage, Cookies, Order | Consent (where this relies on non-essential cookies) |
| Send you marketing emails about our products | Identity, Contact, Marketing | Consent, or our legitimate interests where you are an existing customer and we rely on the PECR "soft opt-in" (see section 9) |
| Establish, exercise or defend legal claims; comply with requests from regulators, courts and law enforcement | Any relevant data | Legal obligation, or legitimate interests in protecting our legal position |
| Transfer of our business — a merger, sale, restructuring or acquisition | Any relevant data | Legitimate interests in the orderly transfer of our business |
4.1 Our legitimate interests
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms, and concluded that they are not. You have the right to object to processing based on legitimate interests — see section 10.
4.2 Changing the purpose
We will only use your personal data for the purposes set out above, unless we reasonably consider that we need to use it for another purpose compatible with the original purpose, or you consent, or we are required or permitted by law to do so.
4.3 Automated decision-making
We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. Our payment providers may run automated fraud checks on transactions; if a payment is declined on that basis you can contact us and we will look into it.
5. Who we share your personal data with
We share personal data only where we have a lawful reason to do so. We do not sell your personal data.
5.1 Service providers acting on our behalf (processors)
| Provider | Purpose |
|---|---|
| Shopify Inc. and its affiliates | Hosting our website, processing orders and storing customer data |
| PayPal and other payment providers | Processing payments and carrying out fraud checks |
| Suppliers and fulfilment partners | Manufacturing and dispatching your order |
| Delivery and courier companies | Delivering your order and handling customs formalities |
| Email and marketing platforms | Sending service messages and, where you have consented, marketing |
| Analytics providers | Measuring how our website is used, where you have consented to analytics cookies |
| IT, cloud and technical support providers | Hosting, maintenance, backup and support |
These providers act on our instructions under a written contract that meets the requirements of Article 28 UK GDPR. They may only use your data for the purposes we specify.
5.2 Others we may share data with
- Our professional advisers — lawyers, accountants, auditors and insurers — where they need it to advise us;
- Regulators, courts, law enforcement and government authorities, where we are required by law to disclose it or where disclosure is necessary to protect our rights or the safety of others;
- A buyer or prospective buyer of our business or assets, in connection with a merger, sale, restructuring or acquisition. If our business changes hands, your data will continue to be protected in accordance with this policy.
5.3 Payment providers
When you pay through a third-party payment provider, you enter into a direct relationship with that provider. Your data is then also handled under their own privacy policy and terms, which we recommend you read.
6. Sending data outside the UK
Some of our service providers and suppliers are based outside the United Kingdom, including in countries whose data protection laws differ from those in the UK. Because we source products from outside the UK, order and delivery data is routinely shared with suppliers and carriers based overseas.
Whenever we transfer personal data out of the UK, we make sure a lawful transfer mechanism is in place. We rely on one of the following:
(a) Adequacy regulations. The country or organisation has been recognised by the UK Government as providing an adequate level of data protection. This includes transfers to Canada (for commercial organisations) and to organisations in the United States that are certified under the UK Extension to the EU-US Data Privacy Framework (the "UK-US Data Bridge").
(b) The International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses. These are contracts approved by the Information Commissioner that impose UK-equivalent protections on the recipient. We carry out a transfer risk assessment before relying on these.
(c) An exception permitted by Article 49 UK GDPR — for example where the transfer is necessary to perform our contract with you, such as passing your delivery address to an overseas supplier so your order can be shipped.
You may request further information about the safeguards we use by contacting us at info@glorenna.com.
7. How long we keep your personal data
We keep personal data only for as long as we need it. The following periods are our normal practice:
| Data | Retention period |
|---|---|
| Order and transaction records, invoices and accounting records | 6 years from the end of the financial year in which the transaction took place, to meet HMRC and company record-keeping requirements |
| Account data (if you open an account) | For as long as your account is active, and for 2 years after your last activity, after which we delete or anonymise it |
| Customer service correspondence and complaints | 2 years from resolution, or 6 years where the matter relates to a potential legal or consumer law claim |
| Marketing preferences and consent records | Until you withdraw consent or unsubscribe, plus a minimum record of your objection so we do not contact you again |
| Website analytics and cookie data | Up to 26 months, or the period stated in our cookie policy |
| Fraud prevention records | Up to 6 years where necessary to protect against repeat fraud |
At the end of these periods we securely delete or anonymise the data. Where deletion is not immediately possible — for example in backups — we isolate the data and delete it on the next scheduled cycle.
8. Cookies
We use cookies and similar technologies on our website. Strictly necessary cookies — those required to make the site work, remember your basket and keep your session secure — are set without your consent, as PECR permits.
All other cookies, including analytics, personalisation and advertising cookies, are only set after you give consent through our cookie banner. You can withdraw or change your consent at any time through the cookie settings on our website, or by clearing cookies in your browser.
Our cookie policy forms part of this Privacy Policy and gives full details of the cookies we use.
9. Marketing
We will only send you marketing emails where:
- you have consented to receive them; or
- you have previously bought from us or enquired about our products, we are marketing similar products, and we gave you a simple way to opt out when we collected your details and in every message since (the "soft opt-in" under regulation 22 of PECR).
You can opt out at any time — click the unsubscribe link in any marketing email, or email us at info@glorenna.com. We will action your request without delay and at no cost to you.
Opting out of marketing does not stop us sending you service messages relating to an order you have placed, such as dispatch and delivery notifications.
10. Your rights
Under the UK GDPR you have the following rights. They are free to exercise, and we will respond within one month. We may extend this by up to two further months for complex requests, in which case we will tell you within the first month and explain why.
Right of access — to be told whether we hold personal data about you and to receive a copy of it, together with information about how we use it.
Right to rectification — to have inaccurate personal data corrected, and incomplete data completed.
Right to erasure ("right to be forgotten") — to have your personal data deleted where we no longer need it, where you withdraw consent and we have no other basis, or where it has been unlawfully processed. This right is not absolute — we may need to keep certain records to meet legal obligations, such as tax records.
Right to restrict processing — to ask us to pause our use of your data, for example while we check its accuracy or consider an objection you have raised.
Right to data portability — to receive the personal data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller. This applies where processing is based on consent or contract and is carried out by automated means.
Right to object — to object to processing based on our legitimate interests. You have an absolute right to object to processing for direct marketing purposes, and we will stop immediately.
Right to withdraw consent — where we rely on consent, you can withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.
Rights relating to automated decision-making — see section 4.3.
10.1 How to exercise your rights
Email info@glorenna.com or write to us at the address in section 1. Please tell us which right you wish to exercise and give us enough information to identify you. We may ask for proof of identity to make sure we do not disclose your data to the wrong person.
11. How we protect your personal data
We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure. These include encryption of data in transit (TLS), restricting access to personal data to those who need it, using reputable providers who maintain recognised security standards, and requiring contractual security commitments from our processors.
No transmission over the internet can be guaranteed completely secure. Where a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours, and we will tell you directly where the breach is likely to result in a high risk to you.
12. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at info@glorenna.com so we can try to put it right.
You also have the right to complain to the UK supervisory authority for data protection:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint
You may complain to the ICO at any time, but we would appreciate the chance to address your concerns first.
13. Changes to this policy
We may update this policy from time to time. The date at the top of this page shows when it was last revised. Where changes are significant — for example if we begin using your data for a new purpose — we will tell you directly, by email or through a notice on our website.
We recommend you review this page periodically.
14. Contact us
Glorenna
600 Heron Close, Rickmansworth, WD3 1NF, United Kingdom
Email: info@glorenna.com
Telephone: +44 7418 604305
Customer service hours
Monday to Friday: 8:00am – 5:00pm
Saturday and Sunday: 9:00am – 4:00pm
We aim to respond to all enquiries within 12 hours.
Legislation referenced in this policy
- UK General Data Protection Regulation (UK GDPR)
- Data Protection Act 2018
- Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR)
- Data Protection (Adequacy) (United States of America) Regulations 2023 — the UK-US Data Bridge