Privacy Policy

1. Who We Are

This website is operated by The Pretty Mob UK, a trading name of Laid By Shay Limited, a company registered in England and Wales.

For any privacy-related enquiries, please contact us at support@theprettymob.co.uk

The Pretty Mob UK is the data controller responsible for your personal data as defined under the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and applicable data protection legislation.

2. Data We Collect

We may collect and process the following personal data:

Information you provide directly

• Full name
• Email address
• Shipping and billing address
• Phone number (where provided)
• Payment information (processed securely by our payment provider, not stored by us)
• Account details if you create an account
• Any information submitted via contact forms, email, or customer support

Information collected automatically

• IP address and approximate location
• Browser type, device type, and operating system
• Pages visited, time spent on site, and referring URLs
• Cookie and tracking data (see Section 7)

3. How We Use Your Data

We use your personal data for the following purposes:

Order fulfilment

• Processing and dispatching your orders
• Sending order confirmations, shipping updates, and delivery notifications
• Managing returns, refunds, and customer support requests

Marketing and communications

• Sending promotional emails, offers, and product updates (only where you have opted in or where we have a legitimate interest)
• Personalising your experience and showing relevant content
• Running targeted advertising campaigns

Analytics and improvement

• Understanding how visitors use our website
• Improving our products, website, and customer experience
• Monitoring site performance and security

Legal basis for processing

We process your data under the following legal bases as defined by GDPR: contractual necessity (to fulfil your order), legitimate interest (to improve our services and communicate with customers), consent (for marketing communications and non-essential cookies), and legal obligation (where required by law).

4. Third Parties

We may share your personal data with trusted third-party service providers who assist us in operating our business. These providers process your data on our behalf and are contractually obligated to protect it.

Service providers include

• Shopify - E-commerce platform, order processing, and payment handling
• Shopify Email - Email marketing and customer communications
• Supabase - Hosting of our accounts database, community and Get Featured records, and the storage of photos and videos you send us. Our database and file storage are hosted in the European Union (Ireland).
• Resend and Google (Gmail) - Delivery of our transactional and internal notification emails
• Meta (Facebook/Instagram) - Advertising, retargeting, and audience insights, and publication of content you have given us permission to share
• TikTok - Advertising and audience insights, and publication of content you have given us permission to share
• Google - Analytics, advertising, and search performance
• Loox - Product review collection and review invitation emails
• Payment processors - Secure payment handling (we do not store card details)
• Shipping carriers - Order delivery and tracking

We do not sell your personal data to third parties. Data is only shared where necessary to provide our services, fulfil orders, or comply with legal obligations.

5. International Data Transfers

Our accounts database and the storage holding any photos or videos you send us are hosted in the European Union (Ireland). Some of our other service providers, including Shopify, Google, Meta, TikTok and our email providers, process data outside the United Kingdom and European Economic Area, principally in the United States.

Where personal data is transferred outside the UK or EEA, we rely on the transfer mechanisms offered by those providers in their data processing terms: the UK International Data Transfer Addendum and the European Commission's Standard Contractual Clauses, or an adequacy decision (including the UK-US Data Bridge and the EU-US Data Privacy Framework) where the provider is certified under it.

These same protections apply to every customer wherever you live. If you are outside the UK, your data is handled under this policy and the UK GDPR standard, and any content published with your permission may be visible worldwide.

5a. Get Featured: Reviews, Photos and Videos

If you take part in Get Featured, we process the review text, photo or video you send us, your Pretty Mob username or display name, your account and contact email, and any order number you give us so we can verify a genuine purchase. Files are stored privately and are not publicly readable.

Private by default

• Submitting is private. Only you and our team can see it.
• Approval is a reward decision. It does not make anything public.
• We only publish a submission if you gave us permission for that channel and we then selected it.

If we publish it

• Only your Pretty Mob username or display name, your review text and the photo or video may be shown. Photos and videos may show your face.
• We never publish your email address, phone number, order number, internal account identifiers, our notes or moderation feedback.
• Once content is public, third parties can copy or repost it and we cannot guarantee removal of those copies.

Lawful basis, permission and withdrawal

• Public use is based on your consent. It is optional, unticked by default, given channel by channel, and recorded with the wording version, date and time.
• You can change or withdraw it at any time in Account → Your Get Featured history, or by contacting us. Withdrawal is recorded and takes effect on the surfaces we control.
• Handling your submission and your reward, and keeping the permission records themselves, is based on our contract with you and our legitimate interest in proving what was agreed.
• Withdrawing public-use permission does not delete your order or account records, and it does not remove your reward.

Retention

• Submissions and their permission history are kept while your account is active and for a reasonable period afterwards, so we can evidence rewards given and permissions agreed.
• Published content is removed from our own surfaces on withdrawal or on request.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy:

• Order data - Retained for 6 years from the date of purchase to comply with tax, accounting, and legal obligations
• Account data - Retained for as long as your account remains active, plus a reasonable period after closure
• Marketing data - Retained until you withdraw consent or unsubscribe
• Analytics data - Retained in anonymised form for up to 26 months

When data is no longer required, it is securely deleted or anonymised.

7. Cookies & Tracking

Our website uses cookies and similar tracking technologies to improve your experience, analyse site usage, and deliver relevant advertising.

Types of cookies we use

• Essential cookies - Required for the website to function (e.g. cart, checkout, session management). These cannot be disabled.
• Analytics cookies - Help us understand how visitors interact with our website (e.g. Google Analytics). Collected with your consent.
• Marketing cookies - Used to deliver personalised advertising and track campaign performance (e.g. Meta Pixel, TikTok Pixel, Google Ads). Collected with your consent.

With advertising consent, we retain Google click IDs (gclid, gbraid or wbraid), campaign and ad-group tags, the anonymous journey reference and your consent record for up to 30 days to link visits to Shopify orders. Orders may contain that reference, the order ID, actual value and currency. When connected and permitted, Google Ads or Google Analytics can receive these for measurement and ad optimisation. A click ID alone does not prove an ad caused an order. We do not share your email or phone for this tracking.

Cookie settings lets you reject tracking at any time without affecting shopping. We keep the time, choices and notice version as consent evidence, including later withdrawal. Withdrawal prevents new click capture and clears saved click IDs and cart attribution; it does not erase legally retained order records or data already received by Google.

For more information on how cookies work, visit the ICO's guide to cookies.

8. Your Rights

Under the UK GDPR, EU GDPR, and applicable data protection laws, you have the following rights in relation to your personal data:

• Right of access - Request a copy of the personal data we hold about you
• Right to rectification - Request correction of inaccurate or incomplete data
• Right to erasure - Request deletion of your personal data where there is no compelling reason for continued processing
• Right to restrict processing - Request that we limit how your data is used
• Right to data portability - Request your data in a structured, machine-readable format
• Right to object - Object to processing based on legitimate interest, including direct marketing
• Right to withdraw consent - Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at support@theprettymob.co.uk. We will respond within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk, or with your local data protection authority.

9. Children's Privacy

Our website and products are not intended for children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

10. Security

We take the security of your personal data seriously. We use appropriate technical and organisational measures to protect your data against unauthorised access, loss, or misuse. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Changes will take effect immediately upon being published on this website. We encourage you to review this policy periodically.