Privacy policy
Privacy Policy
Last updated: 1 Nov 2026
1. Who we are
Lashesby Victoria ("we", "us", "our") is the data controller responsible for your personal data.
- Business: Lashesby Victoria, a trading name of Victoria Dome, a sole trader
- Business address: 101 Leatfield Drive, Plymouth, PL6 5EZ, United Kingdom
- Email: contact@lashesbyvictoria.co.uk
- Phone: +44 7498 489464
- Website: lashesbyvictoria.co.uk
We process personal data in accordance with the UK GDPR and the Data Protection Act 2018.
2. What personal data we collect
| Category | Examples |
|---|---|
| Identity and contact data | Name, billing address, delivery address, email address, telephone number |
| Order data | Items purchased, order value, order history, delivery status, correspondence with us |
| Payment data | Payment method type, card expiry, and the last four digits of your card. We never see or store your full card number — payment details go directly to Stripe |
| Technical data | IP address, browser type and version, device type, operating system, time zone |
| Usage data | Pages and products viewed, time spent on the site, how you arrived at the site |
| Marketing data | Your marketing preferences and whether you have consented to receive email from us |
| Professional status | Where you buy a product restricted to trained professionals, the confirmation you give us at checkout |
| Sensitivity and reaction information | Any information you choose to tell us about allergies, sensitivities or an adverse reaction to a product |
We do not knowingly collect personal data from children under 13.
A note on sensitivity and reaction reports. If you contact us about an allergy, a sensitivity or a reaction to a product, that information is health-related. We use it only to answer you, to handle your order or refund, and to meet our product-safety duties. We keep it with your correspondence, we do not use it for marketing or profiling, and we do not share it except as set out in section 4. You do not have to give us this information, but we may not be able to advise you properly without it.
3. Why we use your data, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Processing and delivering your order, and handling returns and refunds | Performance of a contract with you |
| Taking payment and preventing fraudulent transactions | Performance of a contract / legitimate interests (protecting our business) |
| Answering your questions and providing customer service | Performance of a contract / legitimate interests |
| Answering questions about ingredients, allergies or sensitivities | Your explicit consent, given when you send us the information |
| Investigating and, where required, reporting a serious undesirable effect from a cosmetic product | Compliance with a legal obligation, and substantial public interest in the field of public health |
| Product traceability, and handling a product withdrawal or recall | Compliance with a legal obligation |
| Verifying professional status for restricted products | Performance of a contract / legitimate interests (product safety) |
| Keeping accounting and tax records | Compliance with a legal obligation |
| Sending marketing emails and newsletters | Consent — or the "soft opt-in" for existing customers, which you can withdraw at any time |
| Website analytics, advertising measurement and remarketing | Consent, given through our cookie banner |
| Keeping the website secure and preventing misuse | Legitimate interests |
4. Who we share your data with
We share personal data only where it is necessary, with:
- Shopify Inc. — our e-commerce platform provider. Shopify hosts our online store, processes orders and sends our marketing and transactional emails.
- Stripe, Inc. — our payment provider, which processes card, Apple Pay and Google Pay transactions.
- Royal Mail Group Ltd — our delivery partner. We share your name, delivery address, and your email address or phone number for delivery notifications.
- Google LLC — for Google Ads advertising measurement and remarketing, subject to your cookie choices.
- Our accountant, and, where we are legally required to do so, HMRC, the Office for Product Safety and Standards, Plymouth City Council trading standards, other regulators or law enforcement.
- A product's manufacturer or supplier, where we need to investigate a safety issue or an adverse reaction. We share only what is necessary, and we will tell you if we need to pass on your reaction report.
We do not sell, rent or trade your personal data to anyone.
5. International transfers
Some of our service providers process personal data outside the United Kingdom. Where this happens, we rely on UK adequacy regulations or on the ICO's International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses), together with appropriate additional safeguards.
6. How long we keep your data
| Data | Retention period |
|---|---|
| Order, invoice and transaction records | 6 years after the end of the relevant financial year (HMRC requirement) |
| Product traceability records | As required by cosmetic product safety law, and in any event for the life of the product plus a reasonable period afterwards |
| Records of an adverse reaction or safety report | 10 years, so that we can meet our product-safety obligations |
| Customer service correspondence | 2 years from your last contact with us |
| Marketing data | Until you unsubscribe, after which we keep a minimal suppression record so we do not contact you again |
| Website analytics data | As set out in our Cookie Policy |
7. Your rights
Under the UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- request erasure of your data;
- restrict how we process your data;
- object to processing based on our legitimate interests;
- request transfer of your data to you or another provider (data portability);
- withdraw your consent at any time, which does not affect processing carried out before you withdrew it.
To exercise any of these rights, email contact@lashesbyvictoria.co.uk. We will respond within one month. We do not charge a fee unless a request is manifestly unfounded or excessive.
Please note that where we are legally required to keep a record — for example an accounting record, or a product-safety report — we may not be able to erase it on request.
You can unsubscribe from marketing emails at any time using the unsubscribe link in any email we send you.
8. Automated decision-making
We do not make decisions that produce legal effects, or similarly significantly affect you, based solely on automated processing.
9. Security
Our website uses HTTPS/TLS encryption throughout. Access to personal data is limited to those who need it to run the business. Payments are handled by Stripe, a PCI-DSS Level 1 certified payment provider, and we do not store full card details on our systems.
No transmission of data over the internet can be guaranteed as completely secure, but we take appropriate technical and organisational measures to protect your data and to notify you and the ICO of any breach where we are required to do so.
10. Cookies
Our use of cookies and similar technologies is explained in our separate Cookie Policy.
11. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at contact@lashesbyvictoria.co.uk so that we can try to put it right.
You also have the right to complain to the Information Commissioner's Office:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Helpline: 0303 123 1113 Website: ico.org.uk
12. Changes to this policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised "last updated" date.