Privacy Policy

Mollie May ("we", "us", "our") operates this shop and website, including all related information, content, features, tools, products, and services (the "Services"). This Privacy Policy describes how we collect, use, and share personal data when you visit, use, shop on, or otherwise communicate with us through our Services.

Please read this Privacy Policy carefully. Where there is a conflict between our Terms of Service and this Privacy Policy regarding the collection, processing, and sharing of personal data, this Privacy Policy applies.

1. Data Controller

The data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 is Mollie May.

Email: info@molliemay.co.uk

2. Personal Data We Process

Personal data means any information that identifies you or could reasonably be linked to you. Depending on how you use our Services, we process the following categories:

  • Contact details such as name, address, billing and shipping address, phone number, and email address.
  • Payment details such as payment method, transaction details, and payment confirmations. Full card and bank details are processed exclusively by our payment providers, not by us.
  • Account details such as username, password, settings, and preferences.
  • Order details such as items viewed, basket contents, purchases made, returns, exchanges, and cancellations.
  • Communication data such as the content of your messages to us, for example in support enquiries.
  • Device data such as information about your device, browser, or network, your IP address, and other identifiers.
  • Usage data such as information about how and when you use and navigate our Services.

3. Source of Data

  • Directly from you, such as when creating an account, using the Services, or contacting us.
  • Automatically through the Services, such as from your device and through cookies and similar technologies.
  • From our service providers, when they process data on our behalf.
  • From partners or other third parties.

4. Purposes and Legal Bases for Processing

  • Providing the Services. We process your data to fulfil orders, process payments, arrange delivery, handle returns and exchanges, and manage your account. Legal basis: Article 6(1)(b) UK GDPR (performance of a contract).
  • Marketing and advertising. We process your data to send you newsletters and promotional content and to show you adverts on our Services or other websites. Legal basis: Article 6(1)(a) UK GDPR (consent). We only send marketing emails and SMS with your prior consent.
  • Security and fraud prevention. We process your data to authenticate accounts, enable secure payments, and detect and prevent potentially fraudulent or unlawful activity. Legal basis: Article 6(1)(f) UK GDPR (legitimate interests).
  • Communicating with you. We process your data to handle support enquiries and maintain our business relationship with you. Legal basis: Article 6(1)(b) and 6(1)(f) UK GDPR.
  • Legal obligations. We process your data to comply with commercial, tax, and other legal requirements and to respond to requests from public authorities. Legal basis: Article 6(1)(c) UK GDPR.

5. Recipients and Data Processors

We share personal data with third parties in certain circumstances:

  • With service providers who perform services on our behalf, such as shop hosting, IT operations, payment processing, data analytics, customer service, cloud storage, warehousing, and shipping.
  • With advertising and marketing partners, who process your data under their own privacy notices.
  • With third parties where you instruct or consent to it, such as when using social media widgets or login integrations.
  • With affiliated companies within our corporate group.
  • In connection with corporate transactions, and to comply with legal obligations and enforce our rights.

6. Services We Use

  • Shopify. Our Services are hosted by Shopify. Shopify collects and processes personal data relating to your access to the Services in order to provide and improve them. Data you submit through the Services is transferred to Shopify and to third parties, which may be located outside the UK. For more information, see Shopify's Consumer Privacy Policy.
  • Shopify Payments. For processing card payments. Full card details are processed exclusively by Shopify Payments.

7. Cookies and Consent

We use cookies and similar technologies. Strictly necessary cookies are required for the shop to function and are set on the basis of our legitimate interest in operating the Site. All other cookies, in particular for analytics and marketing, are only set with your consent under the Privacy and Electronic Communications Regulations (PECR) and Article 6(1)(a) UK GDPR. You can withdraw your consent at any time, with future effect, through the cookie settings on our website.

8. Newsletter

If you sign up for our newsletter, we use your email address to send you offers and news. Sign-up uses a double opt-in process: after signing up, you'll receive an email asking you to confirm your subscription. The legal basis is your consent under Article 6(1)(a) UK GDPR. You can unsubscribe at any time using the unsubscribe link in any email.

9. Contacting Us

If you contact us through our contact form or by email, we process your details in order to handle your enquiry. The legal basis is Article 6(1)(b) UK GDPR where your enquiry relates to entering into or performing a contract, and Article 6(1)(f) UK GDPR otherwise.

10. Links to Third-Party Websites

Our Services may contain links to third-party websites or platforms. If you follow such links, please review their privacy notices and terms of use. We are not responsible for the privacy practices or security of these websites.

11. Children's Data

Our Services are not directed at children. We do not knowingly collect personal data from children under 16. If you are a parent or guardian of a child who has provided us with personal data, please contact us using the details below to request its deletion.

12. International Data Transfers

Personal data may be transferred, processed, and stored outside the United Kingdom. In these cases, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements, such as the UK's International Data Transfer Agreement (IDTA) or Addendum to the EU Standard Contractual Clauses, or by relying on the recipient's participation in the UK Extension to the EU-U.S. Data Privacy Framework.

13. Security and Retention Period

13.1 No security measure is completely fail-safe. We recommend that you do not send us confidential or sensitive information over unsecured channels.

13.2 We store your personal data for the following periods:

  • Order and transaction data: 6 years, to meet accounting and tax record-keeping obligations under UK law (including HMRC requirements).
  • Account data: for as long as your account is active, and up to 2 years after your last activity.
  • Newsletter and marketing data: until you unsubscribe or withdraw your consent.
  • Customer service data: up to 3 years after your last enquiry.

14. Your Rights

Under UK GDPR, you have the following rights:

  • Right of access (Article 15). You can request information about the personal data we process about you.
  • Right to rectification (Article 16). You can request that we correct inaccurate data.
  • Right to erasure (Article 17). You can request the deletion of your data, provided no legal retention obligations prevent this.
  • Right to restriction of processing (Article 18). You can request that we restrict the processing of your data.
  • Right to data portability (Article 20). You can receive your data in a structured, commonly used, machine-readable format, or request that it be transmitted to a third party.
  • Right to object (Article 21). You can object to processing based on legitimate interests. You can object to direct marketing at any time, without giving any reason.
  • Right to withdraw consent (Article 7(3)). You can withdraw any consent you've given at any time, with future effect. This does not affect the lawfulness of processing carried out before your withdrawal.

To exercise your rights, email us at info@molliemay.co.uk. We will respond to your request within the legally required timeframes. We may need to verify your identity to process your request. You will not suffer any disadvantage as a result of exercising your rights.

15. Right to Complain to a Supervisory Authority

If you believe that the processing of your personal data infringes UK GDPR, you have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO), which can be contacted at ico.org.uk.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes to our operations or legal requirements. We will publish the current version on this website and update the "last updated" date.

17. Contact

If you have questions about this Privacy Policy or how we handle personal data, email us at info@molliemay.co.uk.

Customer service: Monday to Friday, 9:00am to 5:00pm (UK time)

© 2026 Mollie May