Privacy Policy

Last updated: 24 September 2026

This notice explains how HIGHBORN uses personal information when you browse, shop, subscribe, join our rewards programme or contact us. It is information for you, not a request for consent.

1. Who is responsible for your information?

HIGHBORN LTD, trading as HIGHBORN London, is registered in England and Wales under company number 09809834. Our registered office is 20–22 Wenlock Road, London, N1 7GU, United Kingdom. We are the controller of the personal information we use for our own retail and marketing activities.

For privacy questions, requests or complaints, contact info@highbornlondon.com or 020 7112 8147. You can also use our Customer Care page. Please mark your message “Privacy” so we can direct it to the right person. You can also write to our registered office.

2. Information we collect and where it comes from

  • Contact and account details: your name, email address, telephone number, delivery and billing addresses, and account preferences.
  • Orders and subscriptions: items ordered, payments and refunds, delivery details, subscription selections and changes, and rewards or credit activity. Payment providers process payment credentials; order records can include payment status and limited payment-method details. Please never send us full card details.
  • Messages and feedback: enquiries, chat conversations, complaints, reviews, survey responses and any photos or other material you choose to send.
  • Preferences and interactions: marketing choices, consent records, products you view or buy, and interactions with our messages, where tracking is permitted.
  • Technical information: IP address, approximate location, browser and device information, pages visited, referral links and identifiers used by cookies or similar technologies.

We obtain information directly from you, through your use of our services, and from providers helping us process payments, deliver orders, manage subscriptions and rewards, provide support, and measure marketing. For example, a courier provides delivery status and a payment provider provides payment or fraud-check results. A gift buyer may give us a recipient’s name and address so we can deliver their gift.

Details needed to take payment and deliver an order are required to fulfil that order. Marketing choices, reviews and survey answers are optional.

3. Why we use information and our UK legal bases

  • Taking and fulfilling orders, subscriptions, returns and account requests: performance of our contract with you, or steps you ask us to take before a contract.
  • Answering general enquiries and improving customer service: our legitimate interests in helping customers and running an effective business; contract where the enquiry concerns an order.
  • Accounts, tax, product-safety duties and lawful regulatory requests: compliance with legal obligations.
  • Security, fraud prevention and handling disputes: our legitimate interests in protecting customers, our business and legal rights; legal obligation where a specific duty applies.
  • Optional email and SMS marketing: consent, or our legitimate interests for similar-product marketing where every condition of the PECR customer “soft opt-in” is met, as explained below.
  • Postal marketing: our legitimate interests in telling customers about relevant HIGHBORN products, subject to your right to object.
  • Advertising tracking, optional analytics and personalisation: consent where required by the rules on cookies and similar technologies. An exemption is only available where its legal conditions are met; advertising tracking is not essential to making a purchase.
  • Rewards, referrals, reviews and surveys: contract for benefits you request; our legitimate interests in administering feedback and understanding customer needs; separate permission where needed to use your photograph or story in advertising.

Where we rely on legitimate interests, your rights and reasonable expectations must be taken into account. We cannot use that basis to override a requirement for consent.

4. Your marketing choices

You can object to direct marketing at any time, including related profiling. We will stop using your information for that purpose.

Giving us a phone number for delivery, placing an order or using this website does not itself mean you consent to marketing. You do not have to subscribe to marketing to buy from us.

Where we use the customer soft opt-in for email or SMS, we must have obtained your details directly during a sale or negotiations for a sale, market only our own similar products, and give you a clear, simple opt-out both when collecting the details and in every marketing message. Otherwise, consent is required. Promotional abandoned-checkout reminders are marketing too.

Use the unsubscribe link in an email, the opt-out instructions in a text (such as replying STOP where supported), or contact us. We also accept clear opt-out requests made in other words or through Customer Care. To stop postal marketing, contact us with the name and address receiving it. Essential order, subscription and safety messages can still be sent after you opt out of advertising.

We may use purchase history and permitted engagement information to choose relevant HIGHBORN offers. Advertising partners can match identifiers and website activity to their own information to measure campaigns and personalise adverts, subject to the relevant permissions. You can object to marketing profiling and withdraw tracking consent.

5. The organisations that help us

Access depends on the service you use and the information needed for it. Our service providers include:

  • Shopify for our online shop, checkout and customer accounts; payment providers for the payment method you choose.
  • Recharge for subscriptions; Smile.io for rewards; referral-service providers for referral offers.
  • Klaviyo for email and SMS; Gorgias for customer support and chat, including automated assistance where offered.
  • Delivery and fulfilment providers, including Royal Mail and DHL, and shipping-management services.
  • Review and survey providers, including Stamped and KNO; website and upsell tools, including Zipify; backup, accounting and business-administration providers.
  • Analytics and advertising services, including Triple Whale, Google, Meta and Microsoft, where their features are used and the relevant privacy permissions apply; postal-mail providers such as PostPilot and Scribeless.

Some providers act on our instructions. Others, including payment providers, advertising platforms and Shopify for certain services, may also act as controllers for their own purposes. Their notices explain those activities: Shopify privacy notice, Klaviyo privacy notice, Gorgias privacy notice, Google privacy notice, Meta privacy notice and Microsoft privacy notice.

Information may also be disclosed to professional advisers, insurers, regulators or law-enforcement bodies where necessary and lawful, or to a potential buyer and their advisers in a business transfer with appropriate confidentiality safeguards.

6. Cookies and similar technologies

These technologies can support your basket, account, security and privacy choices, and can also be used for analytics and advertising. Read our Cookie Notice for the different purposes and your choices. Visiting or continuing to browse is not consent to optional tracking.

7. International transfers

Our providers operate internationally, so information may be processed outside the UK, including in the EEA, Canada and the United States. Protections depend on the recipient and destination. For restricted transfers, the applicable mechanism may be UK adequacy regulations, including an eligible certified recipient under the UK Extension to the EU–US Data Privacy Framework, or approved contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum to the EU standard contractual clauses, with any additional measures required.

Shopify and Klaviyo explain their transfer arrangements in their Shopify Data Processing Addendum and Klaviyo Data Processing Agreement. Contact us for information about the safeguard applicable to your information and how to obtain a copy. Agreeing to this notice is not consent to an international transfer.

8. How long information is kept

Retention depends on the purpose and the record. The criteria are:

  • Orders, payments and tax records: the applicable accounting and tax retention requirements, and any period needed for a genuine dispute or legal claim.
  • Accounts, subscriptions and rewards: how long the service remains active, any outstanding deliveries, balances or requests, and necessary records after closure.
  • Support, reviews and complaints: the time needed to resolve the matter, maintain relevant service history, and meet safety, evidence or legal requirements.
  • Marketing: whether there is a valid marketing permission or other lawful basis, your engagement and any withdrawal or objection. A limited suppression record may be retained to ensure you are not contacted again.
  • Technical and tracking records: the function of the record, the technology’s expiry, the relevant provider’s retention settings and any proportionate security or dispute need.

These criteria do not permit information to be kept indefinitely simply because no deletion request has been made. You can ask which retention period applies to a particular record. Deletion rights have exceptions, including information we must retain by law.

9. Sensitive information and automated assistance

You do not need to send medical records to shop with us or ask a general skincare question. Please avoid sending diagnoses, treatment records, full payment details or other unnecessary sensitive information. If health information is needed for a particular request, its use requires both a lawful basis and a separate special-category condition; where we rely on explicit consent, we will ask for it separately. Merely sending a message is not treated as explicit consent for unrelated health profiling or advertising.

Automated tools may help suggest products, answer routine questions and check transaction or device signals for fraud. If an automated response or security check affects your order or request, contact us to ask for a person to review it, explain your position and challenge the outcome. Payment providers may make their own decisions under their own notices. Our skincare guidance is not a medical diagnosis.

10. Your privacy rights

Depending on the circumstances, you can ask for access to your information, correction, erasure, restriction, or a portable copy of information you provided. You can object to processing based on legitimate interests and to direct marketing. Where processing relies on consent, you can withdraw it at any time; this does not undo lawful processing before withdrawal. Applicable safeguards also protect you where a significant decision is made solely by automated means.

Contact us using the details above. You do not need legal wording or an account to make a request. We may ask for proportionate information to confirm identity and protect your information. We normally respond within one month. If a lawful extension or other timing rule applies, we will explain it. Requests are normally free of charge.

11. Privacy complaints

You can complain by email, post, phone or through our Customer Care page. Tell us what happened, when it happened, how we can contact you and what you would like us to put right. You may copy and complete this optional form in an email or letter:

Name:
Preferred contact details:
What happened and when:
Relevant order or earlier request, if any:
What I would like HIGHBORN to do:

We will acknowledge a data-protection complaint within 30 days of receiving it, make appropriate enquiries, keep you informed and tell you the outcome without undue delay. You can also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not give up that right by contacting us first.

12. Other countries, children and changes

Our shop is intended for adults. If you believe a child has provided information that should not be held, please contact us. People outside the UK may have additional rights under local law, including a right to complain to their local supervisory authority; this notice does not remove those rights.

We will update this notice when our practices or legal requirements change and give any further notice required. A new notice does not retrospectively create consent.

Privacy · Terms · Returns · Delivery · Subscriptions · Cookies