Privacy policy

Last updated: 4 November 2026

This policy explains what personal information we collect when you visit smouche.co.uk or buy from us, why we collect it, who we share it with and what your rights are. We’ve tried to keep it short and clear. If anything is unclear, just email us.

Who we are

Smouche is run by Smouche. We’re the ‘controller’ of your personal information. This means we decide how it’s used and we’re responsible for protecting it.

Email: hello@smouche.co.uk

We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What we collect

• When you order: your name, email address, delivery and billing addresses, your phone number if you give it, what you ordered and how much you paid.
• When you pay: payments are handled by PayPal, and we never see or store your full card number. PayPal tells us whether the payment went through and gives us a payment reference. If you pay with a PayPal account, it also shares the name, email address and address on that account.
• When you contact us: your name, email address, your phone number if you give it, and your message. If you tell us about a skin reaction, we’ll only use that information to deal with your request.
• When you sign up for our emails: your email address.
• When you visit our website: technical information such as your IP address, the type of device and browser you use, the pages you look at, and how you found us (for example, the advert or link you clicked). Some of this is collected with cookies, and only if you agree. See our cookie policy.

Why we use your information, and our lawful bases

• To process and deliver your order, take payment, send you order and delivery emails, and deal with returns and refunds. Legal reason: to carry out our contract with you.
• To answer your questions and help you if something goes wrong. Legal reason: our contract with you, or our legitimate interest in looking after our customers.
• To keep records for tax and accounting. Legal reason: to meet our legal obligations.
• To prevent fraud and keep our website secure. Legal reason: our legitimate interests, and PayPal’s.
• To understand how our website is used, and to measure and improve our adverts on Facebook and Instagram. Legal reason: our legitimate interest in promoting our products. You can block these cookies in your browser settings at any time.
• To send you emails about new launches and offers. Legal reason: your consent or, if you’ve bought from us, our legitimate interest in telling you about similar products. You can unsubscribe at any time using the link in every email.
• To remind you about your basket if you start an order and don’t finish it. Legal reason: our legitimate interests. You can opt out at any time.

Who we share it with

We never sell your personal information. We only share it with companies that help us run our shop, and only what they need:

• PayPal, to process your payment (by card, PayPal, Apple Pay or Google Pay) and to prevent fraud. PayPal also uses your information under its own privacy statement.
• Meta (Facebook and Instagram), to measure and improve our adverts, and only if you accept advertising cookies. When you place an order, this can include your email address and phone number in a coded (‘hashed’) form, so that Meta can match the order to its users and tell us which of our adverts work. Meta also uses this information under its own privacy policy.
• Hostinger, the company that hosts our website and stores its data.
• Our supplier and its delivery partners, who pack and deliver your order. They receive your name, delivery address, phone number and what you ordered.
• Our email service, which sends our order, delivery and customer service emails.
• Professional advisers and the authorities, such as our accountant or HMRC, when the law requires it.

These companies must keep your information secure and may only use it for the purposes described here, except where they act on their own account under their own privacy policies (as PayPal and Meta do).

Sending your information outside the UK

Our company is based outside the UK, and so are some of the companies we work with, for example in the European Economic Area, the United States or .

When your information is sent outside the UK, we make sure it stays protected. Either the country has been recognised by the UK government as protecting personal information properly, or we use contract terms approved for this purpose, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. You can ask us for more details.

How long we keep it

• Orders and payments: 6 years after the end of the financial year in which you ordered, because tax and accounting law requires it.
• Customer service messages: up to 3 years after our last exchange.
• Marketing emails: until you unsubscribe. After that, we keep a note of your email address so that we don’t email you again.
• Cookies: see our cookie policy for how long each one lasts.

How we keep it safe

Our website uses a secure (HTTPS) connection, payments are handled by PayPal, and only the people who need your information to look after your order can see it.

Your rights

• Access: ask for a copy of the information we hold about you.
• Correction: ask us to correct anything that’s wrong or incomplete.
• Deletion: ask us to delete your information, unless we have to keep it (for example, for tax records).
• Restriction: ask us to limit how we use your information.
• Objection: object to us using your information for our legitimate interests. You can always object to marketing, and we’ll stop.
• Portability: ask for the information you gave us in a format you can pass on to another company.
• Withdrawing consent: where we rely on your consent (for example, for marketing emails), you can withdraw it at any time. This doesn’t affect anything we did before.

To use any of these rights, email us at hello@smouche.co.uk. It’s free, and we’ll reply within one month. We may ask you to confirm your identity first.

We don’t make decisions about you based only on automated processing. When you pay, PayPal may carry out automated checks to prevent fraud.

Complaints

If you’re unhappy with how we’ve used your information, please tell us first at hello@smouche.co.uk and we’ll do our best to put things right. We’ll acknowledge your complaint within 30 days.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: ico.org.uk, telephone 0303 123 1113.

Children

Our website and products aren’t intended for children under 18, and we don’t knowingly collect their information.

Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.