Privacy Notice
Last updated: July 2026 · UK GDPR & Data (Use and Access) Act 2025 compliant
1. Who We Are and How to Contact Us
This privacy notice tells you what personal data we collect about you, why we collect it, how we use it and what rights you have. It applies to all personal data we process when you visit winternational.co.uk, purchase from us, sign up to our emails or contact us.
| Legal entity | Winternational Fashion Limited |
| Trading as | Winternational |
| Website | winternational.co.uk |
| lookgood@winternational.co.uk | |
| Post | Winternational Fashion Limited, Berkshire, United Kingdom |
| ICO Registration | ZA354430 |
We do not have a Data Protection Officer as we are a small business that does not meet the threshold requiring one. If you have any questions about this notice, please email lookgood@winternational.co.uk.
Please let us know if your personal information changes so we can keep our records accurate.
2. What Personal Data We Collect and From Whom
The table below sets out every source from which we collect personal data, who is affected and what data we process.
| Data collected from | Category of data subject | Personal data being processed |
|---|---|---|
| Shopify checkout | Customer (purchaser) | Name, billing address, delivery address, email, phone number, order details, payment method. Full card data is processed by Shopify — we never see or store it. |
| Shopify customer accounts | Registered customer | Name, email address, encrypted password, saved delivery addresses, order history |
| Shopify abandoned checkout | Prospective customer | Email address, items in cart, partial address if entered before abandonment |
| Klaviyo email sign-up form | Email subscriber | Email address, sign-up date, marketing preferences, email engagement data (opens, clicks, unsubscribes) |
| Klaviyo (synced from Shopify) | Customer | Email address, order history, purchase value, product preferences, on-site browsing behaviour |
| Klarna checkout | Customer using Klarna BNPL | Name, email, address. Klarna also acts as an independent data controller for its own creditworthiness assessment — see klarna.com/uk/privacy |
| Clearpay checkout | Customer using Clearpay BNPL | Name, email, address, payment schedule. Clearpay is an independent data controller — see clearpay.co.uk/privacy |
| PayPal checkout | Customer using PayPal | Name, email. PayPal is an independent data controller — see paypal.com/uk/privacy |
| DHL Express | Customer (recipient) | Name, delivery address, email and phone for delivery notifications and tracking |
| Royal Mail | Customer (recipient) | Name and delivery address |
| FedEx | Customer (recipient) | Name, delivery address, email and phone for delivery notifications and tracking |
| UPS | Customer (recipient) | Name, delivery address, email and phone for delivery notifications and tracking |
| DPD | Customer (recipient) | Name, delivery address, email and phone for delivery notifications and tracking |
| Google Analytics | Website visitor | Anonymised IP address, browser type, device type, pages visited, time on site, referring source, approximate geographic region |
| Meta pixel (Facebook / Instagram) | Website visitor / customer | IP address, browser data, pages visited, products viewed, purchases made — for ad targeting. Requires cookie consent before firing. |
| Pinterest pixel | Website visitor / customer | IP address, browser data, pages viewed, products viewed — for ad targeting. Requires cookie consent before firing. |
| Contact form / email enquiry | Enquirer | Name, email address, phone number (if provided), content of message |
| Returns process | Customer | Name, order number, return reason, address for collection or return postage |
Klarna, Clearpay and PayPal each act as independent data controllers for their own processing. We share only what is necessary for each delivery agent to fulfil your order — name, delivery address, email and phone number. We never share payment data with delivery agents.
3. Why We Process Your Data and Our Lawful Basis
UK GDPR and the Data (Use and Access) Act 2025 require us to have a lawful basis for every type of data processing we carry out.
| Purpose | Data used | Lawful basis | Retention period |
|---|---|---|---|
| Processing your order and payment | Name, address, email, order details | Contract | 7 years (HMRC) |
| Delivering your order | Name and delivery address | Contract | 7 years (HMRC) |
| Sharing with delivery agents (DHL, Royal Mail, FedEx, UPS, DPD) | Name, address, phone, email | Contract | Duration of delivery + 7 years |
| Customer service and enquiries | Name, email, message content | Contract / Legitimate interests | 3 years |
| Sending marketing emails | Email address | Consent (new subscribers) / Recognised legitimate interests for direct marketing under DUAA 2025 (existing customers) | Until unsubscribe or deletion |
| Abandoned checkout recovery | Email, cart contents | Legitimate interests | 90 days |
| Website analytics | Browsing data, anonymised IP | Legitimate interests (opt-out available — DUAA 2025) | 26 months |
| Ad targeting (Meta, Pinterest) | IP address, browsing and purchase data | Consent (cookie consent required) | Per platform policy |
| Fraud prevention | Transaction and account data | Legitimate interests / Legal obligation | 7 years |
| Legal and tax compliance | Order and payment records | Legal obligation | 7 years (HMRC) |
Where we are required to collect personal data by law or under our contract with you and you do not provide it, we may be unable to fulfil your order. We will notify you if this is the case.
4. Marketing Communications
Under the Privacy and Electronic Communications Regulations (PECR), we may send you marketing emails if you have made a purchase from us or asked for information about our products and have not opted out — or if you have actively signed up.
Under the Data (Use and Access) Act 2025, direct marketing is a recognised legitimate interest. We comply with PECR in all cases. We will never share your data with third parties for their own marketing without your express consent. We will never sell your data.
You can unsubscribe at any time by clicking the unsubscribe link in any of our emails, or by emailing lookgood@winternational.co.uk. Opting out of marketing does not affect data processed for order fulfilment or other purposes.
5. Who We Share Your Data With
We do not sell your personal data. We share it only with trusted service providers who process it on our behalf, and with independent controllers (Klarna, Clearpay, PayPal) when you choose to use their services.
| Provider | Purpose | Location |
|---|---|---|
| Shopify Inc. | E-commerce platform, order management, payment processing | USA (SCCs / UK adequacy) |
| Klaviyo Inc. | Email marketing platform | USA (SCCs / UK adequacy) |
| Klarna Financial Services UK Ltd | BNPL payment processing (independent controller) | UK / EU |
| Clearpay Finance Ltd | BNPL payment processing (independent controller) | UK |
| PayPal (Europe) S.à r.l. | Payment processing (independent controller) | Luxembourg / EU |
| DHL Express | Order delivery and shipping | UK / International |
| Royal Mail Group Ltd | UK delivery service | UK |
| FedEx | International delivery and shipping | USA / International |
| UPS | International delivery and shipping | USA / International |
| DPD | UK and European delivery | UK / EU |
| Google LLC (Analytics) | Website analytics | USA (SCCs / UK adequacy) |
| Meta Platforms Ireland Ltd | Ad targeting — Facebook and Instagram | Ireland / EU |
| Pinterest Europe Ltd | Ad targeting — Pinterest | Ireland / EU |
We may also share your data with professional advisers (lawyers, accountants, insurers), government bodies where required by law, and in the event of a business sale or transfer. We require all third parties to treat your data lawfully and securely.
6. International Data Transfers
Some of our service providers are based outside the UK. When we transfer your data outside the UK we ensure appropriate safeguards are in place:
- We transfer data to countries approved by UK regulatory authorities as providing adequate protection
- Where we use US-based providers on the UK-US Data Bridge, we may transfer data to them as they have equivalent safeguards in place
- Where providers are established outside the UK, we use contracts approved by the ICO (International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses)
The European Commission renewed the UK's adequacy decision on 19 December 2025, valid until 27 December 2031, meaning data flows between the UK and EU continue to be protected.
7. Data Security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, altered, disclosed or accessed without authorisation. We limit access to staff and partners with a genuine business need.
Our website uses a 256-bit SSL certificate and is certified Level 1 PCI DSS compliant. Payments are processed securely through Shopify, Klarna, Clearpay and PayPal — we never store your full card details.
We have procedures to deal with suspected data breaches and will notify you and the ICO where we are legally required to do so.
8. How Long We Keep Your Data
We retain your personal data only as long as necessary to fulfil the purposes it was collected for, including satisfying any legal, accounting or reporting requirements.
| Data type | Retention period | Reason |
|---|---|---|
| Order and transaction records | 7 years from date of order | HMRC legal requirement |
| Customer account data | Until account closure or deletion request | Ongoing customer relationship |
| Delivery records | 7 years from date of delivery | HMRC / legal compliance |
| Marketing email preferences | Until unsubscribe or deletion request | Consent management |
| Customer service correspondence | 3 years from last communication | Dispute resolution |
| Abandoned checkout data | 90 days | Legitimate interests — recovery period |
| Website analytics data | 26 months | Google Analytics default — industry standard |
| Ad targeting data | Per Meta and Pinterest platform policy | Third party controller |
In some circumstances we may anonymise your personal data for research or statistical purposes, in which case it may be used indefinitely as it can no longer identify you.
9. Your Legal Rights
Under UK GDPR and the Data (Use and Access) Act 2025, you have the following rights:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — ask us to correct inaccurate or incomplete data
- Right to erasure — ask us to delete your data where there is no longer a lawful reason to hold it
- Right to restrict processing — ask us to pause processing in certain circumstances
- Right to data portability — ask us to provide your data in a portable format
- Right to object — object to processing based on legitimate interests, including direct marketing
- Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of earlier processing
To exercise any of these rights, please email lookgood@winternational.co.uk. You will not be charged. We may need to verify your identity. We will respond within one calendar month — where a request is complex we may extend by up to two months and will notify you within the first month.
Under the Data (Use and Access) Act 2025, our searches in response to access requests are limited to what is reasonable and proportionate. We may also pause the response period ('stop the clock') while we await clarification or identity verification from you.
10. Automated Decision Making
We do not make significant automated decisions about you — that is, decisions with a legal or similarly significant effect — without human involvement.
We use automated processes for non-significant tasks such as website analytics, Klaviyo email audience segmentation and abandoned checkout triggers. These do not materially affect your rights or access to our services.
11. Cookies
We use cookies and similar tracking technologies on our website. You can set your browser to refuse all or some cookies, though this may affect website functionality. For full details please see our Cookie Policy.
- Essential cookies — necessary for the website and checkout to function. No consent required.
- Analytics cookies (Google Analytics) — under the DUAA 2025 these may be set without prior consent where an opt-out is available.
- Marketing cookies (Meta pixel, Pinterest pixel) — require your prior consent before being set.
12. Third-Party Links
Our website may include links to third-party websites. Clicking those links may allow third parties to collect data about you. We do not control those websites and are not responsible for their privacy notices. We encourage you to read the privacy notice of every website you visit.
13. Children
Our website is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. Under the Data (Use and Access) Act 2025, online services likely to be accessed by children must take account of their elevated protection needs. If you believe a child has provided us with their personal data, please contact us immediately and we will delete it.
14. Changes to This Privacy Notice
We may update this notice from time to time. When we make significant changes we will update the 'Last updated' date at the top of this page.
15. How to Make a Data Protection Complaint
If you have a complaint about how we handle your personal data, please contact us first so we can try to resolve it for you.
| lookgood@winternational.co.uk | |
| Subject line | DATA PROTECTION COMPLAINT |
| Post | Winternational Fashion Limited, Berkshire, United Kingdom |
| Phone | +44 (0)1635 019537 |
We will acknowledge your complaint within 5 working days and provide a full response within one calendar month. Our full Data Protection Complaints Procedure is available on our website.
You also have the right to complain to the ICO at any time — you do not have to come to us first, though we would appreciate the chance to resolve things directly.
| ICO Website | ico.org.uk / ico.org.uk/make-a-complaint |
| ICO Helpline | 0303 123 1113 |
| ICO Address | Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF |