Privacy policy

This Privacy Policy explains how Craw-leigh (“we”, “us” or “our”) collects, uses and shares your personal information when you visit or use our website and online store (together, the “Site”), make a purchase from us, or otherwise interact with us in relation to the Site (collectively, the “Services”).

“You” or “your” means any individual using our Services, including customers, website visitors and anyone who contacts us.

Please read this Privacy Policy carefully so you understand how we handle your information.

1. Changes to this Privacy Policy

We may update this Privacy Policy from time to time (for example, to reflect changes in our practices, technology or legal requirements).

When we make changes, we will:

post the updated Privacy Policy on this page, and
update the “Last updated” date above.

Where required by law, we will notify you of significant changes and, if needed, ask for your consent again.

2. Who is responsible for your data?

For the purposes of UK data protection law (including the UK GDPR and the Data Protection Act 2018), Craw-leigh is the “data controller” of the personal information we collect about you via the Site.

3. Personal information we collect

The information we collect depends on how you use our Services. “Personal information” means information that identifies you or can be linked to you.

3.1 Information you provide directly

You may give us information when you: place an order, create an account, contact us, subscribe to marketing, or otherwise use our Services. This can include:

Contact details – name, billing and delivery address, email address, phone number.
Order details – products ordered, payment confirmation, order value, delivery method, and related communication.
Account information – username, password and any details used for login or account security.
Customer support information – information you include when you contact us (for example by email or via a contact form), including complaints, queries or feedback.

You can choose not to provide certain information, but this may mean you cannot use some features (for example, placing an order without providing delivery details).

3.2 Information we collect automatically (Usage Data)

When you visit or use our Site, we may automatically collect certain information about your device and how you interact with the Site (“Usage Data”). This may include:

Device and browser information (e.g. type, version, operating system)
IP address and approximate location
Pages you visit, links you click, the time and date of your visit
How you arrived at the Site (e.g. via an advert or search engine)

We collect this information using cookies, pixels and similar technologies (see section 5 below).

3.3 Information from third parties

We may receive information about you from:

Shopify – who host our online store and support payment and order processing.
Payment providers – who process your payments (e.g. card or wallet services) and confirm whether a payment was successful.
Analytics and advertising partners – who help us understand how visitors use our Site and measure the performance of our marketing.
Delivery and fulfilment partners – who help deliver your order and may provide delivery status updates.

Any information we receive from third parties is handled in line with this Privacy Policy.

4. How we use your personal information

We process your personal information for the following purposes and legal bases under UK data protection law:

4.1 To provide our products and Services (contractual necessity)

We use your information to:

process your orders and take payment
arrange shipping and handle returns or exchanges
create and manage your account
send you order confirmations, delivery updates and transactional messages
provide customer service and support

This processing is necessary to perform our contract with you, or to take steps at your request before entering into a contract.

4.2 Marketing and advertising (legitimate interests / consent)

We may use your personal information to:

send you marketing emails or messages about our products, offers and news
show you relevant adverts on our Site or on other websites and platforms
understand which products and offers you may be interested in

Where required by law, we will only send you direct marketing if you have consented (for example by ticking a box). You can withdraw your consent or opt out at any time (see section 9.6).

4.3 Security, fraud prevention and misuse (legitimate interests / legal obligations)

We may use your information to:

protect our Site, accounts and customers against fraud and abuse
investigate suspicious activity or potential breaches of our terms
comply with our legal obligations (for example, to prevent money laundering or report suspected fraud)

This is in our legitimate interest to keep our Services secure and to protect our business, users and third parties.

4.4 Service improvement and analytics (legitimate interests)

We use Usage Data and other information to:

operate, maintain and improve our Site and Services
understand how customers use our Site and which products are popular
fix errors and improve performance and user experience

It is in our legitimate interest to analyse and improve how our business and website work.

4.5 Legal and regulatory purposes

We may also use your personal information where necessary to:

comply with legal obligations (for example, tax and accounting rules)
respond to lawful requests from authorities or regulators
establish, exercise or defend legal claims

5. Cookies and similar technologies

Like many websites, we use cookies and similar technologies on our Site. Cookies are small text files stored on your device.

We use cookies to:

remember your preferences (e.g. language, basket contents)
keep you logged in to your account
run analytics and measure how the Site is used
support marketing and show relevant ads

For more detail on the cookies used by Shopify when powering our store, you can refer to Shopify’s cookie information: https://www.shopify.com/legal/cookies

Most web browsers accept cookies by default but allow you to change your settings to delete or block cookies. If you block cookies, some parts of our Site may not function correctly. Blocking cookies will not necessarily stop all information sharing with third parties (for example, advertising partners), but it may reduce it.

6. How we share your personal information

We do not sell your personal information. We may share it in the following limited situations:

Shopify and service providers – with trusted vendors who help us operate our business, such as:
- hosting and IT providers
- payment processors
- fulfilment and shipping partners
- analytics providers
- customer support tools
Business and marketing partners – for example, advertising platforms that help us show you relevant ads or measure campaign performance.
Within our group – if we have related companies or affiliates, we may share information where necessary for internal administration and business purposes.
Legal and business reasons – we may share information:
- if required by law, regulation or legal process
- to respond to lawful requests from public authorities
- to enforce our Terms of Service or other agreements
- in connection with a business transaction (e.g. merger, sale, restructuring), subject to appropriate safeguards

Whenever we share personal information, we only share what is necessary and we require recipients to keep your data secure and to handle it in line with data protection law.

We do not use or disclose any “special category” or sensitive personal information about you for profiling or purposes that would infer characteristics about you.

7. International transfers

Our store is hosted by Shopify and we may use other service providers based outside the United Kingdom. This means your personal information may be transferred to and processed in countries outside the UK, where data protection laws may offer a different level of protection.

Where we transfer your personal information outside the UK, we will:

rely on an adequacy regulation (where the destination country is recognised as providing an adequate level of protection), or
use appropriate safeguards, such as standard contractual clauses approved by the UK authorities, or
ensure another valid transfer mechanism is in place.

You can contact us (see section 11) if you would like more information about international transfers and the safeguards we use.

8. How we keep your information secure and how long we keep it

8.1 Security

We use appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, misuse or disclosure.

However, no system or transmission over the internet can be guaranteed to be completely secure. You are responsible for keeping your account login details confidential and for choosing a strong password. If you believe your account has been compromised, please contact us immediately.

8.2 Retention

We keep your personal information only for as long as we need it for the purposes set out in this Privacy Policy, including:

to provide the Services and manage your account
to comply with legal, tax or accounting obligations
to resolve disputes and enforce our agreements

The exact retention period depends on the type of information and the legal requirements that apply. When information is no longer needed, we will delete it or anonymise it.

9. Your rights (UK & EEA users)

If you are in the UK or the European Economic Area, you have certain rights over your personal information under data protection law. These may include:

9.1 Right of access

You can request a copy of the personal information we hold about you, and details of how we use it.

9.2 Right to rectification

You can ask us to correct inaccurate or incomplete personal information.

9.3 Right to erasure (“right to be forgotten”)

In certain circumstances, you can ask us to delete your personal information (for example, if it is no longer needed for the purpose we collected it for).

9.4 Right to restrict processing

You can ask us to restrict how we use your information in certain cases (for example, while we are checking its accuracy or handling an objection).

9.5 Right to object

You can object to certain types of processing, including:

direct marketing (you can always opt out), and
processing based on our legitimate interests, if you believe your rights outweigh our interests.

9.6 Right to withdraw consent

Where we rely on your consent (for example, for some marketing), you can withdraw it at any time. This won’t affect the lawfulness of any processing carried out before withdrawal.

You can usually opt out of marketing emails by clicking the “unsubscribe” link in our emails, or by contacting us.

9.7 Right to data portability

In certain cases, you may request that we provide your personal information in a structured, commonly used and machine-readable format and/or ask us to transfer it to another organisation.

How to exercise your rights
You can exercise your rights by contacting us using the details in section 11. We may need to verify your identity before we act on your request (for example, by asking you to confirm your email address or order details).

We will respond to your request within the timeframes required by applicable law.

We will not treat you unfairly or refuse to provide Services to you simply because you have exercised any of your privacy rights.

10. Complaints and your right to contact the ICO

If you have concerns about how we handle your personal information, please contact us first so we can try to resolve the issue.

If you are not satisfied, you have the right to lodge a complaint with the UK data protection authority:

Information Commissioner’s Office (ICO)
Website: ico.org.uk

If you live in another country or within the EEA, you may also have the right to complain to your local data protection authority.

11. Third-party websites and social media

Our Site may contain links to websites or services operated by third parties (for example, social media platforms, payment providers or partner sites).

We are not responsible for the privacy practices, security or content of these third-party websites. If you follow a link to a third-party site, their own privacy policy will apply. We recommend that you read it carefully.

If you choose to share information publicly on social media or other public areas (for example, comments or reviews), this content may be visible to others and may also be collected by us and the third-party platform.

12. Children’s data

Our Services are not intended for children, and we do not knowingly collect personal information from children.

If you are a parent or guardian and believe that a child has provided us with personal information, please contact us so that we can investigate and, if appropriate, delete the information.

13. Contact details

If you have any questions about this Privacy Policy, wish to exercise your rights or make a complaint, you can contact us at:

Store name: Craw-leigh
Email: info@craw-leigh.com
Phone: +447782273482

Craw-leigh is operated by SLCollective Limited.
UK fulfilment partner location: 158 Beddington Ln, Croydon CR0 4GG, United Kingdom.

Business Name: SLCollective Limited
Business Registration Number: 78238500
Business address: Office 3906, 39th The Center
99 Queen’s Road Central, Central, Hong Kong

Customer service hours:
Monday to Saturday
9:00 AM – 5:00 PM (GMT+0)
We aim to respond to your email within 48 hours.