Privacy Policy
Last updated: 21 July 2026
At Grace & Arthur Cambridge, we respect your privacy and are committed to protecting your personal information.
This Privacy Policy explains how we collect, use, store, disclose and protect your personal information when you:
- Visit our website
- Place an order
- Create an account
- Contact our customer care team
- Subscribe to marketing communications
- Interact with our advertisements or online services
We process personal information in accordance with applicable data-protection legislation, including the UK General Data Protection Regulation, the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation. The Data Protection Act 2018 provides the UK’s legal framework for processing personal data alongside the UK GDPR.
1. Who We Are
For the purposes of applicable data-protection law, the data controller responsible for your personal information is:
Registered Business Name: [Insert your registered legal business name]
Trade Name: Grace & Arthur Cambridge
Website: gracearthurcambridge.com
Email: info@gracearthurcambridge.com
Business Address: [Insert your registered business address]
Chamber of Commerce Number: [Insert your KvK number, if applicable]
VAT Number: [Insert your VAT number, if applicable]
Grace & Arthur Cambridge is a trading name. Your registered legal business name must be entered above before publishing this policy.
2. Personal Information We Collect
Depending on how you use our website and services, we may collect the following information.
Identity and contact information
- Full name
- Billing address
- Delivery address
- Email address
- Telephone number
Order and transaction information
- Products ordered
- Selected sizes, colours and quantities
- Order number
- Order value
- Delivery status
- Returns and refund history
- Payment status
- Transaction reference numbers
Payment information
Payments are processed by secure third-party payment providers.
We generally do not receive or store your complete credit or debit card number. We may receive limited payment information, such as:
- Payment method used
- Transaction identifier
- Payment status
- The final digits of a payment card where provided by the payment processor
Account information
Where customer accounts are available, we may collect:
- Login details
- Account preferences
- Saved addresses
- Order history
- Wishlist or saved-product information
Technical and device information
When you use our website, we may collect:
- IP address
- Browser type
- Device type
- Operating system
- Time zone
- Language settings
- Approximate location derived from your IP address
- Website session and security information
Website and browsing information
Subject to your cookie preferences, we may collect information about:
- Pages visited
- Products viewed
- Links clicked
- Time spent on pages
- Referring websites
- Shopping-basket activity
- Advertisement interactions
- Website errors and performance
Customer-service information
When you contact us, we may collect:
- The content of your message
- Your order number
- Photographs or videos you provide
- Return or complaint details
- Previous correspondence
- Your requested resolution
Marketing information
Where applicable, we may collect:
- Email-marketing preferences
- Cookie and advertising preferences
- Newsletter interactions
- Whether marketing emails were opened or clicked
- Responses to promotions or surveys
We only collect information that is relevant and reasonably necessary for the purposes described in this Privacy Policy.
3. How We Collect Your Information
We may collect personal information:
Directly from you
For example, when you:
- Place an order
- Complete the checkout
- Create an account
- Contact customer support
- Request a return
- Subscribe to our newsletter
- Submit a product review
- Participate in a promotion
Automatically
We may collect technical and usage information through:
- Cookies
- Pixels
- Tags
- Server logs
- Analytics technologies
- Similar website technologies
Non-essential analytical and advertising technologies are used according to your cookie preferences.
From third parties
We may receive information from:
- Our e-commerce platform
- Payment providers
- Delivery carriers
- Fulfilment partners
- Advertising platforms
- Analytics providers
- Fraud-prevention providers
- Customer-support applications
4. How We Use Your Personal Information
We may use your information to:
- Process and confirm orders
- Collect and verify payments
- Prepare and deliver products
- Provide tracking information
- Process returns, exchanges and refunds
- Communicate about your order
- Respond to questions and complaints
- Maintain customer accounts
- Detect and prevent fraud
- Protect our website and customers
- Improve our website and services
- Analyse website performance
- Understand customer preferences
- Maintain financial and transaction records
- Comply with legal obligations
- Establish, exercise or defend legal claims
- Send marketing communications where permitted
- Measure the effectiveness of advertisements
- Display relevant content and advertising according to your preferences
We will not use your information for purposes that are incompatible with those explained in this policy unless permitted or required by law.
5. Legal Bases for Processing
We must have a valid lawful basis for every activity involving personal information. The lawful basis may also affect which privacy rights apply.
Depending on the activity, we rely on the following legal bases.
Performance of a contract
We process information where it is necessary to fulfil our contract with you, including:
- Processing an order
- Taking payment
- Delivering products
- Providing order updates
- Handling returns and refunds
Without the required information, we may be unable to process or deliver your order.
Legal obligation
We may process information where required to:
- Maintain accounting and transaction records
- Meet tax obligations
- Respond to lawful requests from authorities
- Comply with consumer-protection requirements
- Handle data-protection requests
- Prevent or report unlawful activity
Legitimate interests
We may process information where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights.
These interests may include:
- Improving our website
- Providing customer service
- Protecting our website and business
- Detecting fraud
- Managing deliveries
- Maintaining business records
- Understanding general customer behaviour
- Defending legal claims
Where we rely on legitimate interests, we consider the necessity and impact of the processing before proceeding.
Consent
We may rely on your consent for:
- Non-essential cookies
- Certain analytics technologies
- Personalised advertising
- Email or SMS marketing where consent is required
You may withdraw your consent at any time. Withdrawing consent does not affect processing that was lawful before withdrawal.
6. Sharing Your Information
We may share personal information with trusted service providers where necessary to operate our store.
These may include:
E-commerce and website providers
Providers that host or operate our website, checkout and customer-account functionality.
Payment providers
Providers that securely authorise and process payments.
Fulfilment partners and suppliers
Partners that prepare, package and dispatch purchased products.
They may receive information such as:
- Your name
- Delivery address
- Telephone number
- Email address
- Products ordered
Shipping and delivery providers
This may include Royal Mail and other delivery partners used to transport and track orders.
Customer-service providers
Applications used to organise and respond to customer enquiries.
Analytics providers
Providers that help us understand website use and performance, subject to your cookie preferences.
Advertising and marketing providers
Platforms that help deliver or measure advertisements and email campaigns, subject to applicable consent requirements.
Fraud-prevention and security providers
Providers that help identify suspicious, fraudulent or unauthorised transactions.
Professional advisers
This may include accountants, legal advisers, insurers and consultants where reasonably necessary.
Authorities and legal recipients
We may disclose information where required by:
- Law
- Court order
- Tax authorities
- Regulators
- Law-enforcement agencies
- The protection of our legal rights
We do not sell your personal information to third parties in exchange for monetary payment.
We require service providers to use personal information only for authorised purposes and to protect it appropriately.
7. International Data Transfers
Some of our e-commerce, technology, marketing or fulfilment partners may be located outside the United Kingdom.
This means personal information may be transferred to or accessed from another country.
Where a transfer is covered by UK international-transfer rules, we will use an approved transfer mechanism or another legally permitted safeguard. This may include:
- A country recognised as providing adequate protection
- An approved international data-transfer agreement
- An approved contractual addendum
- Another lawful transfer mechanism
The UK GDPR contains specific rules for transfers of personal information to separate organisations outside the United Kingdom.
Some orders may require information to be shared with international fulfilment partners so that the purchased products can be prepared and delivered.
8. Marketing Communications
We may send you promotional communications about:
- New products
- Special offers
- Sales
- Abandoned shopping baskets
- Store updates
- Relevant fashion collections
We will only send marketing communications where we have an appropriate legal basis.
You can unsubscribe at any time by:
- Clicking the unsubscribe link in a marketing email
- Updating your preferences where available
- Contacting info@gracearthurcambridge.com
It may take a limited period to process your request. You may still receive essential service messages relating to active orders, returns, security or legal matters.
Unsubscribing from marketing does not stop transactional messages that are necessary to fulfil an order.
9. Cookies and Similar Technologies
Our website uses cookies and similar technologies to:
- Operate the website
- Maintain the shopping basket
- Secure the checkout
- Remember preferences
- Analyse website traffic
- Measure advertising
- Provide relevant content
Strictly necessary cookies may be used where required to operate the website.
Non-essential analytical and marketing cookies will be used according to the preferences selected through our cookie banner.
You can change your cookie preferences through our website’s cookie-settings tool or your browser settings.
For further information, please read our separate Cookie Policy.
10. Data Retention
We retain personal information only for as long as reasonably necessary for:
- The purpose for which it was collected
- Completing orders and returns
- Providing customer service
- Complying with accounting and tax requirements
- Resolving complaints or disputes
- Preventing fraud
- Establishing or defending legal claims
The retention period depends on:
- The type of information
- The reason it was collected
- Applicable legal requirements
- The existence of an active account or order
- Whether a complaint, refund or legal claim is ongoing
Examples include:
- Order and transaction records are retained for the period required by applicable accounting and tax laws
- Customer-service correspondence may be retained while it remains relevant to an order, complaint or legal claim
- Marketing information may be retained until you unsubscribe or it is no longer required
- Cookie information is retained according to the periods described in our Cookie Policy and cookie-preference tool
The UK GDPR’s transparency requirements state that organisations must inform individuals about their retention periods or the criteria used to determine those periods.
Where information is no longer required, we will delete, anonymise or securely dispose of it where reasonably possible.
11. Data Security
We use reasonable technical and organisational measures to protect personal information against:
- Unauthorised access
- Accidental loss
- Misuse
- Alteration
- Disclosure
- Destruction
These measures may include:
- Encrypted website connections
- Secure payment providers
- Access controls
- Password protection
- Fraud-monitoring tools
- Limited staff or provider access
- Security updates
- Data-handling procedures
However, no method of internet transmission or electronic storage can be guaranteed to be completely secure.
Customers are responsible for keeping any account passwords confidential and should contact us if they believe their account or personal information has been compromised.
12. Your Privacy Rights
Depending on the circumstances and applicable law, you may have the right to:
Be informed
You have the right to receive clear information about how your personal information is used.
Access your information
You may request confirmation of whether we process your personal information and request a copy of it.
Correct your information
You may ask us to correct inaccurate information or complete information that is incomplete.
Request deletion
You may ask us to delete your personal information in certain circumstances.
Restrict processing
You may request that the use of your information be restricted in certain circumstances.
Object to processing
You may object to processing based on legitimate interests and to the use of your information for direct marketing.
Request data portability
You may request certain information in a structured, commonly used and machine-readable format where the relevant legal conditions apply.
Withdraw consent
Where processing is based on consent, you may withdraw that consent at any time.
Rights relating to automated decisions
You may have rights relating to decisions made solely through automated processing where those decisions have a legal or similarly significant effect.
These rights are not absolute and may depend on the purpose and lawful basis of the processing. The UK GDPR includes rights relating to information, access, rectification, erasure, restriction, portability and objection.
To exercise a privacy right, contact:
Please include:
- Your full name
- Your email address
- A description of your request
- The order number where relevant
We may need to verify your identity before fulfilling a request.
13. Data-Protection Complaints
If you are concerned about how we have handled your personal information, contact us first at:
Please clearly describe:
- What happened
- Which information is involved
- When the issue occurred
- Your preferred resolution
We will acknowledge a formal data-protection complaint within 30 days and will investigate and communicate the outcome without undue delay. Updated UK requirements require organisations to provide a clear complaints process, acknowledge complaints within 30 days and keep complainants informed.
You also have the right to raise a complaint with the UK supervisory authority:
Information Commissioner’s Office
The ICO recommends raising the matter with the organisation first so that it has an opportunity to resolve the issue.
14. Children’s Information
Our website and products are not specifically directed at children.
We do not knowingly collect personal information directly from children where parental or guardian consent would be required.
If you believe a child has provided personal information to us improperly, contact:
We will review the matter and take appropriate action.
15. Third-Party Websites
Our website may contain links to third-party websites or services.
We are not responsible for the privacy practices, security or content of third-party websites.
We recommend reading the privacy policy of any external website before providing personal information.
16. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in:
- Our website
- Our service providers
- Our business operations
- Applicable laws
- Regulatory guidance
- The personal information we process
The latest version will be published on this page with an updated revision date.
Where a change is significant, we may provide an additional notice through the website or by email where appropriate.
17. Contact Information
For questions, complaints or requests relating to this Privacy Policy or your personal information, contact:
Grace & Arthur Cambridge
Website: gracearthurcambridge.com
Email: info@gracearthurcambridge.com