Privacy Policy
Last updated: 22 October 2026
There are two ways to use this site: browsing and buying. They involve different information, so this policy treats each question twice, once for the browser and once for the customer. Rose Pemberton LTD, 53 Kingsmere Road, London NW6 2PL, United Kingdom, trading as Rose Pemberton at rosepemberton.com, is the data controller under the UK General Data Protection Regulation and the Data Protection Act 2018. Privacy questions and requests: support@rosepemberton.com with "Privacy request" in the subject line; we reply within 2 working days, Monday to Friday, 9:00 am–5:00 pm UK time.
1. What we collect
If you only browse: your IP address, browser, device, the pages you view and the site you came from, through cookies and similar technologies. Necessary cookies (basket, checkout, security) are always set; analytics and advertising cookies are set only with your consent.
If you buy: your name, delivery and billing address, email, phone number, the items and amounts, and the payment type (for cards, the last four digits only); an encrypted password and order history if you create an account; your emails, photos sent for a claim and measurements given for sizing advice if you contact us; your first name and the text or photo if you leave a review. We don't collect special category data such as health information and don't need it. Our store is for adults; we don't knowingly collect data from anyone under 18.
2. Why we use it, and on what basis
If you only browse: to run and secure the site (our legitimate interest) and, with your consent, to measure which pages work and to show you our products after your visit (advertising cookies and pixels).
If you buy: to process and deliver your order, handle returns and claims and answer you (performance of the contract); to keep order records for tax (legal obligation); to prevent fraud (legitimate interest); and, with your consent or under the PECR "soft opt-in" for existing customers, to send marketing emails. Texts are sent only with your separate consent; reply STOP to end them. Consent is never a condition of buying, and every marketing email has an unsubscribe link that works immediately.
3. Who sees it
If you only browse: Shopify, which hosts the site, and, with your consent, analytics and advertising platforms.
If you buy: Shopify as our processor for the store, accounts and checkout; the payment provider shown at checkout, which handles payment details as an independent controller (we see only the payment type, last four digits and result); our fulfilment centre and carriers (Royal Mail, Evri, DPD or similar) for delivery and notifications; our returns centre in the United States, which receives your name and order number for an approved return; and our email and SMS tools. In both cases we disclose information where the law requires it, to prevent fraud, and in a sale or reorganisation of the business, where this policy continues to apply. We never sell personal information. Some providers and team members are outside the UK, including in the United States; transfers rely on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, and, for US recipients certified under the UK Extension to the EU-US Data Privacy Framework, on the UK's adequacy regulations.
4. How long we keep it
If you only browse: analytics and advertising data for up to 26 months; necessary cookies for the session or up to one year.
If you buy: order and payment records for 6 years from the end of the financial year, as HMRC requires; account details until you delete the account or after 3 years without use; correspondence for 3 years after the last message, with measurements deleted with the thread; reviews until you ask us to remove them; your marketing opt-out for as long as needed to honour it.
5. Your choices and rights
If you only browse: change or withdraw cookie consent at any time in the cookie settings in the site footer, or delete cookies in your browser.
If you buy: you can ask for a copy of your information, have it corrected or deleted, restrict or object to its processing (including to direct marketing, without giving a reason), and receive it in a portable format. Email us from the address you used with us; where needed we'll ask for an order number to confirm your identity, and you'll have a reply within one month. Records we must keep for tax or fraud prevention are retained after a deletion request, and we'll tell you what we've kept and why. We don't make decisions about you based solely on automated processing with legal or similarly significant effects; the payment provider's automated fraud checks can always be reviewed by a person if you contact us.
Either way: if you're unhappy with how we handle your information, you can complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF, telephone 0303 123 1113, though we'd welcome the chance to put things right first.
6. Security and changes
We use encrypted connections, limit access to staff who need it, let the payment provider handle card data so we never hold it, and review who has access to what. If a breach puts your rights at risk, we'll notify the Information Commissioner's Office within 72 hours and, where the law requires, you. We may update this policy as our services or the law change; the current version is always on this page with the date at the top, and material changes to how we use information already collected will be announced on the site or by email before they take effect.
Contact
Rose Pemberton LTD 53 Kingsmere Road, London NW6 2PL, United Kingdom support@rosepemberton.com Monday to Friday, 9:00 am–5:00 pm UK time · Saturday and Sunday closed · Replies within 2 working days