Deborah Harvey ™ Skincare

GDPR & Privacy Policy

1. Introduction

Deborah Harvey ™ Skincare ("we", "us", "our") is committed to protecting your personal data and respecting your privacy. This policy explains how we collect, use, store, and protect your information in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Controller

·  Controller: Deborah Harvey ™ Skincare

·  Contact: Deborah Harvey, Deborah Harvey ™ Skincare.  35, HA3 7BP Email: info@deborahharvey.co.uk

·  ICO Registration No: ZB912067

3. Information We Collect

·  We collect the following personal data:

·  Order Processing:

o   Name, address, email, phone (for shipping and contact).

o   Payment details (processed via secure third-party providers like PayPal/Stripe; we don’t store full card details).

·  Account/Newsletter:

o   Email for marketing (if you subscribe).

·  Website Use:

o   Analytics data (via Google Analytics cookies – see #cookie-policy).

o   IP address, browser type, pages visited (for security/logs).

4. How We Use Your Data

·  Process orders and manage deliveries.

·  Communicate about your order, updates, or queries.

·  Marketing (if you opt in): newsletters, promotions, new products.

·  Improve site experience (analytics).

·  Legal obligations (e.g., tax, refunds).

5. Legal Basis for Processing

·  Contract: To fulfil orders (name, address, payment).

·  Consent: Marketing emails (you can unsubscribe anytime).

·  Legitimate Interest: Site security, analytics (you can object via [contact]).

·  Legal Obligation: Tax, accounting records (6 years retention).

6. Data Sharing & Transfers

·  Third Parties:

o   Payment processors (e.g., PayPal, Stripe).

o   Royal Mail (for shipping).

o   -Analytics (Google Analytics – data may transfer to countries with adequacy agreements or safeguards).

·  No Selling: We don’t sell your data.

7. Your Rights

·  Access: Request a copy of your data.

·  Rectify: Correct errors.

·  Erase: Delete data (unless legal reasons prevent this).

·  -Withdraw Consent: For marketing at any time (unsubscribe link in emails).

·  Object: To processing based on legitimate interests.

·  Complaint: To the ICO (https://ico.org.uk/).

8. Data Retention

·  Orders: 6 years (for accounting/tax).

·  Marketing: Until you unsubscribe.

·  Logs: Short-term for security, then deleted.

9. Security

·  We use ‘technical and organisational measures’ (encryption, access controls) to protect your data.

·  Payment details are handled by secure providers (e.g., Stripe/PayPal).

·  In case of breach: We’ll notify you and the ICO if required.

10. Cookies

·  See our ‘#cookie-policy’ for details on how we use cookies (analytics, marketing, essential).

·  Manage via cookie banner or browser settings.

11. Changes to This Policy

·  We may update this policy. Check this page for changes. Last updated: November 2025

12. Contact Us

·  For any requests or questions:

·  Email: info@deborahharvey.co.uk