Privacy Policy

Last Updated: August 2026

This Privacy Policy explains how MANOLI CORP LLC, trading as Brummell Winders, collects, uses, stores, and shares your personal information when you visit or make a purchase from brummellwinders.com. It is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

1. Data Controller

The data controller responsible for your personal information is:

2. Information We Collect

2.1 Information You Provide Directly

  • Identity data: first name, last name
  • Contact data: email address, phone number, billing and delivery address
  • Order data: products purchased, order history, preferences communicated to our support team
  • Communications data: messages and correspondence you send us by email, contact form, or WhatsApp
  • Account data: if you create an account, your login credentials (password stored in encrypted form)

2.2 Information Collected Automatically

When you visit our website, we automatically collect certain technical data:

  • Device and technical data: IP address, browser type and version, operating system, device type
  • Usage data: pages visited, time spent on pages, links clicked, referring URLs, search terms used to find our site
  • Transaction data: products added to basket, checkout behaviour, purchase completion
  • Cookie data: see Section 7 for full details on cookies and tracking technologies

2.3 Payment Information

Brummell Winders does not collect, store, or have access to your full payment card details. All payment processing is handled directly by our payment partners (Shopify Payments, PayPal, Klarna, and other processors integrated at checkout), which are PCI DSS Level 1 certified. We receive only a confirmation of payment and, where applicable, the last four digits of your card number for reference purposes.

3. How We Use Your Information

Under the UK GDPR we must have a lawful basis for each way we use your data. Ours are set out below.

Purpose Lawful Basis
Processing and fulfilling your orders, sending order confirmations and tracking updates Performance of a contract
Managing returns, refunds, warranty claims, and customer support Performance of a contract
Sending transactional emails (order confirmation, dispatch notification) Performance of a contract
Preventing fraud, detecting unauthorised activity, and protecting the security of our website Legitimate interests
Improving our website, products, and customer experience through analytics Consent (analytics cookies)
Sending marketing emails to existing customers about similar products Legitimate interests (PECR soft opt-in)
Sending marketing emails to subscribers who are not existing customers Consent
Displaying targeted advertising on third-party platforms (Google Ads, Meta) Consent (via cookie preferences)
Complying with legal obligations (tax records, accounting, regulatory requests) Legal obligation

Where we rely on legitimate interests, we have assessed that our interest in running and protecting our business does not override your rights and freedoms. You may object to this processing at any time (see Section 8).

4. Sharing Your Information

We do not sell your personal information to third parties for their own marketing purposes. We share your data only in the following circumstances:

4.1 Service Providers

We share data with trusted third-party providers who process it on our behalf under written data processing terms:

  • Shopify Inc. — e-commerce platform, hosting, and payment infrastructure. Privacy policy: shopify.com/legal/privacy
  • Delivery carriers — your name, delivery address, and contact details are shared with carriers (such as Royal Mail, DPD, Evri, DHL, UPS, FedEx, and regional partners) solely to deliver your order
  • Email service providers — we use an email platform to send transactional and marketing communications; it accesses your email address for sending purposes only
  • Google LLC — Google Analytics (website usage) and Google Ads (advertising and remarketing). Privacy policy: policies.google.com/privacy
  • Meta Platforms Inc. — Meta Pixel for advertising and remarketing on Facebook and Instagram. Privacy policy: facebook.com/policy

4.2 Legal Disclosure

We may disclose your personal information where required by law, court order, or a competent authority, or where we reasonably believe disclosure is necessary to protect our rights, prevent fraud, or ensure the safety of our customers.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, your personal data may be transferred to the acquiring entity. We will notify you by email and/or a prominent notice on our website before your data becomes subject to a different privacy policy.

5. International Data Transfers

Brummell Winders is operated from the United States, and several of our providers are based outside the United Kingdom. This means your personal data is transferred outside the UK, including to the United States.

Where we transfer personal data outside the UK, we rely on one of the safeguards permitted by the UK GDPR:

  • Transfers to a country covered by UK adequacy regulations
  • The UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses
  • For transfers to the United States, certification under the UK Extension to the EU–US Data Privacy Framework where the recipient participates in it

You may request a copy of the safeguards applying to a specific transfer by contacting support@brummellwinders.com.

6. Data Retention

We keep your personal data only for as long as necessary for the purposes it was collected for:

  • Order and transaction data: 6 years (UK tax and accounting requirements, and the limitation period for contract claims)
  • Customer account data: for the life of your account, plus 2 years after your last activity
  • Marketing data: until you unsubscribe or withdraw consent
  • Support correspondence: 3 years from the date of the interaction
  • Analytics and cookie data: as configured in our analytics tools, typically 13–26 months

When data is no longer required, it is securely deleted or anonymised.

7. Cookies & Tracking Technologies

A cookie is a small text file placed on your device when you visit our site. Under PECR, we place non-essential cookies only with your consent, which we collect through the cookie banner shown on your first visit.

7.1 Types of Cookies We Use

  • Essential cookies: required for the website to function (basket, session management, checkout). These do not require consent and cannot be disabled.
  • Analytics cookies: help us understand how visitors use our site (Google Analytics). Set only with your consent.
  • Advertising cookies: used to deliver relevant ads and measure campaign performance (Google Ads, Meta Pixel). These may track your activity across other websites. Set only with your consent.
  • Preference cookies: remember your settings (language, currency, and similar). Set only with your consent.

7.2 Managing Your Cookie Preferences

You can accept or reject non-essential cookies when you first visit our site, and change your choice at any time using the cookie preferences link in our website footer. Withdrawing consent is as easy as giving it, and does not affect the lawfulness of processing carried out before withdrawal.

You can also control cookies through your browser settings, and opt out of advertising cookies directly:

8. Your Rights

Under the UK GDPR you have the following rights over your personal data. To exercise any of them, contact support@brummellwinders.com. We will respond within one month, and will tell you if we need to extend that period for a complex request. Exercising your rights is free of charge.

Right of Access

Request a copy of the personal data we hold about you.

Right to Rectification

Request correction of inaccurate or incomplete personal data.

Right to Erasure

Request deletion of your personal data, subject to legal retention obligations.

Right to Restriction

Request that we limit how we process your data in certain circumstances.

Right to Portability

Receive your data in a structured, commonly used, machine-readable format.

Right to Object

Object to processing based on legitimate interests, including direct marketing.

Right to Withdraw Consent

Withdraw consent at any time where our processing relies on it, such as cookies or marketing.

Automated Decisions

We do not use automated decision-making or profiling that produces legal effects concerning you.

8.1 Complaining to the ICO

If you are unhappy with how we have handled your personal data, please contact us first at support@brummellwinders.com so we can try to put it right. You also have the right to lodge a complaint with the UK supervisory authority at any time:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk

9. Marketing Communications

If you have bought from us or opted in, we may send you promotional content, product updates, and offers about similar products. You may unsubscribe at any time using the link in any marketing email, or by contacting support@brummellwinders.com. We action unsubscribe requests promptly and at no cost to you.

Unsubscribing from marketing does not affect transactional emails relating to your orders (order confirmations, dispatch notifications, warranty communications), which we must send to perform our contract with you.

10. Children's Privacy

Our website and products are not directed at individuals under the age of 18, and we do not knowingly collect personal information from them. If you believe we have inadvertently collected data from a minor, contact us at support@brummellwinders.com and we will delete it promptly.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These include SSL/TLS encryption for all data transmitted through our website, access controls limiting data access to authorised personnel only, and payment infrastructure that is PCI DSS Level 1 certified via Shopify.

No method of transmission over the internet or electronic storage is completely secure. While we use commercially reasonable means to protect your data, we cannot guarantee absolute security. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where the risk is high, inform you directly.

12. Third-Party Links

Our website may contain links to third-party websites, such as carrier tracking portals and social media platforms. We are not responsible for their privacy practices and encourage you to review the privacy policy of any site you visit.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify you by email.

14. Contact & Data Requests

For any question, concern, or request regarding this Privacy Policy or your personal data:

We respond to privacy requests within one month of receipt.