Privacy policy

This Privacy Policy describes how Brenelo ("Brenelo", "we", "us", or "our") collects, uses, and discloses your personal information when you visit, use our services, or make a purchase from brenelo.com (the "Site") or otherwise communicate with us. By using the Site, you agree to the collection and use of your information as described in this Privacy Policy.

Data controller

The data controller responsible for your personal data is:

Brenelo
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Email: contact@brenelo.com
Phone: +44 7871 227519

As the data controller, we decide the purposes and means of processing your personal data, and we are accountable for how it is handled. Privacy enquiries and data subject requests should be sent to the email address above; we act as the point of contact for all data protection matters and reply within 1 to 2 business days.

Data protection law and legal bases

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and, where applicable to EU customers, the EU GDPR. We rely on the following legal bases:

  • Performance of a contract — to process, deliver and support your order.
  • Legitimate interests — to prevent fraud, secure the Site, and improve our products and service, balanced against your rights.
  • Legal obligation — to meet our tax, accounting and consumer law duties.
  • Consent — for marketing emails and non-essential cookies. You can withdraw consent at any time.

Information we collect

  • Information you provide: your name, billing and shipping address, email address, phone number, and order details when you place an order or contact us. We do not store full payment card numbers — payments are handled securely by our payment providers.
  • Information collected automatically: device and browser information, IP address, and how you interact with the Site, collected through cookies and similar technologies.

How we use your information

We use your information to process and deliver your orders, provide customer support, send order updates, prevent fraud, comply with our legal obligations, and — where you have agreed — send you marketing about new products and offers. You can unsubscribe from marketing at any time.

Third parties we share your information with

We share personal information only with the third parties listed below. Each of these third parties acts as a processor on our documented instructions under a written data processing agreement, and may use your data only to provide the service to us. We do not sell your personal information, and we do not share it with any third party for that third party's own marketing purposes.

  • Shopify Inc. — our e-commerce platform and hosting provider, which stores and processes orders, customer accounts and store data on our behalf.
  • Payment processors — Shopify Payments and the card networks, to authorise and take payment. They receive your payment and billing details directly; we never see or store full card numbers.
  • Delivery carriers — Royal Mail, Evri, DPD and Parcelforce, together with our order-tracking provider. They receive your name, delivery address, phone number and email address so your parcel can be delivered and tracked.
  • Email and marketing providers — to send order confirmations, delivery updates and, where you have agreed, marketing emails.
  • Analytics providers — such as Google Analytics, to understand how the Site is used, where you have consented to analytics cookies.
  • Professional advisers and authorities — our accountants, lawyers, insurers, and regulators or law enforcement, where we are legally required to disclose information or need to establish, exercise or defend a legal claim.

We may also disclose personal information to a third party in connection with a merger, acquisition or sale of all or part of our business, in which case we will tell you before your data becomes subject to a different privacy policy.

Third-party links

The Site may contain links to third-party websites, such as courier tracking pages or social media. Those third parties are not controlled by us and are not covered by this Privacy Policy. We encourage you to read the privacy policy of any third-party site you visit.

International transfers

Some of the third parties above are based outside the UK. Where personal data is transferred abroad, we rely on UK adequacy regulations or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, so your data keeps an equivalent level of protection.

Data protection and security

We take data protection seriously and apply appropriate technical and organisational measures to keep your personal data safe. These include encryption of the Site with HTTPS/TLS, payment processing by PCI DSS compliant providers so that we never see or store full card numbers, access controls that limit staff access to personal data on a need-to-know basis, secure hosting with our e-commerce platform, and regular review of our systems and suppliers. We follow the data protection principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. No method of transmission over the internet is completely secure, but we work to protect your data and, in the unlikely event of a personal data breach that risks your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and inform you where required by law.

Cookies

We use cookies to operate the Site, remember your preferences, and understand how the Site is used. Essential cookies are needed for the Site to work; analytics and marketing cookies, including those set by the third parties named above, are used only with your consent. You can control cookies through your browser settings at any time.

Your rights

If you are in the UK or EU, you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, to withdraw consent, and not to be subject to solely automated decision-making. To exercise any of these rights, email contact@brenelo.com. We respond within one month, free of charge. You can also ask us not to sell or share your data, as explained on our Do Not Sell My Data page.

Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we can put it right. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk or on 0303 123 1113. If you are in the EU, you may complain to your local data protection authority.

Data retention

We keep your personal information only for as long as needed to provide our services and to meet our legal, accounting and reporting obligations. Order and transaction records are kept for six years to satisfy UK tax law. Marketing contact details are kept until you unsubscribe. Data no longer needed is securely deleted or anonymised.

Children's privacy

The Site is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. The version published on this page is always the current one.

Contact

For any privacy or data protection question or request, contact us at contact@brenelo.com, or write to: Brenelo, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.