Privacy Policy

Half Moon Bay Limited

Last updated: 17 June 2026

This Privacy Policy explains how Half Moon Bay Limited collects, uses, stores and shares personal information when you visit or shop at www.halfmoonbayshop.co.uk, create an account, subscribe to marketing, contact us, or otherwise interact with us.

We are committed to protecting your personal information and handling it fairly, lawfully and transparently in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.

1. Who we are

Half Moon Bay Limited is the controller of your personal information.

Legal name: Half Moon Bay Limited
Company number: 03129562
Trading name: Half Moon Bay
Registered office: 12b George Street, Bath, United Kingdom, BA1 2EH
Website: www.halfmoonbayshop.co.uk
Email: help@halfmoonbay.co.uk
Telephone: 01225 473873

We have not appointed a Data Protection Officer. Any privacy or data protection questions should be sent to:

Email: help@halfmoonbay.co.uk
Postal address: Half Moon Bay Limited, 12b George Street, Bath, United Kingdom, BA1 2EH

2. What this policy covers

This policy applies to personal information we collect about:

• visitors to our website;

• customers who place orders online;

• customers who create website accounts;

• customers who use guest checkout;

• people who contact us by email, telephone or other channels;

• people who subscribe to email or SMS marketing;

• people whose information is provided to us by recruitment agencies.

This policy does not cover third-party websites, platforms or services that we do not control. Where our website links to third-party websites, you should read their own privacy notices.

3. Personal information we collect

We may collect and use the following types of personal information.

Type of information	Examples
Identity information	Name, username or account name, date of birth where requested
Contact information	Email address, telephone number, delivery address and, where provided during checkout, billing address
Account information	Login details, account preferences, saved details and account activity
Order information	Products ordered, purchase history, delivery details, returns, refunds and customer service records
Payment information	Payment method, transaction confirmation, payment status and fraud-screening information. We do not intentionally store full card details; these are processed by our payment provider(s). Shopify Payments, Paypal
Marketing information	Email and SMS marketing preferences, consent records, unsubscribe records, message open and click information
Website and device information	IP address, browser type, device type, time zone, pages viewed, products viewed, referring website or search terms, interactions with the site and cookie identifiers
Communications information	Emails, call records, customer service correspondence and information you provide when contacting us
Recruitment information	Candidate details provided by third-party recruitment agencies, such as CV details, contact details, work history and interview notes, where applicable

We do not knowingly collect special category information through our consumer website, such as health information, racial or ethnic origin, religious beliefs, trade union membership or biometric data. If special category information is provided to us in a recruitment context, we will only use it where necessary and where we have a lawful basis and condition for processing.

4. How we collect your information

We collect personal information when:

• you visit or browse our website;

• you create an account;

• you place an order;

• you use guest checkout;

• you sign up to receive email or SMS marketing;

• you contact us by email, telephone or another channel;

• you interact with our marketing messages;

• cookies, pixels and similar technologies are used on our website;

• third-party recruitment agencies provide candidate information to us.

Some information is collected directly from you. Some information is collected automatically when you use our website. Some information may be provided by service providers, such as Shopify, payment providers, courier services, marketing platforms and recruitment agencies.

5. How we use your information and our lawful bases

We only use your personal information where we have a lawful basis to do so.

Purpose	Personal information used	Lawful basis
To provide and operate our website	Website, device, technical and cookie information	Legitimate interests and, where required for non-essential cookies, consent
To create and manage customer accounts	Identity, contact and account information	Contract and legitimate interests
To process online orders	Identity, contact, order, delivery and payment information	Contract
To arrange delivery	Name, delivery address, telephone number, email address and order information	Contract and legitimate interests
To process payments, refunds and fraud checks	Payment, order, identity, contact and transaction information	Contract, legitimate interests and legal obligation
To provide customer support	Contact, order and communications information	Contract and legitimate interests
To manage returns, refunds, complaints and disputes	Order, payment, contact and communications information	Contract, legitimate interests and legal obligation
To send email marketing	Name, email address, marketing preferences and order history	Consent, or where permitted, the PECR soft opt-in
To send SMS marketing	Name, telephone number and marketing preferences	Consent, or where permitted, the PECR soft opt-in
To manage unsubscribes and suppression lists	Email address, telephone number and marketing preferences	Legal obligation and legitimate interests
To analyse website performance	Website, device, analytics and cookie information	Consent for non-essential analytics cookies
To measure and personalise advertising	Website, device, order, marketing and cookie/pixel information	Consent for advertising cookies and pixels
To improve our products, website and services	Order history, website usage, customer feedback and customer service information	Legitimate interests
To comply with accounting, tax and legal obligations	Order, payment, customer and accounting records	Legal obligation
To protect our business, website and customers	Technical, order, payment and fraud-prevention information	Legitimate interests and legal obligation
To assess recruitment candidates received through agencies	Candidate information provided by recruitment agencies	Legitimate interests and steps prior to entering into an employment contract
To establish, exercise or defend legal claims	Relevant customer, order, communication, recruitment or business records	Legitimate interests and legal obligation

Where we rely on legitimate interests, we have considered whether our interests are overridden by your rights and freedoms. You can object to processing based on legitimate interests in certain circumstances.

6. Marketing

We may send you marketing by email or SMS where you have actively opted in, or where we are otherwise permitted to do so under applicable law.

Marketing may include information about our products, offers, promotions, events and updates.

You can opt out of marketing at any time by:

• clicking the unsubscribe link in our emails;

• following the opt-out instructions in our SMS messages, such as replying STOP where available;

• contacting us at help@halfmoonbay.co.uk.

If you opt out, we may keep a suppression record of your email address or telephone number so that we do not send you further marketing.

Opting out of marketing does not affect service messages relating to your orders, deliveries, account, payments, returns or legal notices.

7. Cookies and similar technologies

Our website uses cookies, pixels, tags and similar technologies.

Cookies are small files placed on your device. Pixels and tags are technologies that can record information about how you interact with a website or message.

We use the following categories of cookies and similar technologies:

Category	Purpose	Consent required?
Strictly necessary cookies	To operate the website, enable checkout, maintain baskets, support login, provide security, prevent fraud and remember cookie choices	No, but we still provide information about them
Analytics cookies	To understand how visitors use the website, which pages and products are viewed, and how the website performs	Yes, unless a specific legal exemption applies
Advertising and retargeting cookies/pixels	To measure advertising, understand campaign performance, build audiences and show relevant ads on platforms such as Google, Meta/Facebook and TikTok	Yes
Marketing tracking technologies	To understand whether marketing emails or messages are opened or clicked	Consent where required

We use Shopify to operate our ecommerce website and cookie consent tools. We also use Google Analytics 4, Google Ads, Meta/Facebook Pixel and TikTok Pixel.

Non-essential analytics and advertising cookies or pixels should not be set unless you have given consent through our cookie banner or cookie preference tool.

You can change your cookie choices at any time using the cookie settings available on our website.

You can also control cookies through your browser settings. Blocking some cookies may affect how the website works, including basket, checkout or account functionality.

8. Who we share personal information with

We may share personal information with trusted third parties where necessary for the purposes described in this policy.

These include:

Recipient	Purpose
Shopify	Ecommerce platform, website hosting, checkout, account functionality, marketing tools, analytics support and cookie consent tools
Payment provider(s)	Processing payments, refunds and fraud checks. [Insert payment provider names before publishing]
Sage 200 and related support providers	Order management, accounting, customer service, financial administration and business records
Royal Mail and delivery partners	Delivering orders, tracking parcels and resolving delivery issues
Google	Analytics, advertising measurement and Google Ads services
Meta/Facebook	Advertising measurement, retargeting and Meta Pixel services
TikTok	Advertising measurement, retargeting and TikTok Pixel services
Email and SMS service providers	Sending and managing marketing communications, where enabled
Recruitment agencies	Candidate sourcing and recruitment administration
Professional advisers	Legal, tax, accounting, audit, insurance and business advice
Regulators and public authorities	Where required by law, including HMRC, law enforcement bodies, courts and regulators
Business transaction parties	Where necessary in connection with a sale, merger, restructuring or transfer of our business or assets

We require service providers acting on our behalf to handle personal information securely and only in accordance with our instructions, unless they act as independent controllers under applicable law.

Some third-party services, such as Shopify, payment providers, Google, Meta and TikTok, may also process personal information as independent controllers for certain purposes. Their own privacy policies will apply to that processing.

9. International transfers

We are based in the United Kingdom.

Some of our service providers are global businesses and may process personal information outside the UK. This may include Shopify, Google, Meta, TikTok and payment providers.

Where personal information is transferred outside the UK, we will ensure that appropriate safeguards are in place. These may include:

• an adequacy regulation confirming that the destination country provides adequate protection;

• the UK International Data Transfer Agreement;

• the UK Addendum to the EU Standard Contractual Clauses;

• equivalent contractual safeguards approved under applicable data protection law;

• other lawful transfer mechanisms.

You can contact us if you would like further information about the safeguards used for international transfers.

10. How long we keep your information

We keep personal information only for as long as needed for the purposes described in this policy, including to meet legal, accounting, tax, reporting and dispute-resolution requirements.

Our usual retention periods are:

Type of information	Retention period
Customer account information	Up to 5 years after account closure or last meaningful account activity, unless we need to keep it longer for legal, tax, accounting or dispute purposes
Order, transaction, tax and accounting records	6 years from the end of the financial year to which the records relate, or longer if required by law, dispute, investigation or tax enquiry
Customer service communications	Up to 5 years after the issue is resolved, unless needed longer for legal or dispute purposes
Marketing consent and preference records	While you remain subscribed and for up to 5 years after your last interaction with us, unless withdrawn earlier
Marketing suppression records	As long as needed to ensure we respect your opt-out
Cookie consent records	For as long as needed to demonstrate your cookie choices and comply with applicable law
Website analytics information	In line with our analytics settings and cookie durations.
Recruitment records for unsuccessful candidates	Usually up to 12 months after the recruitment process ends, unless you agree that we may keep your details for future opportunities
Recruitment records for successful candidates	Transferred to employee records and handled under our employee privacy notice

When we no longer need personal information, we will delete it, anonymise it or securely archive it.

11. Your rights

You have rights under data protection law. These may include:

• the right to be informed about how we use your personal information;

• the right of access to your personal information;

• the right to correct inaccurate or incomplete personal information;

• the right to request deletion of your personal information;

• the right to restrict how we use your personal information;

• the right to object to certain uses of your personal information;

• the right to data portability;

• the right to withdraw consent at any time, where we rely on consent;

• rights relating to automated decision-making and profiling;

• the right to complain to us and to the Information Commissioner’s Office.

These rights are not absolute and may depend on the circumstances and the lawful basis we rely on.

To exercise your rights, contact us at:

Email: help@halfmoonbay.co.uk
Post: Half Moon Bay Limited, 12b George Street, Bath, United Kingdom, BA1 2EH

We may need to verify your identity before responding to a request.

We will usually respond to data rights requests within one month. If a request is complex or we receive multiple requests, we may extend the response period where permitted by law.

12. Complaints

If you are unhappy with how we have handled your personal information, please contact us first so that we can try to resolve the issue.

You can complain to us by email, telephone or post using the contact details in this policy.

We will acknowledge data protection complaints within 30 days and respond without undue delay after making appropriate enquiries. We will keep you informed where we need more time.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

You can also make a complaint through the ICO’s website. The ICO says organisations must have a data protection complaints process, with the new statutory requirements taking effect from 19 June 2026, and GOV.UK confirms the ICO’s contact details. (ICO)

13. Automated decision-making and profiling

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

We may use limited profiling for marketing and advertising purposes, such as showing more relevant adverts or understanding customer interests, but only where permitted by law and, where required, with your consent.

You can object to profiling for direct marketing at any time.

14. Children

Our website is aimed at adults. We do not knowingly collect personal information from children under 13.

If we become aware that we have collected personal information from a child under 13 without appropriate consent, we will take steps to delete it.

15. Security

We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures include access controls, secure systems, supplier due diligence and internal procedures for handling personal information.

No website or online service can be completely secure. You are responsible for keeping your account login details confidential and for telling us promptly if you believe your account has been compromised.

16. Third-party links

Our website may include links to third-party websites, platforms or services.

We are not responsible for the privacy practices of third parties. You should read their privacy policies before providing personal information to them.

17. Changes to this policy

We may update this Privacy Policy from time to time.

When we make significant changes, we will take appropriate steps to bring them to your attention, such as updating the notice on our website or contacting you where required.

The latest version will always be available on our website.

.