Privacy policy

This policy explains how ELIXYR LONDON LIMITED uses personal information when you visit elixyr.uk, buy from us or hear from us. We keep it short and plain.

Who we are

ELIXYR LONDON LIMITED (company number 17160325), 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, is the controller of your personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Contact us at hello@elixyr.uk.

What we collect

Order details: your name, email address, delivery and billing address, phone number if you give one, what you bought and how much you paid. Payment card details are handled by our payment providers; we never see your full card number.
Your messages: anything you send us by email or through our contact form.
Email preferences: if you sign up to our letters, your email address, where you signed up and, if you allow it, what you browse and buy in our shop.
Reviews: your review, rating, display name and any photo you choose to add.
Device and usage information: IP address, browser and device type, pages viewed and how you arrived, collected through cookies and similar technologies as described below.

Why we use it, and our lawful basis

To take, deliver and support your order, including dispatch emails, cancellations, returns and refunds. Lawful basis: performance of our contract with you.
To keep records required for tax and accounting. Lawful basis: legal obligation.
To prevent fraud and keep the shop secure. Lawful basis: our legitimate interests.
To send our letters about new scents, the Discovery Set and occasional offers. Lawful basis: your consent, which you can withdraw at any time with the unsubscribe link in any letter. Order emails never subscribe you.
To ask for a review once after your order is delivered. Lawful basis: our legitimate interests. You can ignore or unsubscribe from the request.
To measure and improve our advertising with Meta, TikTok and Google. Lawful basis: your consent through our cookie banner.

Who we share it with

We do not sell your personal information. We share it only with providers that help us run the shop, under contracts that require them to protect it:

Shopify, which hosts our shop and checkout and sends order emails.
Our payment providers (Shopify Payments, Shop Pay, PayPal, Apple Pay and Google Pay where you choose them), to take payment and prevent fraud.
Royal Mail, to deliver your order.
Klaviyo, which sends our letters and order follow-up emails.
Judge.me, which collects and publishes reviews and sends review requests.
Meta (Facebook and Instagram), TikTok and Google, only if you allow advertising cookies (see below).
Professional advisers and authorities where the law requires it.

Cookies and your consent

Strictly necessary cookies keep your basket, checkout and security working and are always on.

Analytics, marketing and advertising cookies are off until you choose. When you first visit, our cookie banner lets you accept them, reject them or choose by category. You can change your mind at any time through Cookie settings in the footer of every page. Rejecting is as easy as accepting.

Meta, TikTok and Google pixels

If you allow marketing cookies, we use the Meta Pixel and Conversions API, the TikTok Pixel and Events API, and Google tags. They tell these platforms which pages and products you view, what you add to your basket, when you start checkout and when you buy, with the order value, so we can measure which adverts lead to sales and show adverts to people likely to be interested.

To match a purchase to an advert, we send your IP address, browser information, ad-click identifiers and, in a hashed (scrambled) form, your email address and phone number. Each platform acts as an independent controller for its own use of this information under its own privacy policy, and may process it outside the UK.

If you reject marketing cookies, none of this is sent from our shop.

Where your information is processed

Some of our providers process information outside the UK, including in the United States and the European Economic Area. Where they do, the transfer is protected by UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or another safeguard recognised under UK GDPR.

How long we keep it

Order and accounting records: six years after the end of the financial year, as UK tax law requires.
Email marketing information: until you unsubscribe, then only a suppression record so we do not email you again.
Customer service messages: up to two years after the matter is closed.
Cookie choices: up to 12 months, after which we ask again.

Your rights

Under UK GDPR you can ask us for a copy of your information, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. Write to hello@elixyr.uk; we will reply within one month.

If you are unhappy with how we handle your information, please tell us first. You also have the right to complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.