Privacy Policy

1. Data Controller Information

LETTY Beauty Limited (“LETTY”, “we”, “us”, or “our”) is the designated Data Controller responsible for your personal information collected via our website, digital boutique, and client concierge services.

If you have any questions regarding your privacy, data protection, or wish to exercise your statutory rights, please reach our Data Protection Officer at lettybeautyco@gmail.com.

2. Personal Data We Collect

We may collect and process the following categories of personal information:

• Identity & Contact Data: Full name, delivery address, billing address, email address, and telephone number.
• Financial & Payment Data: Payment card tokenisation and transaction identifiers processed securely via our Level 1 PCI-DSS certified payment processor (Stripe). We never store raw debit/credit card numbers on our servers.
• Order & Transaction Data: Records of products purchased, order values, shades selected, returns history, and customer service correspondences.
• Technical & Browsing Data: IP address, browser type, operating system, device identifiers, and page interaction timestamps collected via strictly essential or consented cookies.

3. Lawful Basis for Processing

Under UK GDPR, we process your personal data under the following legal grounds:

4. Sharing Your Information

We do not sell, rent, or trade your personal data with third parties. We share data solely with trusted third-party service providers who assist our operations:

• Payment Gateways: Stripe (Level 1 PCI-DSS compliant) for secure credit/debit card, Apple Pay, and Google Pay verification.
• Logistics & Couriers: Royal Mail, DPD, DHL Express, and regional postal authorities for tracked parcel delivery.
• Cloud & Hosting Infrastructure: Secure servers located in the UK and European Economic Area (EEA) with end-to-end encryption.

5. Data Retention

We retain your order and transactional information for 6 years following the date of purchase to comply with UK statutory accounting, tax, and consumer warranty regulations. Marketing subscriber data is retained until you choose to unsubscribe.

6. Your Statutory Rights (UK GDPR)

As a resident of the United Kingdom, you possess statutory rights regarding your personal data:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal records.
• Right to Erasure (“Right to be Forgotten”): You may request deletion of your personal data where legal retention periods do not apply.
• Right to Restrict or Object: You can restrict or object to our processing of your data under legitimate interest.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.