PRIVACY POLICY
How we collect, use and protect your personal data
When you order nano ring or clip-in hair extensions, use our colour-match service, or buy aftercare essentials from hairisland.co.uk, we collect certain personal data to serve you. This page explains exactly what we collect, why, who we share it with, and the rights you have over it under UK data protection law.
The company responsible for your data
Hair Island is the trading name of Hair Island Limited. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Hair Island Limited is the "data controller" of the personal data described on this page — we decide why and how your personal data is used when you visit hairisland.co.uk or place an order with us.
Hair Island Limited has not appointed a statutory Data Protection Officer, as this is not a legal requirement for a business of our size and activity under UK GDPR Article 37. All data protection queries are handled directly by our team via the contact details in Section 11.
Exactly what information passes through our systems
We only collect the personal data we genuinely need to take your order, deliver your nano ring or clip-in extensions safely, match your shade correctly, keep you informed, and run a secure, lawful online shop.
Full name, delivery and billing address, email address, and telephone number, collected at checkout, account sign-up, or when you contact customer service or the colour-match service.
Products purchased (nano rings, clip-ins, brushes, shampoo, conditioner, storage solutions), order value and history, and payment confirmation data. We never see or store your full card number.
IP address, device and browser type, pages viewed, referral source, and approximate location, collected via cookies and similar technologies while you browse.
Your email marketing consent status, communication preferences, and engagement data, used only if you have opted in to hear from us.
Photo(s) or hair-colour details you voluntarily submit, used solely to recommend the closest shade match for your extensions.
The content of emails, live chat transcripts, and information you provide when contacting us about an order, return, or product question.
We do not knowingly collect special category data (such as health, biometric, or religious information) through our store. Please avoid including sensitive details about yourself in free-text fields such as order notes or live chat unless strictly necessary.
The specific purposes behind each use of your data
We never collect data "just in case." Every piece of personal data we hold is tied to one or more of the purposes below.
Processing payment, packing and dispatching your extensions and aftercare items, arranging courier collection, and keeping you updated on delivery.
Responding to enquiries, handling returns or cancellations, resolving faulty-item claims, and providing colour-match or aftercare guidance.
Sending order confirmations always, and — only with consent or the PECR "soft opt-in" — occasional emails about shades, restocks, or offers.
Understanding how visitors use our collections and product pages, and improving site speed, layout and content.
Verifying payment details, detecting and preventing fraudulent transactions, and protecting our store and customers.
Keeping financial records as required by HMRC, responding to lawful requests, and meeting UK consumer protection obligations.
Which lawful ground applies to each activity
Under UK GDPR Article 6, we must have a valid legal basis for every way we use your personal data. Here is which basis applies to each core activity.
Where we rely on legitimate interests, we have considered whether that interest is overridden by your rights and freedoms, and concluded it is not. You can object to processing based on legitimate interests at any time — see Section 08.
The trusted processors that help us run Hair Island
We do not sell your personal data to anyone, ever. We share limited, necessary data with the third-party services below, each processing it strictly on our instructions under a data processing agreement.
Our store is built on Shopify Inc., which hosts our site, processes checkout, and stores order and customer records securely on our behalf.
Providers such as Shopify Payments, Stripe and PayPal handle your card and payment details directly; we never store your full card number.
Delivery partners such as Royal Mail and DPD receive your name, address and phone number solely to get your extensions to your door.
If you subscribe, tools such as Klaviyo or Mailchimp store your email address and engagement data to send newsletters and order messages.
With your cookie consent, tools such as the Meta Pixel and Google Ads/Analytics measure ad performance and improve our site — see Section 09.
We may disclose data where required by law, for example to HMRC, law enforcement, or in connection with a legal claim.
What happens when data leaves the UK
We are a UK-only retailer and ship exclusively to UK customers. However, some third-party tools we rely on — including Shopify, certain payment processors, and advertising platforms such as Meta and Google — operate infrastructure outside the UK, including in the United States.
Where your data is transferred outside the UK, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or a UK adequacy regulation.
Your order and delivery data stays with UK-facing systems wherever possible. Data shared with US-headquartered processors is transferred only under one of the safeguards above.
You can ask us at any time for details of the safeguard used for a specific transfer by contacting hello@hairisland.co.uk.
Retention periods, by data type
We keep personal data only for as long as necessary for the purpose it was collected, or as required by law.
| Data type | Retention period | Reason |
|---|---|---|
| Order & transaction records | 6 years from the end of the relevant tax year | UK HMRC record-keeping requirements |
| Customer account data | While active, plus 2 years of inactivity | To view order history and re-order easily |
| Marketing consent & email data | Until unsubscribe, or 24 months of no engagement | PECR requires marketing only while consent is current |
| Colour-match photos/details | Deleted within 90 days unless kept on request | Data minimisation |
| Customer service correspondence | 3 years from last contact | To handle follow-up, warranty or dispute queries |
| Website analytics & cookie data | Up to 14 months | Standard analytics retention window |
| Fraud-prevention & security logs | Up to 12 months | To detect patterns of fraudulent activity |
Where you exercise your right to erasure (Section 08), we will delete or anonymise your data unless we are legally required to retain it, for example for tax purposes.
Seven rights, always available to you, always free
As a UK data subject, you have the following rights over your personal data. To exercise any of them, email us or use our Privacy Opt-Out Request Form — we respond within one calendar month, free of charge, unless your request is manifestly unfounded or excessive.
Request a copy of the personal data we hold about you.
Ask us to correct inaccurate or incomplete data, such as a delivery address.
Ask us to delete your data where there is no legal reason for us to keep it.
Ask us to pause how we use your data while a query is resolved.
Receive your data in a structured, commonly-used format to transfer elsewhere.
Object to processing based on legitimate interests, or to direct marketing at any time.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or by calling 0303 123 1113. We'd appreciate the chance to resolve any concern directly first.
We do not carry out any solely automated decision-making, including profiling, that produces a legal or similarly significant effect on you.
What we store in your browser, and why
Cookies are small text files that let our store remember your cart, understand how you use hairisland.co.uk, and — only with your consent — measure the performance of our marketing.
Keep your basket contents, remember you're logged in, and let checkout work securely. These cannot be switched off.
Remember preferences such as currency or previously viewed products, to make your visit smoother.
Help us understand which collections, shades and pages perform well, so we can improve the site.
Help us show relevant adverts and measure their effectiveness, and are only set once you accept them.
You can accept or decline non-essential cookies via the cookie banner shown when you first visit our site, change your choice at any time through your browser's cookie settings, or ask us directly to stop non-essential tracking using our Privacy Opt-Out Request Form. Declining certain cookies may affect how parts of the site function.
Not intended for anyone under 18
Hairisland.co.uk is intended for adults and is not directed at, marketed to, or intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from someone under 18, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at hello@hairisland.co.uk.
How we keep your data safe
We use industry-standard technical and organisational measures, including encrypted (TLS/SSL) connections across our store, PCI-DSS compliant payment processing handled entirely by our payment providers, restricted internal access to customer data, and regular review of the third-party apps connected to our Shopify store. No method of transmission or storage is 100% secure, but we work continuously to protect your information.
Questions about this policy or your data
Hair Island Limited
For any question about this Privacy Policy, to exercise one of your rights listed in Section 08, or to raise a concern about how your data has been handled, contact our team directly using the details below.
| Company number | 16790985 |
| VAT number | GB522646694 |
Registered address:
19-20 Bourne Court, Southend Road, Woodford Green, Essex, IG8 8HD, United Kingdom
| Monday – Friday | 09:00 – 17:00 |
| Weekend & bank holidays | Closed |
We review this page whenever our practices or the law change
We may update this Privacy Policy from time to time to reflect changes in our data practices, the products and services we offer, or UK data protection law. Any changes will be posted on this page with a revised "last updated" date at the top.
The UK law behind this Privacy Policy
The core framework governing how we collect, use, store and share your personal data, including your rights in Section 08.
The UK's implementing legislation, setting out how UK GDPR applies domestically, including exemptions and ICO enforcement powers.
Governs our use of cookies and electronic marketing, including the consent requirements in Sections 04 and 09.
Ensure the information we give you about your order and how your data supports it is fair, clear and not misleading.
If you have any questions about how this policy applies, or believe your data has been misused, contact us at hello@hairisland.co.uk or raise a complaint with the Information Commissioner's Office.
A few specific scenarios, answered
Yes. Shopify Inc. hosts our entire store and processes checkout on our behalf as our data processor, under Shopify's own data processing terms and appropriate international transfer safeguards. Shopify does not use your data for its own marketing purposes.
What happens to the photo I send for the colour-match service?Your photo is used only to recommend the closest matching shade for your nano ring or clip-in extensions and is deleted within 90 days unless you ask us to keep it on file for future orders.
Can I stop marketing emails but still receive order updates?Yes. Unsubscribing from marketing emails using the link in any newsletter, or via our Privacy Opt-Out Request Form, only stops promotional messages. You will still receive essential transactional emails, such as order and delivery confirmations.
Do you ship or transfer my data outside the UK?We only ship physical orders within the UK. Some background data processing (for example, via Shopify's global infrastructure or advertising platforms) may occur outside the UK, always under the safeguards described in Section 06.
The rest of our policies, in one place
Last updated and effective from 6 September 2026. Hair Island is a trading name of Hair Island Limited (company no. 16790985, VAT GB522646694), 19-20 Bourne Court, Southend Road, Woodford Green, Essex, IG8 8HD, United Kingdom.