Privacy policy

Coral-London — Privacy Policy
Last updated: [date]

Coral-London ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect when you visit corallondon.com or place an order, why we collect it, how we use it, who we share it with, and what rights you have, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this policy carefully. By using our Site, you acknowledge the practices described here.

1. WHO WE ARE (THE "DATA CONTROLLER")

Coral-London, operated by [your legal business name], is the data controller responsible for your personal data.

- Business address: [address]
- Email: corallondonofficial@gmail.com
- Data protection contact: [name/role, or "our customer service team" if you don't have a dedicated DPO]

2. WHAT PERSONAL DATA WE COLLECT

We collect the following categories of personal data:

a) Identity and contact data: full name, email address, delivery address, billing address, telephone number.

b) Order and transaction data: items purchased, order value, order history, payment confirmation status (we do not collect or store your full card number, CVV, or expiry date — this is handled entirely by our PCI-DSS-compliant payment processor).

c) Account data: username, password (encrypted), account preferences, wishlist items, if you create an account.

d) Technical and usage data: IP address, browser type and version, device type, operating system, pages visited, time spent on pages, referral source, and other analytics collected via cookies (see Section 6).

e) Marketing and communication data: your preferences for receiving marketing from us, and your communication history (e.g. emails opened/clicked, if using an email marketing platform).

f) Customer service data: any information you provide when contacting us, including complaints, returns, and correspondence.

We do not knowingly collect any "special category" data (e.g. health, religion, ethnicity) unless you voluntarily provide it to us (for example, in a customer service message), and we do not use such data for any purpose beyond resolving your query.

3. HOW WE COLLECT YOUR DATA

We collect data:
- Directly from you, when you create an account, place an order, sign up for our newsletter, enter a competition, or contact customer service.
- Automatically, through cookies and similar tracking technologies when you browse the Site (see Section 6).
- From third parties, such as our payment processor confirming a successful transaction, or our shipping carrier providing delivery status updates.

4. WHY WE USE YOUR DATA AND OUR LEGAL BASIS

Purpose | Legal basis under UK GDPR
Processing and fulfilling your order | Performance of a contract
Customer service and handling returns/complaints | Performance of a contract / Legitimate interests
Sending order confirmations and shipping updates | Performance of a contract
Sending marketing emails/SMS about new products or offers | Consent (where you've opted in)
Improving our Site, products, and customer experience | Legitimate interests
Preventing fraud and abuse of promotional codes | Legitimate interests
Maintaining accounting and tax records | Legal obligation
Responding to legal requests from authorities | Legal obligation

Where we rely on consent (e.g. marketing communications), you can withdraw this at any time — see Section 9.

Where we rely on legitimate interests, we have considered that our processing is proportionate, expected, and does not override your rights and freedoms.

5. SHARING YOUR DATA

We do not sell your personal data. We share data only with trusted third parties who need it to help us run our business, including:

- Fulfilment and manufacturing partners, who need your name, address, and order details to prepare and ship your Products (this may involve transferring data to partners located outside the UK — see Section 7).
- Payment processors, to securely process your payment.
- E-commerce and hosting platform providers (e.g. Shopify), who host our Site and store order/account data on our behalf.
- Email/SMS marketing platforms, if you have opted into marketing communications.
- Analytics providers, to help us understand Site usage in aggregate.
- Delivery/courier companies, to deliver your order and provide tracking.
- Professional advisors and authorities, where required by law (e.g. HMRC for tax purposes, or law enforcement where legally compelled).

All third parties we share data with are contractually required to keep your data secure and to use it only for the purposes we specify.

6. COOKIES AND SIMILAR TECHNOLOGIES

Our Site uses cookies and similar technologies to make the Site work properly, understand how it's used, and, where you consent, to personalise marketing.

a) Strictly necessary cookies: required for core Site functionality, such as keeping items in your basket and enabling secure checkout. These cannot be switched off.

b) Analytics/performance cookies: help us understand how visitors use our Site (e.g. which pages are popular) so we can improve it. Used with your consent where required.

c) Marketing/advertising cookies: used to show you relevant ads on other platforms (e.g. social media) and to measure the effectiveness of our campaigns. Only used with your consent.

You can manage or withdraw your cookie consent at any time via our cookie banner/settings, or through your browser settings. Disabling certain cookies may affect the functionality of the Site.

7. INTERNATIONAL DATA TRANSFERS

Because Coral-London works with manufacturing and fulfilment partners, and uses service providers, that may be located outside the UK, your personal data (primarily name, address, and order details) may be transferred to and processed in countries outside the UK, which may have different data protection laws.

Where this happens, we ensure appropriate safeguards are in place, such as the UK's International Data Transfer Agreement (IDTA), UK-approved Standard Contractual Clauses, or transfers to countries with a UK adequacy decision, to ensure your data continues to be protected to a standard consistent with UK GDPR.

8. DATA RETENTION

We retain your personal data only for as long as necessary for the purposes described in this policy:

- Order and transaction records: typically retained for 6 years to comply with UK tax and accounting obligations.
- Account data: retained while your account remains active, and for a reasonable period after, in case you wish to reactivate it.
- Marketing data: retained until you unsubscribe or request deletion.
- Customer service correspondence: retained for a reasonable period to handle any follow-up queries or disputes.

When data is no longer needed, we securely delete or anonymise it.

9. DATA SECURITY

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including encrypted checkout (SSL/TLS), secure hosting via our e-commerce platform, restricted internal access to personal data, and use of PCI-DSS compliant payment processors. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

10. MARKETING COMMUNICATIONS AND YOUR CHOICES

If you've opted in to receive marketing emails or SMS from us, you can opt out at any time by:
- Clicking "unsubscribe" at the bottom of any marketing email
- Replying "STOP" to any marketing SMS
- Emailing us at corallondonofficial@gmail.com

Please note that even if you opt out of marketing, we will still send you essential transactional communications (e.g. order confirmations, shipping updates) related to any order you place.

11. AUTOMATED DECISION-MAKING

We do not use your personal data for any automated decision-making that produces legal or similarly significant effects on you (for example, we do not use automated profiling to deny you service).

12. CHILDREN'S PRIVACY

Our Site and Products are intended for adults. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us so we can delete it.

13. YOUR RIGHTS UNDER UK GDPR

As a UK data subject, you have the following rights regarding your personal data:

- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — ask us to correct inaccurate or incomplete data.
- Right to erasure ("right to be forgotten") — ask us to delete your data, subject to certain legal exceptions (e.g. we may need to retain order records for tax purposes).
- Right to restrict processing — ask us to limit how we use your data in certain circumstances.
- Right to data portability — request your data in a structured, commonly used, machine-readable format.
- Right to object — object to our processing based on legitimate interests, or to direct marketing at any time.
- Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of processing before withdrawal.
- Right to complain — lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk or by calling 0303 123 1113, if you believe we have not handled your data properly.

To exercise any of these rights, email us at corallondonofficial@gmail.com. We will respond within one month, as required by law. We may need to verify your identity before actioning certain requests.

14. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any updates will be posted on this page with a revised "last updated" date. We encourage you to review this policy periodically.

15. CONTACT US

If you have any questions about this Privacy Policy or how we handle your personal data, please contact:

Coral-London
Email: corallondonofficial@gmail.com
Address: [your business address]

You also have the right to contact the Information Commissioner's Office (ICO), the UK's independent regulator for data protection, at ico.org.uk.