Privacy policy

1. About this Privacy Policy

Key privacy summary

Haarfen Ltd is the controller of personal information used to operate haarfen.com, administer orders, deliver Products, provide support, prevent fraud, meet legal obligations and, where permitted, market the business.

You may contact privacy@haarfen.com about personal information or data-protection rights.

This is a layered notice. The summary gives the principal points; the numbered sections provide the detailed purposes, lawful bases, recipients, retention and rights information.

This policy is deliberately future-ready. Some activities are described conditionally using wording such as "where offered", "where enabled" or "if you choose to use the service". That wording does not state that every provider, feature or processing activity is currently active.

Before beginning a materially new use of personal information, Haarfen will review the relevant notice, lawful basis, consent mechanism, contract and internal records and provide any additional information required at the point of collection.

This policy applies when you visit haarfen.com, create or use an account, place or consider an order, contact customer service, request delivery or return services, subscribe to marketing, interact with advertising or social channels, submit a review, enter a promotion or survey, or otherwise interact with Haarfen.

It should be read alongside the Cookie Policy, Terms and Conditions of Sale, Website Terms of Use, Delivery Information Policy and Returns and Refunds Policy.

This Privacy Policy is a transparency notice and does not vary the hierarchy of contractual sales documents. It does not reduce statutory or contractual rights.

2. Who is responsible for your information?

The data controller is:

Haarfen has not appointed a statutory Data Protection Officer. Privacy matters are overseen internally and handled through privacy@haarfen.com.

3. Meaning of personal information

3.1 Personal information means information relating to an identified or identifiable individual.

3.2 It does not include information that has been effectively anonymised so that the individual can no longer reasonably be identified.

3.3 In this policy:

• "Haarfen", "we", "us" and "our" mean Haarfen Ltd.
• "you" and "your" mean the person whose personal information is being processed.
• "Product" means a Product offered or supplied by Haarfen.
• "Business Customer" means a person acting wholly or mainly for trade, business, craft or professional purposes.

4. Information we may collect

Depending on how you interact with Haarfen, we may collect the following categories of information.

4.1 Identity information

This may include:

• full name
• title
• account username
• date of birth where genuinely required by a finance provider, competition or age-verification process
• signature
• customer reference; and
• identity-verification information.

4.2 Contact information

This may include:

• billing address
• delivery address
• email address
• telephone number
• WhatsApp number
• communication preferences; and
• authorised representative details.

4.3 Order and transaction information

This may include:

• Products viewed, ordered, returned or cancelled
• order number
• order value
• discounts and promotional codes
• delivery and collection requirements
• order status
• invoice and VAT information
• refund and exchange information
• complaints and warranty claims
• correspondence concerning the order; and
• information about gifts or third-party recipients.

4.4 Payment information

Payments are processed by Shopify and the relevant payment or finance provider.

Haarfen does not ordinarily receive or store complete payment-card numbers, card security codes or full online-banking credentials.

We may receive limited payment information, including:

• payment status
• payment method
• card type
• the final digits of a payment card
• transaction reference
• billing name and address
• refund information
• fraud-screening results; and
• chargeback or payment-dispute information.

4.5 Customer-account information

This may include:

• account login details
• saved addresses
• order history
• return and complaint history
• wish lists
• saved Products
• marketing preferences
• communication history; and
• account security information.

4.6 Customer-service information

This may include:

• emails
• telephone-call recordings
• live-chat and chatbot conversations
• SMS and WhatsApp messages
• social-media messages
• photographs, videos and documents
• Product-fault evidence
• delivery and access instructions
• complaint records
• notes made by our customer-service team; and
• your preferences or instructions.

4.7 Technical and website information

This may include:

• IP address
• device identifiers
• browser type and version
• operating system
• time zone
• approximate location
• screen resolution
• language
• referring website
• website pages and Products viewed
• searches
• links selected
• basket and checkout activity
• date, time and duration of visits
• cookie identifiers
• advertising identifiers
• account login activity
• error logs
• security logs; and
• website-performance information.

4.8 Marketing and advertising information

This may include:

• marketing consents
• channel preferences
• unsubscribe and suppression records
• campaign engagement
• email opens and link selections
• SMS or WhatsApp engagement
• advertising audiences
• advertisement interactions
• inferred Product interests
• customer segments
• abandoned-basket activity; and
• response to offers or promotions.

4.9 Delivery and property-access information

This may include:

• delivery address
• recipient name and telephone number
• access restrictions
• parking information
• stairs and lift access
• doorway measurements
• room-of-choice instructions
• safe handling requirements
• delivery photographs
• proof of delivery
• signatures
• collection details; and
• communications with couriers, suppliers or installers.

4.10 Accessibility and health-related information

Where you request a reasonable delivery or service accommodation, you may provide information concerning:

• limited mobility
• step-free access requirements
• disability-related needs
• additional time requirements
• communication requirements; or
• another practical health or accessibility consideration.

We ask you not to provide a diagnosis, medical history or other information that is not necessary for the requested accommodation.

4.11 Review information

This may include:

• your display name
• rating
• review text
• photographs or video
• Product purchased
• verification of purchase
• date of review
• responses to the review; and
• moderation or fraud indicators.

4.12 Competition and survey information

This may include:

• entry details
• eligibility information
• contact information
• answers and feedback
• winner-selection records
• prize-delivery details
• photographs or content submitted as part of an entry; and
• consent to any agreed publication.

4.13 Fraud, security and compliance information

This may include:

• payment risk scores
• unusual order patterns
• mismatched billing and delivery details
• failed payment attempts
• device and IP information
• identity-verification results
• delivery evidence
• account-security events
• suspected misuse
• chargeback history; and
• information received from payment, fraud-prevention or identity-verification providers.

5. How we obtain personal information

We may obtain personal information:

• directly from you
• from someone ordering a Product or arranging a delivery on your behalf
• through your customer account
• through our website, checkout and customer-service channels
• through cookies, pixels, software development kits and similar technologies
• from Shopify
• from payment and consumer-finance providers
• from fraud-prevention and identity-verification providers
• from suppliers, warehouses, couriers, installers and returns partners
• from review providers
• from advertising and analytics platforms
• from social-media and messaging services
• from competition, survey and promotional partners
• from professional advisers, regulators, courts or law-enforcement bodies; and
• from publicly available sources where lawful and reasonably necessary.

We do not buy, rent or use third-party consumer marketing lists.

6. Our lawful bases

Haarfen uses personal information only where it has a lawful basis.

Depending on the circumstances, we may rely on:

• contract, where processing is necessary to take steps at your request before a contract or to perform our contract with you
• legal obligation, where processing is necessary to comply with applicable law
• legitimate interests, where processing is reasonably necessary for Haarfen's or another person's legitimate interests and those interests are not overridden by your rights
• consent, where you have made a freely given, specific and informed choice
• explicit consent, where required for special-category information
• vital interests, where processing is necessary to protect someone's life or physical safety; or
• another lawful basis permitted by applicable law.

Contract may be used where information is genuinely necessary to supply an order or take requested pre-contractual steps. Legitimate interests may be used where processing is reasonably expected and proportionate, including fraud prevention, security, service improvement and the defence of legal claims.

7. How and why we use personal information

7.1 Website operation

We may use technical, account and website-use information to:

• operate haarfen.com
• display Products and content
• maintain your basket
• enable account functions
• remember settings
• improve navigation
• identify website errors
• maintain security; and
• prevent unauthorised access.

Our lawful bases are contract, legitimate interests and consent where required.

7.2 Enquiries, quotations and pre-order discussions

We may use your identity, contact and Product-interest information to:

• respond to enquiries
• discuss Products
• provide availability or delivery information
• prepare a quotation
• follow up an active request; and
• take steps requested before an order is placed.

Our lawful bases are contract and legitimate interests.

7.3 Processing orders

We may use identity, contact, payment, account and order information to:

• accept or reject an order
• take payment
• confirm the order
• obtain Products from suppliers
• manage stock and lead times
• provide updates
• arrange delivery
• issue invoices
• process cancellations
• manage returns and refunds; and
• provide contractual remedies.

Our primary lawful basis is contract. We may also rely on legal obligations and legitimate interests.

7.4 Delivery, collection and fulfilment

We may use and share relevant customer information to:

• arrange supplier-direct fulfilment
• schedule parcel or specialist delivery
• confirm delivery windows
• obtain access information
• provide room-of-choice services
• arrange assembly or installation
• collect returned Products
• investigate delivery incidents
• verify delivery; and
• manage failed delivery or collection attempts.

Our lawful bases are contract and legitimate interests.

7.5 Payments and refunds

We may use payment and transaction information to:

• process payments
• authorise refunds
• reconcile transactions
• manage payment failures
• prevent duplicate refunds
• respond to chargebacks
• maintain accounting records; and
• comply with tax and financial obligations.

Our lawful bases are contract, legal obligation and legitimate interests.

7.6 Customer accounts

We may use account information to:

• create and secure your account
• save addresses
• display order history
• maintain wish lists and saved Products
• record preferences
• support returns and complaints
• restore access; and
• identify suspicious account activity.

Our lawful bases are contract and legitimate interests.

7.7 Customer service and complaints

We may use communications and service records to:

• answer questions
• investigate issues
• provide updates
• resolve complaints
• process returns and remedies
• maintain an accurate record of instructions
• train staff
• monitor service quality
• defend legal claims; and
• comply with our complaints-handling obligations.

Our lawful bases are contract, legitimate interests and legal obligation.

7.8 Product faults, damage and warranty claims

We may use order information, photographs, videos, correspondence and Product records to:

• assess a reported issue
• obtain supplier or manufacturer assistance
• arrange inspection
• determine the appropriate remedy
• investigate misuse or accidental damage
• arrange collection, repair or replacement
• establish responsibility; and
• defend or pursue legal claims.

Our lawful bases are contract, legal obligation and legitimate interests.

7.9 Fraud prevention and security

We may use identity, payment, order, device, account and behavioural information to:

• detect and prevent fraud
• verify identity
• protect customer accounts
• investigate suspicious transactions
• prevent abuse of refunds, promotions or accounts
• protect Haarfen, customers, suppliers and payment providers
• respond to security incidents; and
• provide evidence to payment providers or law-enforcement bodies.

Our lawful bases are legitimate interests, contract and legal obligation.

7.10 Accounting, tax and corporate administration

We may use order, invoice, payment and customer records to:

• maintain accounting records
• prepare VAT and tax returns
• complete audits
• reconcile payments
• respond to HM Revenue & Customs
• maintain corporate records; and
• comply with statutory duties.

Our lawful basis is legal obligation.

7.11 Establishing and defending legal rights

We may use relevant information to:

• obtain legal advice
• pursue unpaid sums
• respond to claims
• enforce our Terms and Conditions
• resolve chargebacks
• investigate misconduct
• protect our intellectual property
• preserve evidence; and
• establish, exercise or defend legal claims.

Our lawful basis is legitimate interests and, where applicable, legal obligation.

7.12 Improving Haarfen

We may use service, order, website and feedback information to:

• analyse Product performance
• improve website design
• improve delivery and returns processes
• understand customer demand
• evaluate supplier and courier performance
• train customer-service staff
• identify recurring complaints
• develop Products and services; and
• produce aggregated business reports.

Our lawful bases are legitimate interests and consent where required.

8. Direct marketing

8.1 Haarfen may send marketing through:

• email
• SMS
• WhatsApp; and
• other electronic messaging channels that you have selected.

8.2 Marketing may include:

• newsletters
• Product announcements
• offers and promotions
• restock information
• abandoned-basket reminders
• editorial content
• invitations to events
• review requests
• competitions; and
• surveys.

8.3 For individual recipients, we will send unsolicited electronic marketing only where:

• you have consented to that particular channel; or
• the limited existing-customer soft opt-in applies and all of its conditions have been satisfied.

8.4 Where we rely on the existing-customer soft opt-in:

• we must have obtained your details directly
• the details must have been obtained during a sale or genuine negotiation for a sale
• the marketing must concern Haarfen's similar Products or services
• you must have been given a clear opportunity to opt out when the details were collected; and
• every subsequent message must include a straightforward opt-out.

8.5 Consent for email, SMS and WhatsApp is managed separately. Agreeing to email marketing does not automatically mean that you have agreed to SMS or WhatsApp marketing.

8.6 Every marketing message will identify Haarfen and provide an appropriate method of opting out.

8.7 You may:

• select the unsubscribe link in an email
• follow the instructions in an SMS
• reply STOP to an eligible SMS or WhatsApp message
• change your preferences through your account where available; or
• email privacy@haarfen.com.

8.8 Withdrawal applies to the specified channel unless you clearly request that all marketing stop.

8.9 Opting out of marketing does not stop essential order, delivery, account, security or service communications.

8.10 We may keep a minimal suppression record to ensure that your opt-out is respected.

8.11 We do not use bought-in consumer marketing lists. UK electronic-marketing rules generally require consent or satisfaction of the soft opt-in for marketing to individuals, and consent must be specific to the communication channel.

9. Personalised advertising and profiling

9.1 Subject to your choices and applicable consent requirements, we may use advertising services provided by organisations such as:

• Google
• Meta, including Facebook and Instagram
• Pinterest; and
• other advertising platforms used by Haarfen.

9.2 We may use these services to:

• show advertisements to people who have visited Haarfen
• show advertisements relating to Products viewed or added to a basket
• measure whether an advertisement led to a visit or purchase
• limit repeated advertisements
• build audiences of people with similar interests
• exclude existing customers or opted-out individuals from certain campaigns
• understand advertising performance; and
• match customer contact details with an advertising-platform account.

9.3 Audience matching may involve sending an encrypted or hashed version of an email address, telephone number or another identifier to the platform.

9.4 Advertising platforms may process information as independent controllers under their own privacy notices.

9.5 You may withdraw cookie consent through Haarfen's cookie controls and may also use the privacy and advertising settings provided by the relevant platform.

9.6 Haarfen will not use accessibility or health-related information for advertising or marketing profiling.

9.7 You have an absolute right to object to the use of your personal information for direct marketing, including related profiling.

10. Cookies, analytics and similar technologies

10.1 Haarfen may use cookies, pixels, scripts, local storage and similar storage or access technologies as explained in the Cookie Policy.

10.2 Strictly necessary technologies may operate without optional consent where legally permitted.

10.3 At launch, analytics, advertising, retargeting, audience matching, social tracking and other optional technologies are disabled until valid consent is given.

10.4 Visitors can reject optional technologies as easily as accepting them and may choose analytics and advertising separately where the consent platform supports those categories.

10.5 Refusing optional technologies does not prevent ordinary browsing or checkout, although an optional feature may not operate.

10.6 Consent may be withdrawn through the preference centre. Haarfen may retain a record of the consent choice and policy version.

10.7 Haarfen will use a live cookie-preference centre and internal cookie register rather than relying solely on a static list in this Privacy Policy.

11. Automated processing and fraud screening

11.1 Shopify, payment providers and fraud-prevention services may automatically analyse an order using information such as:

• payment status
• billing and delivery addresses
• IP address
• device information
• order value
• purchasing patterns
• account history
• failed payment attempts; and
• known fraud indicators.

11.2 A risk result may cause Haarfen to:

• request additional verification
• delay order acceptance or fulfilment
• restrict a payment method
• cancel an order
• investigate an account; or
• refer the matter for human review.

11.3 Haarfen does not intend to make a solely automated decision producing a legal or similarly significant effect unless it is lawful and appropriate safeguards are provided.

11.4 Where applicable, you may request:

• human intervention
• an explanation
• an opportunity to provide further information; or
• reconsideration of the decision.

11.5 Consumer-finance providers may make their own automated credit or eligibility decisions. Those decisions are governed by the provider's privacy notice and legal obligations. UK data-protection law provides additional safeguards for solely automated decisions that have legal or similarly significant effects.

12. Buy-now-pay-later and consumer finance

12.1 Where Haarfen offers finance or instalment services, the provider will be identified at checkout. Providers may include Klarna, Clearpay, PayPal Credit or another provider then displayed.

12.2 This section applies only where you choose such a service and it is enabled.

12.3 Haarfen and the provider may exchange identity, contact, transaction, delivery, device and fraud-prevention information as necessary to provide and administer the service.

12.4 The provider may act as an independent controller and conduct its own eligibility, credit or fraud assessment under its privacy notice.

12.5 A finance provider's decision is not made by Haarfen and may be subject to separate legal rights and safeguards.

13. Customer-service telephone recordings

13.1 Where telephone recording is enabled, Haarfen will provide an appropriate notice at or before the start of the recording.

13.2 Calls may be recorded for evidence, quality, training, fraud prevention, dispute handling, safety and compliance where a lawful basis applies.

13.3 Not every call is necessarily recorded. This section does not state that recording is active on every line.

13.4 Access will be restricted and recordings retained only for a proportionate period, subject to any dispute, complaint, legal hold or mandatory requirement.

13.5 Where reasonably available, a caller may request an alternative non-recorded channel, although Haarfen may still keep ordinary written notes of the interaction.

14. Live chat, chatbots and artificial intelligence

14.1 Where live chat, chatbot or AI-assisted support is enabled, Haarfen may process the information submitted in that channel together with relevant account or order context.

14.2 Automated systems may answer routine questions, identify the subject of an enquiry, provide general Product or policy information, route conversations, detect abuse or spam and prepare suggested responses for human review.

14.3 Haarfen will identify automated interaction where required and will not delegate the final decision on a significant refund, legal complaint, fraud allegation or statutory remedy without appropriate human involvement.

14.4 Haarfen will not authorise a provider to use identifiable customer conversations to train a general-purpose model unless the information is effectively anonymised or separate informed consent is obtained.

14.5 Limited conversation records may be used internally for support quality, security and process improvement where lawful.

14.6 This section applies conditionally and does not state that a chatbot or AI feature is currently available.

15. Accessibility and health-related information

15.1 Information concerning health, disability or mobility may amount to special-category personal data.

15.2 Haarfen will collect only the practical information reasonably necessary to arrange:

• safe delivery
• safe collection
• additional time
• step-free access
• an alternative communication method; or
• another requested accommodation.

15.3 We will not request unnecessary medical evidence or diagnoses.

15.4 We normally rely on:

• contract or legitimate interests as the relevant general lawful basis; and
• your explicit consent as the special-category processing condition.

15.5 In exceptional circumstances, we may rely on another lawful condition, including vital interests or processing necessary for legal claims.

15.6 We may share the necessary practical instruction with a supplier, courier, installer or collection partner.

15.7 We will not use the information for advertising, customer segmentation or unrelated profiling.

15.8 We will delete or restrict it once the relevant service has been completed, unless it remains necessary for a complaint, safety record or legal claim.

Health and disability information requires an Article 6 lawful basis and an additional special-category condition. Explicit consent must be clearly expressed and specific.

16. Reviews

16.1 Haarfen may use a third-party review platform to:

• send verified review invitations
• confirm that a reviewer purchased the Product
• collect and publish ratings
• publish reviews, photographs and videos
• respond to reviews
• investigate fraudulent or misleading reviews; and
• moderate abusive or unlawful content.

16.2 We may share limited information with the provider, including:

• name
• email address
• order number
• Product purchased; and
• date of purchase.

16.3 The provider must not be authorised by Haarfen to use this information for unrelated marketing.

16.4 A public review may display your chosen display name, rating, review and submitted media.

16.5 We will not intentionally publish your:

• email address
• telephone number
• full delivery address
• payment details; or
• other unnecessary private information.

16.6 You may ask Haarfen to stop future review invitations.

16.7 A review already published may remain available where continued publication is lawful, although you may request correction, anonymisation or removal.

17. Competitions, prize draws, giveaways and surveys

17.1 Haarfen may process entry and response information to:

• administer the promotion or survey
• verify eligibility
• prevent duplicate or fraudulent entries
• select and contact winners
• deliver prizes
• analyse responses
• improve Products and services
• maintain an audit record; and
• comply with legal and regulatory requirements.

17.2 Our lawful bases may include contract, legitimate interests, consent and legal obligation.

17.3 Entering a competition or completing a survey does not automatically subscribe you to marketing.

17.4 Any marketing consent will be:

• optional
• separately presented
• specific to the selected communication channel; and
• capable of withdrawal.

17.5 Winner information will be published only where:

• required by law or applicable promotion rules
• reasonably necessary to demonstrate proper administration; or
• separately agreed with the winner.

17.6 We will not publish unnecessary contact or address information.

18. Children

18.1 Haarfen's website and services are not directed at children.

18.2 You must be at least 18 years old to create a customer account or place an order.

18.3 Haarfen does not knowingly collect children's personal information for advertising, direct marketing or profiling.

18.4 Where we learn that a child has provided personal information without appropriate authority, we may:

• delete the information
• restrict its use
• close the account; or
• contact a parent or guardian where appropriate.

18.5 A parent or guardian may contact privacy@haarfen.com concerning information relating to their child. We may require evidence of identity, parental responsibility or authority before taking action.

19. Who we share personal information with

Haarfen may share personal information with the following categories of recipient.

19.1 Shopify and ecommerce providers

Shopify provides core website, checkout, account, hosting and ecommerce infrastructure.

Shopify may process information as Haarfen's processor and may act as an independent controller for certain activities described in its own privacy information.

19.2 Payment and finance providers

This includes:

• card processors
• digital-wallet providers
• PayPal
• Klarna
• Clearpay
• PayPal Credit
• banks
• acquiring banks; and
• fraud-prevention services.

19.3 Product suppliers

Where a supplier fulfils an order directly or helps resolve a Product issue, we may share:

• customer name
• delivery address
• telephone number
• email address
• order details
• access instructions
• delivery requirements; and
• relevant complaint or return information.

19.4 Warehouses and fulfilment providers

We may share information required to:

• pick and pack orders
• prepare delivery
• coordinate collections
• inspect returned Products; and
• manage stock.

19.5 Delivery and collection providers

This includes:

• parcel couriers
• specialist two-person delivery providers
• freight operators
• local delivery companies
• returns carriers; and
• collection partners.

They may contact you directly to schedule or complete delivery or collection.

19.6 Installers, assemblers, repairers and inspectors

We may share the information required to provide an agreed service or investigate a Product issue.

19.7 Customer-service and communications providers

This may include providers of:

• email
• telephone systems
• call recording
• SMS
• WhatsApp
• live chat
• chatbot services; and
• helpdesk software.

19.8 Analytics and advertising providers

This may include:

• Google
• Meta
• Pinterest
• Shopify; and
• other providers disclosed through our cookie controls.

Optional sharing for advertising and tracking is subject to applicable consent requirements.

19.9 Review, survey and promotion providers

We may share limited information necessary to administer reviews, surveys, competitions or prize fulfilment.

19.10 Professional advisers

This includes:

• accountants
• auditors
• solicitors
• insurers
• tax advisers
• consultants; and
• debt-recovery providers.

19.11 Government and regulatory bodies

We may disclose information to:

• HM Revenue & Customs
• Companies House
• the Information Commissioner's Office
• courts
• tribunals
• law-enforcement agencies
• trading standards
• consumer-protection bodies; and
• other authorised public authorities.

19.12 Business restructuring recipients

Relevant information may be disclosed to prospective or actual:

• purchasers
• investors
• lenders
• insurers
• administrators
• insolvency practitioners
• group companies; or
• professional advisers

where Haarfen or part of its business is being sold, merged, reorganised, refinanced or transferred.

Such disclosures will be limited to what is reasonably necessary and will be subject to appropriate confidentiality and data-protection safeguards.

19.13 Other recipients

We may disclose information:

• where you have instructed or authorised us to do so
• where necessary to protect life or safety
• to establish or defend legal rights; or
• where otherwise permitted or required by law.

We do not sell personal information for money.

20. Responsibilities of suppliers and service partners

20.1 Some recipients act only on Haarfen's instructions as data processors.

20.2 Others, including certain couriers, payment providers, advertising platforms and finance providers, may act as independent controllers for their own regulated or operational activities.

20.3 Where a provider acts as a processor, Haarfen will require appropriate contractual obligations concerning:

• confidentiality
• security
• permitted use
• sub-processors
• deletion or return of information
• international transfers; and
• assistance with data-protection compliance.

20.4 Haarfen does not authorise suppliers, couriers or fulfilment partners to use customer information for unrelated marketing.

21. International transfers

21.1 Haarfen is established in the United Kingdom, but Shopify and other payment, hosting, communications, analytics, advertising and technology providers may process information in other countries.

21.2 Where personal information is transferred outside the United Kingdom, Haarfen will use an available lawful transfer mechanism.

This may include:

• UK adequacy regulations
• the UK International Data Transfer Agreement
• the UK Addendum to approved European Union standard contractual clauses
• binding corporate rules
• an approved certification or code
• another legally permitted safeguard; or
• a limited statutory exception where appropriate.

21.3 Where required, Haarfen or the relevant provider will assess whether the information will receive a standard of protection that is not materially lower than the UK standard and will introduce additional contractual, organisational or technical safeguards where needed.

21.4 International-transfer safeguards currently recognised by the ICO include adequacy regulations, the UK IDTA, the Addendum and binding corporate rules, together with an appropriate transfer-risk assessment where required.

22. Information security

22.1 Haarfen uses reasonable technical and organisational measures designed to protect personal information against:

• unauthorised access
• loss
• misuse
• alteration
• disclosure
• accidental destruction; and
• unlawful processing.

22.2 Measures may include:

• access controls
• account authentication
• restricted staff permissions
• secure cloud services
• encryption in transit
• payment-provider security
• logging and monitoring
• supplier due diligence
• confidentiality obligations
• staff training
• backups; and
• incident-response procedures.

22.3 Access is limited to people and providers who reasonably need the information for their role.

22.4 No internet transmission or information-storage system can be guaranteed to be completely secure.

22.5 You are responsible for:

• keeping account credentials confidential
• using a strong and unique password
• signing out from shared devices; and
• notifying Haarfen promptly of suspected unauthorised account access.

23. How long we keep personal information

Haarfen keeps personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, tax, accounting, fraud-prevention and dispute-resolution requirements.

23.1 Customer accounts

Account information may be retained while the account remains active.

Optional account information may be deleted or anonymised after three years without a login, purchase or other meaningful account activity, following reasonable notice where practicable.

Closing an account does not require Haarfen to delete transactional records that must still be retained.

23.2 Orders, invoices and accounting records

Order, invoice, payment, VAT and related transactional records will normally be retained for six years from the end of the relevant company financial year, or longer where required for a tax enquiry, compliance check or other legal obligation. HMRC states that limited companies generally need to keep relevant company and accounting records for six years from the end of the financial year to which they relate.

23.3 Customer-service and complaint records

Customer-service correspondence, live chats, complaint files, return evidence and dispute records may be retained for up to six years after the matter is closed.

They may be retained longer where required for an active legal claim, investigation or enforcement matter.

23.4 Call recordings

Routine call recordings are retained for up to 12 months.

A relevant recording may be preserved for longer where connected to an unresolved complaint, chargeback, investigation, safety incident or legal claim.

23.5 Marketing records

Marketing contact details may be retained while marketing remains active and lawful.

Consent and preference records may be retained for as long as reasonably necessary to demonstrate compliance.

A minimal suppression record may be retained after an opt-out so that Haarfen does not contact you again through that channel unintentionally.

23.6 Website and security information

Website, technical, account-security and fraud-prevention logs are retained according to their purpose, sensitivity and risk.

Relevant security or fraud records may be kept for up to six years after the transaction or investigation, or longer where an active claim requires it.

23.7 Accessibility and health information

Practical accessibility information will normally be deleted or restricted after the relevant delivery, collection or support service is completed.

It may be retained for longer where necessary for an ongoing complaint, safety matter or legal claim.

23.8 Identity-verification documents

Additional identity documents collected for a privacy request or unusual transaction will be deleted when verification and any associated issue have been completed, unless continued retention is legally necessary.

23.9 Competition and survey records

Competition and survey information will be retained for the period required to administer the activity, verify its outcome, respond to complaints and comply with applicable rules.

23.10 Reviews

A published review may be retained while it remains relevant and lawful.

Purchase-verification and moderation records may be kept for as long as reasonably necessary to establish the authenticity and history of the review.

23.11 Legal holds

Normal deletion periods are suspended where information is required for:

• litigation
• a complaint
• an investigation
• an audit
• a chargeback
• suspected fraud
• regulatory action; or
• another legal hold.

UK data-protection law requires retention periods to be justified and personal information not to be kept indefinitely without a continuing purpose.

24. Your data-protection rights

Depending on the circumstances, you may have the following rights.

24.1 Right to be informed

You have the right to receive clear information about how Haarfen collects and uses your personal information.

24.2 Right of access

You may request confirmation of whether Haarfen processes your information and request a copy of relevant personal information.

24.3 Right to rectification

You may ask us to correct inaccurate information or complete information that is incomplete.

24.4 Right to erasure

You may ask us to delete personal information in circumstances where the right applies.

The right is not absolute. We may retain information where it remains necessary for:

• a legal obligation
• an active contract
• accounting or tax
• fraud prevention
• freedom of expression
• public-interest purposes; or
• legal claims.

24.5 Right to restrict processing

You may request restriction of processing in circumstances provided by law.

24.6 Right to data portability

Where processing is automated and based on consent or contract, you may be entitled to receive information you provided in a structured, commonly used and machine-readable format or ask for it to be sent to another controller where technically feasible.

24.7 Right to object

You may object to processing based on legitimate interests.

We may continue where there are compelling legitimate grounds that override your interests, rights and freedoms, or where processing is required for legal claims.

24.8 Absolute right to object to direct marketing

You have an absolute right to object at any time to:

• direct marketing; and
• profiling related to direct marketing.

Once an objection is received, Haarfen will stop the relevant marketing.

24.9 Right to withdraw consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not make processing carried out before withdrawal unlawful.

24.10 Rights relating to automated decisions

Where applicable, you may request human involvement, express your point of view and challenge a solely automated decision having a legal or similarly significant effect.

24.11 Right to complain

You may complain directly to Haarfen and may also raise a concern with the Information Commissioner's Office.

These rights are subject to applicable conditions, exemptions and limitations. Rights requests normally require a response within one calendar month once any reasonably necessary verification has been received, although a lawful extension may apply to complex or multiple requests.

25. How to exercise your rights

25.1 Send your request to:

privacy@haarfen.com

25.2 Please provide:

• your full name
• relevant contact details
• your order or account number where applicable
• the right you wish to exercise; and
• sufficient information to help us identify the relevant records.

25.3 You do not need to use a particular form.

25.4 A request may be made verbally or in writing, although written requests usually provide a clearer record.

26. Identity and authority verification

26.1 Haarfen may require reasonable evidence of identity before:

• disclosing personal information
• deleting an account
• changing significant account information
• transferring information; or
• acting on a request made by a representative.

26.2 We will use existing account or order information where that provides sufficient verification.

26.3 Additional identification will be requested only where reasonably necessary and proportionate to the risk.

26.4 Where someone acts for another person, we may require evidence of:

• authority
• power of attorney
• parental responsibility
• executorship; or
• another relevant legal relationship.

26.5 Haarfen may withhold disclosure until identity and authority are adequately verified.

26.6 Verification documents will be protected and deleted when no longer required.

27. Fees and excessive requests

27.1 Haarfen will normally deal with a privacy-rights request free of charge.

27.2 Where a request is manifestly unfounded or excessive, Haarfen may:

• refuse all or part of the request
• ask you to narrow or clarify it; or
• charge a reasonable administrative fee where permitted by law.

27.3 Haarfen will assess the circumstances individually and document the decision.

27.4 A request will not be refused merely because it is inconvenient or time-consuming.

27.5 If we refuse or charge for a request, we will explain the reasons and inform you of your right to complain to the ICO.

The ICO states that the threshold is high but permits refusal or a reasonable administrative fee for manifestly unfounded or excessive requests.

28. Data-protection complaints

28.1 You may complain about any aspect of Haarfen's processing by emailing:

privacy@haarfen.com

28.2 Please include:

• your full name
• your contact information
• the nature of the complaint
• relevant dates
• relevant order or account details; and
• any supporting evidence.

28.3 Haarfen will:

• provide a clear route for making the complaint
• acknowledge receipt within 30 days
• take appropriate steps to investigate without undue delay
• keep you appropriately informed; and
• communicate the outcome without undue delay.

28.4 We may request further information where necessary to understand or investigate the complaint.

28.5 A complaint and a privacy-rights request may be handled as related but separate matters where appropriate.

These complaint-handling requirements have applied to organisations since 19 June 2026.

29. Complaining to the Information Commissioner

You have the right to complain to the UK Information Commissioner's Office.

You are encouraged to contact Haarfen first so that we have an opportunity to investigate and resolve the matter, but this does not restrict your right to contact the ICO.

30. Changes to this Privacy Policy

30.1 Haarfen may update this policy to reflect changes in law, operations, technology, providers or processing.

30.2 The public policy will show its effective date, version and last-reviewed date.

30.3 Material new processing will be brought to affected individuals' attention before it begins where required.

30.4 Previous versions will be retained internally. A later version does not retrospectively change an accepted sales contract.

31. Contact details

For privacy requests, objections, consent withdrawals or data-protection complaints:

Back to Terms & Policies