Privacy policy

Privacy Policy

Last updated: 29 October 2026

1. Introduction

Kirkstall Investment Ltd, trading as Kirkstall Commerce ("Kirkstall Commerce", "we", "us" or "our"), operates the website kirkstallcommerce.co.uk and its associated online store, products, content, features and services (collectively, the "Services").

We are committed to protecting your privacy and handling your personal information responsibly, securely and transparently.

This Privacy Policy explains how we collect, use, store, share and protect your personal information when you visit our website, purchase products, create an account, subscribe to marketing communications or otherwise interact with our business.

We process personal information in accordance with applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended.

Our online store is powered by Shopify, which provides the technology used to operate our website and facilitate customer transactions.

For the purposes of applicable data protection legislation, Kirkstall Investment Ltd is the data controller responsible for personal information processed for our own business purposes.

Certain third-party providers, including Shopify, may act as independent data controllers for specific processing activities.

By using our Services, you acknowledge that you have been provided with this Privacy Policy. Where consent is legally required, we will seek it separately.

2. Personal Information We Collect

We may collect and process the following categories of personal information, depending on how you interact with our Services.

Contact Information

• Full name
• Email address
• Telephone or mobile number
• Billing address
• Delivery address
• Business name and business contact details

Account Information

• Customer account details
• Account preferences and settings
• Account authentication information
• Trade account information, where applicable
• Previous orders and account activity

Order and Transaction Information

• Products viewed or purchased
• Shopping cart contents
• Order history
• Payment and transaction details
• Payment method and confirmation
• Delivery and tracking information
• Returns, refunds and exchanges
• Customer communications relating to orders

Payments are handled through secure third-party payment providers. We do not ordinarily receive or store customers' complete payment card numbers.

Device and Website Usage Information

When you visit our website, we and our service providers may automatically collect:

• IP address
• Device type
• Browser type and version
• Operating system
• Network information
• Website pages visited
• Products viewed
• Shopping cart interactions
• Time spent on website pages
• Referral sources
• Advertising interactions
• Cookies and similar identifiers
• Approximate geographical location

Marketing Information

Where applicable, we may collect:

• Email and SMS marketing preferences
• Newsletter subscriptions
• Marketing consent records
• Email engagement information
• Advertising interactions
• Abandoned checkout information
• Customer interests and product preferences

Communications

We may retain information you provide when contacting us by email, telephone, website forms, social media or other communication channels.

This may include customer enquiries, complaints, feedback and correspondence.

3. Sources of Personal Information

We collect personal information from several sources.

Directly from you: When you place an order, create an account, subscribe to marketing communications, contact us or otherwise provide information.

Automatically through our website: Through cookies, analytics technologies, advertising tools and website functionality.

From service providers: Including Shopify, payment providers, delivery companies and other organisations assisting with our operations.

From business partners and third parties: Where permitted by law, including advertising platforms, customer service providers and business contacts.

From publicly available sources: Where relevant to legitimate business activities, such as publicly available business contact information.

Where we obtain personal information from third parties, we process it in accordance with applicable data protection requirements.

4. How We Use Your Personal Information

We may use personal information for the following purposes.

Processing and Fulfilling Orders

To process purchases, arrange payments, manage orders, organise deliveries, provide tracking information and handle returns, refunds and exchanges.

Customer Accounts

To create and manage customer accounts, maintain account preferences, provide account functionality and support trade customers.

Customer Service

To respond to enquiries, resolve complaints, provide product information and communicate with customers about their purchases.

Website Operation and Improvement

To maintain our website, improve functionality, analyse performance, understand customer preferences and develop our products and services.

Marketing and Advertising

To promote our products and services through email, SMS, online advertising and other marketing channels where permitted by applicable law.

This may include personalised advertising based on products viewed, previous purchases, shopping cart activity and interactions with our website.

Security and Fraud Prevention

To protect customer accounts, identify potentially fraudulent transactions, investigate suspicious activity and maintain the security of our business and Services.

Legal and Regulatory Compliance

To comply with accounting, taxation, consumer protection and other legal obligations, respond to lawful requests and establish, exercise or defend legal claims.

5. Lawful Bases for Processing Personal Information

Under the UK GDPR, we must have an appropriate lawful basis for processing personal information.

Depending on the purpose, we rely on the following lawful bases.

Performance of a Contract

We process personal information where necessary to fulfil an order, provide purchased products, arrange delivery, manage customer accounts or take steps requested before entering into a contract.

Legal Obligations

We process and retain certain information where necessary to comply with legal requirements, including accounting, taxation and regulatory obligations.

Legitimate Interests

We may process personal information where necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms.

Our legitimate interests may include:

• Operating and improving our business
• Providing customer support
• Preventing fraud
• Protecting our website and systems
• Understanding business performance
• Managing customer relationships
• Establishing or defending legal claims
• Conducting lawful business development and marketing activities

We assess the necessity and potential impact of processing activities where relying on legitimate interests.

Consent

Where required, we rely on your consent for activities such as:

• Non-essential cookies
• Certain analytics and advertising technologies
• Personalised advertising
• Email marketing
• SMS marketing

You may withdraw your consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Marketing Communications

Where applicable law permits marketing without express consent, including under relevant provisions of PECR, we may rely on an appropriate lawful basis under data protection legislation.

We will provide the required opportunity to opt out of marketing communications.

6. Relationship with Shopify

Our website and online store are powered by Shopify.

Shopify collects and processes personal information to provide and improve the Services, including website hosting, checkout functionality, customer accounts, transaction processing, security and related services.

Information submitted through our website may be transmitted to Shopify and relevant service providers, including organisations located outside the United Kingdom.

Shopify Enhanced Services

Shopify may provide enhanced services that use information about customer interactions with our store, other merchants and Shopify.

Where these services are enabled, Shopify may process personal information to provide features such as improved shopping experiences, fraud prevention, analytics and personalised advertising.

Shopify may combine information obtained from interactions across participating merchants and Shopify services for these purposes.

For certain enhanced services, Shopify is responsible for its own processing of personal information, including responding to applicable privacy rights requests.

You can learn more about Shopify's processing activities through its official privacy information:

Shopify Consumer Privacy Policy:
https://www.shopify.com/legal/privacy/app-users

Shopify Privacy Portal:
https://privacy.shopify.com/en

Where required by applicable law, we will obtain consent for relevant Shopify enhanced services and provide appropriate options to withdraw consent.

7. Third-Party Service Providers

We use third-party organisations to help operate our business.

These may include:

• Shopify and associated ecommerce services
• Payment processing providers
• Delivery and courier companies
• Order management and fulfilment systems
• Email and SMS marketing platforms
• Website analytics providers
• Advertising platforms
• Customer review platforms
• Website development and technical support providers
• Accounting and professional advisers
• Cloud storage and data hosting providers

These organisations may receive personal information where necessary to provide their services.

We require appropriate contractual and security safeguards where applicable.

Some service providers act as data processors on our behalf, while others may act as independent data controllers.

Where a provider acts as an independent controller, its own privacy policy may also apply.

8. Google Analytics and Advertising

We may use Google Analytics, Google Ads and related advertising technologies to understand website activity, measure advertising performance and promote our products.

These technologies may collect information such as:

• Website visits
• Pages and products viewed
• Shopping cart activity
• Purchases and conversions
• Device and browser information
• Advertising interactions
• Cookie identifiers

We may use advertising technologies to measure the effectiveness of campaigns and, where permitted, display relevant advertisements on other websites and platforms.

Advertising partners may process information in accordance with their own privacy policies.

Where required by law, non-essential advertising cookies and similar tracking technologies will only be used after obtaining appropriate consent.

Customers can manage applicable preferences through our website's cookie consent controls.

9. Personalised Advertising

We may use information about your interactions with our website to provide relevant advertising and product recommendations.

This may include information about:

• Products viewed
• Items added to shopping carts
• Previous purchases
• Website interactions
• Advertising engagement

Where enabled, Shopify and other advertising partners may use information obtained through participating websites and services to support personalised advertising.

Where required, we will obtain your consent before using personal information for these purposes.

You may withdraw applicable consent or adjust your preferences using the privacy controls available through our website or relevant third-party services.

10. Email Marketing

Where permitted by applicable law, we may send marketing emails containing:

• Product announcements
• Special offers
• Discounts and promotions
• New product information
• Business updates
• Relevant product recommendations

We may use third-party email marketing providers to manage subscriptions, deliver messages and analyse campaign performance.

You can unsubscribe from marketing emails at any time using the unsubscribe link included in our messages or by contacting us.

Unsubscribing from marketing emails will not prevent essential transactional communications relating to your orders or account.

11. SMS Marketing

We may collect your mobile telephone number when you place an order, create an account, contact us or subscribe to marketing communications.

Telephone numbers may be used for:

• Order confirmations
• Delivery updates
• Customer service communications
• Account-related notifications
• Promotional SMS messages, where permitted

Where required, we will obtain your consent before sending marketing text messages.

Marketing messages may include product information, promotions, special offers and abandoned checkout reminders.

Consent to receive marketing SMS messages is not a condition of purchasing goods from Kirkstall Commerce.

You may withdraw your consent at any time by following the unsubscribe instructions included in our messages or contacting us directly.

We do not sell, rent or share SMS marketing opt-in information or consent records with unrelated third parties for their own independent marketing purposes.

We may share mobile numbers and associated consent information with trusted messaging providers where necessary to operate our SMS services.

12. Abandoned Shopping Carts

Our website may use Shopify-integrated technologies and third-party marketing services to identify shopping carts that have been abandoned before checkout is completed.

Where customers have provided their contact information, we may use this information to send abandoned checkout reminders by email or SMS where permitted by applicable law.

These communications may include details of products left in a shopping cart and a link to complete the purchase.

Where consent is required, we will obtain it before sending these communications.

Customers may opt out of marketing messages using the unsubscribe options provided.

13. Cookies and Similar Technologies

Our website uses cookies and similar technologies to operate essential website functions, understand customer activity and improve the shopping experience.

Cookies are small files stored on your device when you visit a website.

We may use the following categories of cookies.

Essential Cookies

These support functions such as shopping carts, checkout, customer authentication, security and website operation.

Analytics Cookies

These help us understand website traffic, visitor interactions and website performance.

Marketing Cookies

These support advertising measurement, conversion tracking and personalised advertising.

Preference Cookies

These remember relevant website preferences and settings.

Where required by law, we will obtain consent before placing or accessing non-essential cookies or using equivalent tracking technologies.

You can manage applicable cookie preferences through our website's privacy controls.

You may also adjust your browser settings to block or delete cookies. However, restricting certain cookies may affect website functionality.

14. Sharing and Disclosure of Personal Information

We may disclose personal information where reasonably necessary to:

• Process and fulfil customer orders
• Arrange delivery services
• Process payments
• Provide customer support
• Manage customer accounts
• Operate marketing and advertising services
• Maintain website functionality
• Prevent fraud
• Comply with legal obligations
• Protect our legal rights

We may also share information with:

Service providers: Organisations performing services on our behalf.

Business and marketing partners: Where necessary for lawful advertising, promotional or business activities.

Professional advisers: Including accountants, legal advisers and other professional service providers.

Regulatory authorities: Where disclosure is required or permitted by law.

Business successors: Where relevant to a merger, acquisition, restructuring or transfer of business assets.

Where you direct us to share information with another organisation, such as a delivery provider or third-party integration, we may disclose the information necessary to fulfil your request.

We do not sell customer contact information to unrelated organisations for their independent direct marketing purposes.

This does not prevent disclosures to advertising partners for personalised advertising where permitted by applicable law and subject to required consent.

15. International Data Transfers

Some of our service providers may process or store personal information outside the United Kingdom.

Where personal information is transferred internationally, we will use appropriate safeguards where required by applicable data protection legislation.

These may include:

• Transfers to countries recognised as providing adequate protection
• The UK International Data Transfer Agreement
• The UK Addendum to approved standard contractual clauses
• Other legally recognised transfer mechanisms

Where applicable, European Economic Area transfers may rely on European Commission adequacy decisions or approved Standard Contractual Clauses.

You may contact us to request further information about the safeguards applicable to relevant international transfers.

16. How Long We Retain Personal Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including applicable legal, accounting and regulatory requirements.

Retention periods depend on:

• The nature of the information
• The purpose for which it was collected
• Customer account activity
• Contractual obligations
• Accounting and taxation requirements
• Applicable legal obligations
• Potential disputes or legal claims

Order and transaction records may be retained for the periods required under applicable accounting and taxation legislation.

Customer account information may be retained while an account remains active and for a reasonable period afterwards where necessary.

Marketing information may be retained while relevant to our marketing activities, subject to applicable consent, objection and retention requirements.

Where information is no longer required, we will delete, anonymise or securely dispose of it unless continued retention is legally justified.

17. Security of Personal Information

We take reasonable technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, misuse, loss or destruction.

These measures may include secure website connections, access controls, appropriate service provider arrangements and security procedures.

However, no electronic transmission or storage system can be guaranteed to be completely secure.

Customers are responsible for maintaining the confidentiality of their account credentials.

We recommend that customers avoid sending sensitive payment information through unsecured communication channels.

18. Your Rights Under Data Protection Law

Depending on the circumstances and applicable legislation, you may have the following rights.

Right of Access

You may request access to personal information we hold about you.

Right to Rectification

You may request correction of inaccurate or incomplete personal information.

Right to Erasure

You may request deletion of personal information where applicable.

Certain information may need to be retained to comply with legal obligations.

Right to Restrict Processing

You may request restrictions on certain processing activities where applicable.

Right to Data Portability

You may request certain personal information in a structured, commonly used and machine-readable format.

Right to Object

You have the right to object at any time to the processing of your personal information for direct marketing purposes, including profiling related to direct marketing.

You may also object to certain other processing activities based on legitimate interests, subject to applicable legal exceptions.

Right to Withdraw Consent

Where processing relies on your consent, you may withdraw that consent at any time.

Withdrawal does not affect processing lawfully carried out before consent was withdrawn.

Rights Relating to Automated Decision-Making

You may have rights concerning decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

We may use automated tools for activities such as fraud detection, advertising and website personalisation.

Where automated decision-making falls within applicable legal restrictions, we will provide the required information and safeguards.

19. Exercising Your Privacy Rights

You may exercise your applicable privacy rights by contacting us using the details provided at the end of this policy.

We may request information to verify your identity before processing a request.

Where permitted by law, an authorised representative may submit a request on your behalf, subject to appropriate verification.

We will respond within the timescales required by applicable legislation.

In most cases, requests under the UK GDPR must be answered within one month, subject to applicable rules concerning extensions and clarification.

We will not unlawfully discriminate against individuals for exercising their privacy rights.

You may also exercise certain rights relating to Shopify's independent processing through the Shopify Privacy Portal:

https://privacy.shopify.com/en

20. Children's Privacy

Our website and Services are not specifically directed towards children.

We do not knowingly collect personal information from children in circumstances where doing so would be unlawful.

If you believe a child has provided personal information to us inappropriately, please contact us so we can investigate and take appropriate action.

21. Business and Trade Customers

We may collect and process information relating to business and trade customers.

This may include:

• Business names
• Business addresses
• Contact names
• Business email addresses
• Telephone numbers
• Trade account details
• Order histories
• Payment and transaction records

We use this information to manage trade accounts, process orders, communicate with business customers, provide customer support and maintain commercial relationships.

Where business contact information identifies an individual, it is treated as personal information under applicable data protection legislation.

Marketing communications to business contacts will be conducted in accordance with applicable data protection and electronic marketing laws.

22. Location Information

When you visit our website, we and our service providers may collect information about your approximate geographical location based on your IP address and other technical information.

This may be used to:

• Understand visitor locations
• Improve website performance
• Analyse customer activity
• Detect potentially fraudulent transactions
• Provide relevant delivery information
• Support website functionality

We also collect billing and delivery addresses when provided during checkout.

These addresses are used to process orders, calculate delivery charges, arrange shipping and fulfil contractual obligations.

We do not ordinarily require precise GPS location information to provide our Services.

If we introduce functionality requiring access to precise device location, we will provide appropriate information and obtain consent where required.

23. Information Required to Provide Our Services

Certain personal information is necessary to process orders and provide our Services.

For example, we generally require contact details, delivery information and relevant payment information to fulfil purchases.

If you choose not to provide information necessary to complete a transaction, we may be unable to process your order or provide certain services.

Other information, such as marketing preferences, is generally optional.

You are not required to consent to marketing communications to purchase products from Kirkstall Commerce.

24. Third-Party Websites and Links

Our website may contain links to third-party websites, services or platforms.

These websites operate independently and may have their own privacy policies.

We are not responsible for the privacy practices of websites or services that we do not control.

We recommend reviewing the relevant privacy policies before providing personal information to third parties.

Information you voluntarily publish on public platforms, including social media websites, may be accessible to other users in accordance with those platforms' settings and policies.

25. Business Transfers

If Kirkstall Investment Ltd undergoes a merger, acquisition, restructuring, sale of assets or other business transaction, relevant personal information may be transferred as part of that transaction.

Any such transfer will be conducted in accordance with applicable data protection legislation.

Where required, appropriate safeguards and notices will be provided.

26. Complaints and the Information Commissioner's Office

If you have concerns about how we collect, use, store or protect your personal information, please contact us.

We will investigate privacy-related complaints and respond in accordance with applicable law.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: https://ico.org.uk

Telephone: 0303 123 1113

If you reside in the European Economic Area, you may also have the right to lodge a complaint with the relevant data protection supervisory authority.

27. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our business operations, website functionality, service providers, data processing activities or applicable legislation.

When changes are made, we will publish the revised policy on our website and update the date shown at the beginning of this document.

Where required by law, we will provide additional notice or obtain consent before implementing relevant changes.

We encourage customers to review this policy periodically.

28. Contact Information

For questions about this Privacy Policy, requests concerning your personal information or complaints relating to privacy, please contact:

Kirkstall Investment Ltd
Trading as Kirkstall Commerce

17 Kirkstall Crescent
Darlington
United Kingdom
DL3 9RN

Email: info@kirkstallcommerce.co.uk

Telephone: 01325 605043

Website: https://kirkstallcommerce.co.uk

Kirkstall Investment Ltd is the data controller responsible for personal information processed for its own business purposes.