privacy policy

Privacy Policy

Last updated: 5 October 2026

HAMISH THWAITES LTD ("we", "us", "our") respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and share personal information when you visit or make a purchase from our website, hamishthwaites.com (the "Website"), or otherwise interact with us.

We are based in the United Kingdom and currently sell our products primarily to customers in the UK.

1. Who we are

The company responsible for your personal information is:

HAMISH THWAITES LTD
Company number: 17033664
167–169 Great Portland Street
5th Floor
London
W1W 5PF
United Kingdom

For privacy-related questions or requests, you can contact us at:

info@hamishthwaites.com

For the purposes of applicable UK data protection law, including the UK GDPR and the Data Protection Act 2018, HAMISH THWAITES LTD is the controller of the personal information we collect and use in connection with our Website and services.

2. Personal information we collect

When you use our Website, place an order, contact us, or sign up to receive marketing communications, we may collect the following information.

Information you provide to us

This may include:

• Your name
• Billing and delivery address
• Email address
• Telephone number
• Payment and transaction information
• Information you provide when contacting us
• Your marketing preferences
• Information you provide in connection with an order, return, refund or other customer service enquiry

We do not currently require customers to create an account to purchase from our Website.

Information collected automatically

When you visit our Website, certain information may be collected automatically through Shopify and other technologies. This may include:

• IP address
• Browser and device information
• Operating system
• Approximate location derived from technical information
• Pages and products viewed
• Referring website or source
• Information about how you interact with the Website
• Information about your shopping activity, such as products added to your cart
• Cookie and similar technology information

Some of this information is collected through cookies and similar technologies. See the Cookies and similar technologies section below.

3. How we use your information

We use personal information for the following purposes:

Processing and fulfilling orders

We use your information to:

• Process and fulfil purchases
• Process payments
• Deliver products
• Provide order confirmations and updates
• Process returns, refunds and exchanges
• Provide customer service
• Communicate with you about your orders

Operating and improving our Website

We may use information to:

• Operate and maintain our Website
• Understand how customers use our Website
• Improve our products, services and customer experience
• Detect technical problems
• Maintain the security of our Website and systems

Marketing

Where you have provided the appropriate consent or where otherwise permitted by applicable law, we may use your email address and other relevant information to send you marketing communications about our products, collections, offers and news.

Our email marketing is currently managed using Shopify Messaging.

You can unsubscribe from marketing emails at any time by using the unsubscribe link in the relevant communication or by contacting us.

Advertising

We may use information and advertising technologies provided by Meta, including in connection with advertising on Instagram, to advertise our products, measure advertising performance and understand how our advertising campaigns perform.

Where required, non-essential advertising and tracking technologies are used only after you have provided the appropriate consent through our cookie consent mechanism.

Security and fraud prevention

We may process information to:

• Protect our Website and customers
• Detect and prevent fraud
• Detect suspicious or unauthorised activity
• Protect our business and systems

Legal and regulatory purposes

We may use and retain information where necessary to:

• Comply with legal or regulatory obligations
• Establish, exercise or defend legal claims
• Respond to lawful requests from authorities
• Maintain appropriate business, tax, accounting and transaction records

4. Our lawful bases for using your information

Under UK data protection law, we need a lawful basis for processing your personal information.

Depending on the circumstances, we rely on the following lawful bases:

Where we rely on legitimate interests, we consider those interests against your rights and interests and do not use your information where those interests are overridden by your rights.

5. Payments

Payments made through our Website are processed using third-party payment services.

Our current payment providers include:

• Shopify Payments
• PayPal

Depending on the payment method you choose, Shopify may make additional payment methods available, including card payments, Shop Pay, Google Pay and Klarna.

We do not generally receive or store your full payment card details ourselves. Payment information is processed by the relevant payment provider in accordance with its own privacy and security practices.

For more information, please refer to the privacy policies of the relevant payment provider.

6. Shopify

Our Website is hosted and operated using Shopify.

Shopify provides the ecommerce infrastructure that allows us to operate our Website, process orders, manage customer information and provide certain analytics, security and other services.

Shopify may process personal information on our behalf and may also process certain information for its own purposes in accordance with its own privacy policies and terms.

You can read Shopify's Privacy Policy for more information.

7. Shopify Network Intelligence

We currently have Shopify Network Intelligence enabled.

Shopify describes Network Intelligence as a service through which customer data may be used with other Shopify data to improve Shopify products, advertising targeting and personalisation.

Shopify may therefore process certain customer information for these purposes in accordance with Shopify's terms and privacy practices.

Where applicable, you can learn more about Shopify's use of information through Shopify's Privacy Policy and Shopify's relevant privacy and service documentation.

8. Marketing and Instagram advertising

We may advertise our products on Instagram and use services provided by Meta to manage, deliver or measure advertising.

This may involve the processing of information such as:

• Website interactions
• Products viewed
• Purchases
• Advertising interactions
• Device or technical information
• Information used to measure advertising effectiveness

The exact information processed may depend on the advertising tools and integrations we use at any particular time.

We will update this Privacy Policy if we introduce additional advertising technologies or services that materially change how personal information is processed.

You can also control non-essential cookies and similar technologies through our cookie consent settings.

9. Cookies and similar technologies

Our Website uses cookies and similar technologies.

Some cookies are necessary for the Website to function, including technologies required for things such as:

• Shopping cart functionality
• Checkout
• Payment processing
• Security
• Remembering essential Website settings

Other cookies or similar technologies may be used for purposes such as:

• Analytics
• Personalisation
• Advertising
• Measuring advertising performance

Where required by law, we will ask for your consent before using non-essential cookies or similar technologies.

Our Website currently uses Shopify's cookie consent mechanism, which allows visitors to accept, decline or manage their cookie preferences.

You can change your preferences through the cookie settings available on our Website.

We do not currently use Google Analytics or Google Ads.

If we introduce these or other significant analytics or advertising technologies in the future, we will update our privacy and cookie information as appropriate.

The ICO's current guidance confirms that non-essential storage and access technologies generally require appropriate information and consent where required under PECR.

10. Newsletter and marketing communications

If you choose to subscribe to our marketing communications, we may collect and use your email address to send you information about:

• New products
• New collections
• Offers
• Promotions
• Brand news
• Other relevant updates

We currently use Shopify Messaging to send marketing emails.

You can unsubscribe at any time using the unsubscribe link included in our marketing emails.

If you unsubscribe, we may retain a limited record of your preference so that we can respect your request and avoid sending you unwanted marketing communications.

11. Who we share your information with

We may share personal information with trusted third parties where necessary to operate our business and provide our services.

These may include:

• Shopify
• Shopify Payments
• PayPal
• Delivery and fulfilment providers
• Email and marketing service providers, including Shopify Messaging
• Advertising and measurement providers, including Meta
• IT, security and technology service providers
• Professional advisers such as accountants, lawyers or insurers
• Government bodies, regulators or law enforcement authorities where required by law

We only share information where there is an appropriate reason to do so and, where applicable, appropriate contractual and data protection safeguards are in place.

12. International transfers

Some of the companies and service providers we use may process personal information outside the United Kingdom.

Where personal information is transferred outside the UK, we will take appropriate steps to ensure that the transfer is made in accordance with applicable UK data protection law.

Depending on the circumstances, this may include relying on:

• UK adequacy regulations;
• appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses; or
• another lawful transfer mechanism permitted under applicable law.

The ICO's current guidance requires organisations to consider whether international transfers are restricted transfers and, where applicable, put appropriate safeguards in place.

13. How long we keep your information

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected.

The length of time we retain information depends on the type of information and why we need it.

For example:

• Order and transaction information may be retained for as long as necessary to manage orders, returns, refunds, disputes and our business records.
• Financial and accounting information may be retained where necessary to comply with tax, accounting and other legal requirements.
• Customer service enquiries may be retained for as long as reasonably necessary to deal with the enquiry and any related matters.
• Marketing information is generally retained while you remain subscribed. If you unsubscribe, we may retain a limited suppression record to ensure we do not send you further marketing communications.
• Cookie and technical information may be retained in accordance with the relevant technology or service provider's settings and the purposes for which it is used.
• We may retain certain information for longer where necessary to establish, exercise or defend legal claims or comply with legal obligations.

We regularly review the information we hold and delete or anonymise information when it is no longer reasonably necessary.

14. Your data protection rights

Depending on the circumstances and subject to applicable law, you may have rights in relation to your personal information, including the right to:

• Request access to the personal information we hold about you
• Ask us to correct inaccurate or incomplete information
• Ask us to delete your personal information
• Ask us to restrict how we use your personal information
• Object to certain uses of your personal information
• Request portability of certain personal information
• Withdraw consent where we rely on consent to process your information
• Object to direct marketing

These rights are not absolute and may be subject to legal exceptions.

If you wish to exercise a right or ask a question about how we use your information, contact us at:

info@hamishthwaites.com

We may need to ask for information to verify your identity before fulfilling certain requests.

15. Marketing preferences

You can unsubscribe from our marketing communications at any time by clicking the unsubscribe link in our emails.

You can also contact us at info@hamishthwaites.com to ask us to stop sending marketing communications.

Even if you opt out of marketing, we may still send you essential communications relating to orders or other transactions, such as order confirmations, delivery updates or information about your purchases.

16. Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

However, no method of transmitting or storing information online can be guaranteed to be completely secure.

Where we use third-party service providers, we take reasonable steps to ensure that they provide appropriate safeguards for personal information.

17. Children's privacy

Our Website is not directed at children, and we do not knowingly collect personal information from children for the purpose of marketing or advertising.

If you believe that a child has provided us with personal information, please contact us at info@hamishthwaites.com so that we can consider the appropriate action.

18. Third-party websites

Our Website may contain links to third-party websites, services or social media platforms, including Instagram.

If you follow a link to another website or service, that website will have its own privacy policy and terms.

We are not responsible for the privacy practices of third-party websites or services.

We recommend reviewing their privacy policies before providing them with personal information.

19. Complaints

If you have concerns about how we have handled your personal information, please contact us first at:

info@hamishthwaites.com

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).

Information Commissioner's Office (ICO)

You do not have to contact us before complaining to the ICO, although we would appreciate the opportunity to try to resolve your concerns first.

20. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our business, Website, services, technology or legal requirements.

When we make changes, we will update the "Last updated" date at the top of this Privacy Policy.

Where required, we will provide additional notice of significant changes before they take effect.

The ICO recommends regularly reviewing privacy information and updating it when new uses of personal information are introduced.

21. Contact us

If you have any questions about this Privacy Policy or how we use your personal information, please contact:

HAMISH THWAITES LTD
167–169 Great Portland Street
5th Floor
London
W1W 5PF
United Kingdom

Email: info@hamishthwaites.com