Privacy Policy

Last updated: 2 June 2026

ESPRĒN LTD (‘we’, ‘us’, ‘our’) operates espren.co.uk and provides the products and services available through it. This Privacy Policy describes how we collect, use, and protect your personal information when you visit our website, place an order, subscribe to our letter, or otherwise interact with us.

We are committed to protecting your privacy and handling your data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For the purposes of these laws, we are the data controller of your personal information.

1. Personal information we collect

Depending on how you interact with us, we may collect:

  • Contact details — your name, billing address, shipping address, phone number, and email address
  • Order and payment information — items you have viewed, added to cart, purchased, returned, or exchanged. Payment is processed by Shopify and we do not store full card numbers ourselves
  • Account information — if you create an account: username, password (hashed), preferences, order history
  • Communications — any messages you send us via email, contact form, or live chat
  • Device and usage information — IP address, browser, device type, and how you interact with the site, collected via cookies and similar technologies

2. How we collect it

  • Directly from you — when you place an order, sign up to our letter, create an account, or contact us
  • Automatically — via cookies and analytics when you visit the site
  • From our service providers — Shopify (platform), our payment processor, our shipping carriers, and our email marketing tool

3. How we use your information

We use your personal information to:

  • Fulfil and ship your orders, process refunds, and manage subscriptions
  • Communicate with you about your order, account, or a support enquiry
  • Send you our fortnightly letter and other marketing communications — only if you have opted in
  • Improve our website, products, and customer experience
  • Detect and prevent fraud, comply with our legal obligations, and enforce our terms

Our lawful bases under UK GDPR are: (a) performance of a contract — to fulfil your order; (b) consent — for marketing, where you have opted in; (c) legitimate interests — to run and improve our business; and (d) legal obligation — to comply with tax, accounting, and regulatory requirements.

4. Who we share your information with

We never sell your personal information. We share it only with the following categories of recipients, and only as necessary:

  • Shopify — our e-commerce platform
  • Payment processors — to take payment securely
  • Shipping carriers — to deliver your order
  • Email service provider — to send transactional and (where opted in) marketing emails
  • Professional advisors — accountants, lawyers, where required
  • Authorities — if required by law (e.g. tax authorities, in response to a valid legal request)

5. Cookies

We use cookies and similar technologies to make the site work, remember your cart and preferences, understand how the site is used, and (where you have consented) measure marketing performance. You can manage your cookie preferences through the banner on our site or via your browser settings. Disabling essential cookies may stop parts of the site working.

6. How long we keep your information

We keep your personal information only for as long as needed for the purposes set out above, or as required by law. Order records are typically kept for 6 years to meet UK tax and accounting requirements. Marketing subscriber details are kept until you unsubscribe, after which we keep a minimal record of your unsubscribe request so we do not contact you again.

7. Your rights

Under UK GDPR you have the following rights in relation to your personal information:

  • Access — request a copy of the information we hold about you
  • Rectification — ask us to correct inaccurate information
  • Erasure — ask us to delete your information (‘right to be forgotten’), subject to legal retention requirements
  • Restriction — ask us to limit how we process your information
  • Portability — receive your information in a portable format
  • Objection — object to certain types of processing, including direct marketing
  • Withdraw consent — where we rely on consent (e.g. marketing), you can withdraw it at any time

To exercise any of these rights, email espren.uk@gmail.com. We will respond within one calendar month.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: ico.org.uk.

8. Security

We take reasonable technical and organisational measures to protect your personal information, including secure hosting via Shopify, encrypted payment processing, and access controls. However, no internet transmission is 100% secure — we cannot guarantee absolute security, and you use our services at your own risk.

9. International transfers

Our service providers (including Shopify) may store and process your personal information outside the UK. Where this happens, we rely on appropriate safeguards — typically the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with a UK addendum, or transfers to countries with a UK adequacy decision.

10. Children

Our products are not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. The ‘Last updated’ date at the top reflects the most recent change. For material changes we will give clear notice on our site or by email.

12. Contact us

Questions about this Privacy Policy or how we handle your data:

  • Email: espren.uk@gmail.com
  • Post: ESPRĒN LTD, 66 Paul Street, London EC2A 4NA