Privacy Policy

This page explains what we do with your information, who else sees it, and what you can ask us to do about it. We have written it in plain English rather than legal language.

Last updated: 18 October 2026

Who is responsible for your data

Elmwell is the data controller for the information collected through this shop. That means we decide what is collected and why, and we are responsible for looking after it.

If you want to ask anything about your data, or make any of the requests described further down this page, write to support@elmwell.co.uk and a person will reply within one working day.

What we collect, and why

When you place an order
Your name, delivery address, email address, phone number if you give one, and what you ordered.
Why: to take your order, send it to you, and deal with any refund. We could not sell you anything without it.
When you pay
Your card is handled by Shopify Payments or by your chosen payment provider.
We never see or store your full card number. We only see the last four digits and whether the payment succeeded.
When you message us
Whatever you send us by email or WhatsApp, and your reply address or number.
Why: to answer you. We keep the conversation so we have a record if you come back to us about the same thing.
When you browse the shop
Pages viewed, what you put in your basket, the device and browser you used, and your approximate location from your IP address.
Why: to keep the shop working, and — only if you agree to it — to measure our advertising.

We do not ask for and do not want any health information. Please do not send us medical details or records. If you describe a symptom when you message us, we only use it to answer your question.

Our lawful basis

To perform our contract with you — taking, packing, sending and refunding your order.

Our legitimate interests — keeping the shop secure and working, preventing fraud, and keeping records of what we sold and to whom.

Your consent — advertising and analytics cookies, and marketing emails. You can withdraw it at any time, and withdrawing it is as easy as giving it.

Legal obligation — keeping sales records for as long as the law requires.

Who else sees your data

We do not sell your data and we never will. We share only what is necessary, and only with these:

Shopify
Runs this shop and our checkout, and processes payments through Shopify Payments. Your order and account information is stored on Shopify's systems. Their own privacy policy is at shopify.com/legal/privacy.
Meta (Facebook and Instagram)
We advertise on Facebook and Instagram. If you agree to advertising cookies, Meta receives information about pages you viewed and purchases you made on this shop, so we can see whether our adverts work and show them to people like you. You can control this in your Facebook and Instagram settings, and you can refuse it here by declining cookies.
The carrier delivering your parcel
Your name, address and, where needed, your phone number or email so they can deliver to you and keep you updated.
Anyone the law requires
If we are legally obliged to hand something over, or need to in order to establish or defend a legal claim.

Where your data goes

Shopify and Meta are based outside the United Kingdom, so some of your information is stored or processed abroad. Those transfers are covered by the safeguards UK law requires for sending personal data overseas, including the International Data Transfer Agreement or standard contractual clauses. Your rights travel with your data.

Cookies

Essential cookies keep your basket, remember your currency and let the checkout work. The shop cannot function without them, so they do not need your permission.

Advertising and analytics cookies let us measure our adverts on Facebook and Instagram. These are only set if you agree. If you decline, you can still buy from us and nothing on the shop stops working.

You can change your mind whenever you like, through the cookie settings on this site or by clearing cookies in your browser.

How long we keep it

Order records — six years, because tax and accounting rules require it.

Messages to support — two years, in case you come back to us about the same order.

Marketing consent — until you withdraw it.

Cookie data — as set out in the cookie settings, and never longer than the cookie's own lifetime.

Your rights

Under UK data protection law you can ask us to:

  • Show you what we hold about you, and give you a copy.
  • Correct anything that is wrong.
  • Delete what we hold, where we do not have to keep it by law.
  • Stop or limit what we do with it.
  • Send it to you or to someone else in a portable format.
  • Object to us using it for our legitimate interests.
  • Withdraw consent for cookies or marketing, at any time.

Email support@elmwell.co.uk and we will deal with it within one month. We do not charge for any of this, and we will not make it difficult.

If you are not happy with us

Tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk or on 0303 123 1113. You do not have to come to us first.

Children

Our products are for adults and this shop is not aimed at children. We do not knowingly collect information about anyone under 16. If you believe we have, tell us and we will delete it.

Changes to this page

If we change how we handle your information we will update this page and change the date at the top. If the change is a significant one and we hold your email address, we will tell you directly.

Data questions

support@elmwell.co.uk

We reply within one working day, and deal with formal requests within one month.