Privacy policy

PRIVACY POLICY

Last updated: 16 August 2026

1. ABOUT THIS PRIVACY POLICY

This Privacy Policy explains how Avenir Haircare collects, uses, stores and shares personal information when you:

• Visit or use our website.
• Purchase or return a product.
• Create or use a customer account.
• Contact us.
• Subscribe to marketing.
• Submit a review.
• Interact with our advertisements, forms or other services.

Avenir Haircare is operated by OXBEAK LTD. For the purposes of UK data-protection law, OXBEAK LTD is the data controller responsible for the personal information described in this policy.

Our online store is hosted by Shopify, which provides the ecommerce platform used to operate the website and process transactions.

1. INFORMATION WE COLLECT

The information we collect depends on how you interact with us.

We may collect the following categories of personal information:

CONTACT INFORMATION

• Name.
• Email address.
• Telephone number.
• Billing address.
• Delivery address.

ORDER AND TRANSACTION INFORMATION

• Products viewed, added to your basket or purchased.
• Order number and purchase history.
• Delivery and fulfilment information.
• Returns, refunds, complaints and customer-service records.
• Discounts, promotions and gift information.
• Transaction value, currency and payment status.

PAYMENT INFORMATION

Payments are processed by Shopify Payments, Shop Pay, Klarna or another payment provider available at checkout.

We normally receive confirmation of the payment, payment method, billing details and limited transaction information. We do not normally receive or store your complete payment-card number.

ACCOUNT INFORMATION

• Customer-account details.
• Login and authentication information.
• Saved addresses and preferences.
• Account activity and order history.

DEVICE AND WEBSITE INFORMATION

• Internet Protocol address.
• Browser and device type.
• Device identifiers.
• Operating system.
• General location derived from your IP address.
• Pages viewed and links selected.
• Products viewed or added to your basket.
• Referring website or advertisement.
• Date, time and duration of visits.
• Cookie and tracking identifiers.
• Website interactions and checkout activity.

COMMUNICATIONS

• Emails and customer-service enquiries.
• Return and refund requests.
• Feedback, complaints and correspondence.
• Information supplied when reporting a product issue.

REVIEWS AND USER CONTENT

• Product ratings and reviews.
• Photographs or other content submitted with a review.
• Name or display name associated with a review.
• Information about incentives where a review was requested or rewarded.

MARKETING INFORMATION

• Marketing subscription status.
• Email engagement, such as opens and link selections where supported.
• Advertising preferences.
• Cookie and consent choices.
• Interaction with forms, campaigns and advertisements.

PRODUCT-SAFETY INFORMATION

If you report an allergic reaction, sensitivity or other product-safety concern, you may voluntarily provide information relating to your health.

Please do not send medical information that is not necessary for us to investigate the issue.

Where health-related information is provided, we will use it only where necessary to respond to the concern, meet product-safety or legal obligations, establish or defend legal claims, or protect an individual’s vital interests. We will apply an appropriate lawful basis and special-category condition where required.

1. HOW WE COLLECT INFORMATION

We may collect personal information:

DIRECTLY FROM YOU

This includes information supplied when you:

• Place an order.
• Create an account.
• Contact us.
• Request a return or refund.
• Subscribe to marketing.
• Complete a form.
• Submit a review.
• Enter a promotion.
• Report a product problem.

AUTOMATICALLY

We may collect device, browser, cookie and usage information when you interact with our website, emails or advertisements.

FROM SERVICE PROVIDERS

We may receive information from Shopify, payment providers, fulfilment partners, delivery carriers, marketing platforms, review services, fraud-prevention providers and other companies that help us operate the store.

FROM ADVERTISING AND SOCIAL-MEDIA PLATFORMS

Where permitted, we may receive campaign, audience, referral and engagement information from platforms such as Meta or Google.

FROM PUBLIC OR PERMITTED SOURCES

We may receive information from publicly available sources, professional advisers, fraud-prevention services or another person where permitted by law.

1. HOW WE USE PERSONAL INFORMATION

We may use personal information to:

ORDERS AND CONTRACTS

• Process and confirm orders.
• Take and verify payment.
• Arrange fulfilment and delivery.
• Provide order and delivery updates.
• Process cancellations, returns and refunds.
• Manage customer accounts.
• Provide customer support.
• Respond to enquiries and complaints.

STORE OPERATION

• Operate, maintain and secure our website.
• Remember customer preferences and basket contents.
• Diagnose technical problems.
• Measure website performance.
• Improve our products, website and customer experience.
• Maintain accurate business and transaction records.

SECURITY AND FRAUD PREVENTION

• Authenticate customer accounts.
• Detect and prevent fraud or unauthorised transactions.
• Protect customers, our business and our service providers.
• Investigate suspected misuse or security incidents.
• Enforce our Terms of Service and other policies.

MARKETING AND ADVERTISING

Where permitted, we may:

• Send marketing emails.
• Measure email and campaign performance.
• Display or measure advertisements.
• Create advertising audiences.
• Personalise marketing content.
• Remind customers about products or baskets in which they showed an interest.

You can unsubscribe from marketing emails at any time using the unsubscribe link in the email or by contacting us.

Withdrawing from marketing does not prevent us from sending necessary order, account, safety or customer-service communications.

PRODUCT SAFETY AND LEGAL COMPLIANCE

• Investigate adverse reactions or product complaints.
• Issue safety information or product recalls.
• Comply with accounting, tax, consumer-protection and other legal obligations.
• Respond to lawful requests from courts, regulators and public authorities.
• Establish, exercise or defend legal claims.

1. LAWFUL BASES

Where UK or European data-protection law applies, we rely on one or more of the following lawful bases:

CONTRACT

We process information where necessary to take steps at your request or perform our contract with you, including processing orders, payments, deliveries, returns and refunds.

LEGAL OBLIGATION

We process information where necessary to comply with legal obligations, including accounting, tax, product-safety, consumer-protection and regulatory requirements.

LEGITIMATE INTERESTS

We may process information where necessary for our legitimate business interests and where those interests are not overridden by your rights.

These interests may include:

• Operating and improving our store.
• Providing customer support.
• Preventing fraud and securing our systems.
• Understanding store performance.
• Maintaining appropriate business records.
• Managing disputes and legal claims.
• Promoting our products where the law permits.

Where required, we assess whether the processing is necessary and proportionate and consider its effect on your rights.

CONSENT

We rely on consent where required, including for certain:

• Marketing communications.
• Non-essential cookies.
• Analytics technologies.
• Personalised advertising technologies.
• Uses of sensitive information.

You may withdraw consent at any time. Withdrawal does not affect processing that occurred before consent was withdrawn.

VITAL INTERESTS

In rare circumstances, we may process information where necessary to protect someone’s life or physical safety.

1. INFORMATION NEEDED TO COMPLETE AN ORDER

Certain information, including your name, delivery address, contact details and payment information, is required to process and fulfil an order.

If you do not provide the required information, we may be unable to accept, deliver or provide support for your order.

Marketing information and non-essential cookie consent are not required to purchase from us.

1. COOKIES AND TRACKING TECHNOLOGIES

Our website uses cookies and similar technologies.

These may include:

STRICTLY NECESSARY COOKIES

These are required for functions such as:

• Shopping baskets.
• Checkout.
• Payments.
• Security.
• Customer-account access.
• Remembering privacy choices.

These cookies cannot always be disabled through our consent controls because the website may not function correctly without them.

FUNCTIONAL COOKIES

These help remember preferences such as language, country, currency or other store settings.

ANALYTICS COOKIES

These help us understand how visitors use the website, which pages and products are viewed and whether the website is functioning effectively.

ADVERTISING COOKIES

Where enabled and permitted, these help us measure advertisements, understand campaign performance and display more relevant advertising.

EMAIL AND FORM TECHNOLOGIES

Our email-marketing provider may use cookies, pixels or similar technologies to measure form interactions, email engagement and website activity associated with marketing communications.

Where consent is legally required, non-essential cookies and tracking technologies should not be activated until consent has been obtained.

You can manage available choices through our cookie banner or privacy-preference controls. You may also adjust your browser settings, although blocking essential cookies may affect website functionality.

1. MARKETING COMMUNICATIONS

We may send marketing communications where:

• You have given consent.
• Applicable law permits us to contact an existing customer about similar products.
• Another valid legal basis is available.

You can opt out at any time by:

• Selecting the unsubscribe link in a marketing email.
• Adjusting available account or privacy preferences.
• Contacting info@avenir-haircare.com.

We may retain a minimal suppression record after you unsubscribe so that we can respect your request and avoid adding you back to marketing unintentionally.

You have an absolute right to object to the use of your personal information for direct marketing.

1. HOW WE SHARE PERSONAL INFORMATION

We share personal information only where reasonably necessary for the purposes described in this policy.

Recipients may include:

SHOPIFY

Shopify hosts our store and provides ecommerce, checkout, account, payment, security and analytics services.

Shopify may process personal information on our behalf and may also process certain information for its own purposes as explained in Shopify’s privacy documentation.

PAYMENT PROVIDERS

Payment information may be processed by Shopify Payments, Shop Pay, Klarna, card networks, banks and other payment providers selected at checkout.

FULFILMENT AND DELIVERY PROVIDERS

We share the information needed to prepare and deliver orders with Selfnamed, its fulfilment facilities, delivery carriers and logistics providers.

This may include your name, delivery address, contact details, ordered products and order reference.

MARKETING PROVIDERS

We may use Klaviyo to support customer communications, email marketing, forms, audience management and related website analytics.

Where enabled and permitted, advertising and analytics platforms such as Meta or Google may receive cookie, device, campaign and interaction information.

REVIEW PROVIDERS

We may use review platforms such as Loox to request, collect, verify and display product reviews.

TECHNICAL AND PROFESSIONAL PROVIDERS

Information may be shared with:

• Website and technology providers.
• Security and fraud-prevention services.
• Accountants, insurers, legal advisers and other professional advisers.
• Customer-support providers.
• Data-storage and cloud-service providers.

AUTHORITIES AND LEGAL RECIPIENTS

We may disclose information where reasonably necessary to:

• Comply with a legal obligation.
• Respond to a lawful court, regulatory or government request.
• Protect customers or another person.
• Investigate fraud or illegal activity.
• Establish, exercise or defend legal claims.

BUSINESS TRANSFERS

Information may be shared with advisers, purchasers or successor organisations in connection with a proposed or completed sale, merger, restructuring or transfer of all or part of our business.

Any recipient will be required to handle the information appropriately and in accordance with applicable law.

1. SALE, SHARING AND TARGETED ADVERTISING

We do not sell personal information in exchange for money.

Certain uses of advertising cookies or information supplied to advertising platforms may be classified as a “sale”, “sharing” or use for “targeted advertising” under some United States privacy laws, even where no money is exchanged.

Where applicable, you may opt out using our cookie banner, privacy-preference controls, data-sharing opt-out page or by contacting us.

We will not discriminate against you for exercising an applicable privacy right.

1. INTERNATIONAL DATA TRANSFERS

Some service providers may process personal information outside the United Kingdom or European Economic Area, including in Canada, the United States and other countries where they or their service providers operate.

Where data-protection law requires safeguards for an international transfer, we will rely on an appropriate mechanism, such as:

• An adequacy regulation or adequacy decision.
• The UK International Data Transfer Agreement.
• The UK Addendum to the European Commission’s Standard Contractual Clauses.
• European Commission Standard Contractual Clauses.
• Another legally recognised transfer safeguard or exception.

You may contact us for further information about the safeguards relevant to your personal information.

1. DATA RETENTION

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, accounting, safety and dispute-resolution requirements.

Retention periods may include:

ORDER AND FINANCIAL RECORDS

Order, payment, refund and accounting records may generally be retained for up to six years after the relevant transaction or financial period, and longer where required by law or an ongoing dispute.

CUSTOMER ACCOUNTS

Account information may be retained while the account remains active and for a reasonable period afterward, unless deletion is requested and no legal reason requires continued retention.

CUSTOMER-SERVICE RECORDS

Enquiries, complaints, returns and safety reports may be retained for as long as reasonably necessary to resolve the matter, identify recurring concerns and protect legal rights.

MARKETING RECORDS

Marketing information is retained until you unsubscribe, withdraw consent or object, subject to maintaining a minimal suppression record.

REVIEWS

Published reviews may remain visible while they are relevant to the product or store. You may contact us if you wish to request removal or anonymisation.

COOKIE AND ANALYTICS DATA

Retention depends on the type of technology and provider. More information may be available through our cookie-preference controls or the provider’s privacy information.

We may retain information for longer where necessary because of fraud prevention, product safety, legal proceedings, regulatory enquiries or another legal obligation.

When information is no longer required, we will delete or anonymise it where reasonably practicable.

1. DATA SECURITY

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, alteration, disclosure or misuse.

These measures may include:

• Access controls.
• Account authentication.
• Secure payment processing.
• Encryption where appropriate.
• Service-provider security requirements.
• Monitoring and fraud-prevention measures.
• Limiting access to people who need the information.

No website, transmission method or storage system can be guaranteed to be completely secure.

Do not send full card numbers, passwords or other highly sensitive information to us by email.

1. YOUR PRIVACY RIGHTS

Depending on where you live and the applicable law, you may have rights including:

• The right to be informed about how your information is used.
• The right to request access to your personal information.
• The right to correct inaccurate or incomplete information.
• The right to request deletion of information.
• The right to restrict certain processing.
• The right to object to certain processing.
• The right to receive certain information in a portable format.
• The right to withdraw consent.
• The right to object to direct marketing.
• Rights relating to solely automated decisions that produce legal or similarly significant effects.
• The right to complain to a data-protection authority.

These rights are not absolute and may be subject to legal exceptions.

To exercise a right, contact:

info@avenir-haircare.com

Please provide enough information for us to identify you and understand your request.

We may ask for reasonable proof of identity. We will not request more information than necessary to verify and respond to the request.

Where applicable, you may use an authorised agent. We may request evidence of the agent’s authority and may need to verify your identity directly.

1. AUTOMATED PROCESSING AND PROFILING

Shopify, payment providers and fraud-prevention services may use automated systems to assess transactions for fraud, security or payment risk.

Advertising and analytics providers may use device and interaction information to create audiences, measure campaigns or personalise content where permitted.

We do not normally make decisions based solely on automated processing that produce legal or similarly significant effects for you.

If that changes, we will provide the information and safeguards required by applicable law.

1. CHILDREN’S PRIVACY

Our store is intended for adults purchasing haircare products.

We do not knowingly collect personal information directly from children who are below the age at which they can independently consent to the relevant processing under applicable law.

Products intended for children should be purchased and managed by a parent, guardian or responsible adult.

If you believe a child has provided personal information to us without appropriate permission, contact us so that we can investigate and take appropriate action.

1. THIRD-PARTY WEBSITES

Our website may link to websites or services operated by third parties.

We are not responsible for the privacy practices of websites or services that we do not control. You should review their privacy information before providing personal information.

1. COMPLAINTS

Please contact us first if you have a concern about how we have handled your personal information. We will investigate and try to resolve the matter.

UK residents may complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Website: https://ico.org.uk/make-a-complaint/

Residents of the European Economic Area may complain to the data-protection supervisory authority in their country.

Residents of other locations may contact the relevant privacy or consumer-protection authority.

1. CHANGES TO THIS POLICY

We may update this Privacy Policy to reflect changes to our services, providers, legal obligations or processing activities.

The revised policy will be posted on our website with an updated date.

Where a change materially affects how we use personal information, we will provide additional notice where required by law.

1. CONTACT INFORMATION

The data controller is:

OXBEAK LTD
Trading as Avenir Haircare
Company number: 15926865
Registered in England and Wales

Registered office:

Unit 7–8 Silverlink Business Park
Wallsend
United Kingdom
NE28 9NX

Email: info@avenir-haircare.com

Website: https://avenir-haircare.com