PRIVACY

PRIVACY NOTICE

Who we are

Saint Luke London Ltd (registered in England and Wales, company number 08825739), is the data controller responsible for personal information collected through www.saintluke.co. If you have any questions about this notice or how we use your data, please contact us at hello@saintluke.co.

What information we collect

When you visit, register an account or place an order, we may collect:

Identity and contact details: name, billing and delivery address, email, phone number
Order information: items purchased, order value, delivery preferences
Account information: username, encrypted password, order history
Communications: messages you send us, customer service enquiries, product reviews
Technical information: IP address, browser type, device information, pages viewed, referring URL
Marketing preferences: whether you have opted in to receive marketing communications

We do not collect or store full payment card details. Payments are processed by PCI-DSS compliant providers (such as Shopify Payments and PayPal) who handle card information directly.

How we use your information, and our lawful basis for doing so

To process and fulfil your order, and to contact you about it — performance of a contract
To manage your customer account — performance of a contract
To respond to customer service enquiries — legitimate interests (providing support) and performance of a contract
To send you marketing emails about products, offers and journal content — your consent, which you can withdraw at any time by clicking "unsubscribe" in any email
To notify you when a product is back in stock — your consent, given when you click "Notify Me When Available"
To improve our website and understand how customers use it — legitimate interests (developing our business)
To prevent fraud and protect our legal rights — legitimate interests and legal obligation
To comply with legal, tax and accounting obligations — legal obligation

Who we share your information with

We share your data only with trusted service providers who help us run the business. These include:

Shopify Inc. — our e-commerce platform, hosting the store and processing orders
Klaviyo Inc. — for marketing emails and back-in-stock notifications (only where you have opted in)
Loox Ltd. — for product reviews (only the information you voluntarily submit)
Shipping carriers (Royal Mail, DHL, FedEx and similar) — to deliver your order
Payment providers (Shopify Payments, PayPal and similar) — to process payments
Analytics providers — to measure site performance
Professional advisers and law enforcement — where required by law or to establish, exercise or defend our legal rights

All processors are contractually bound to process your data only on our instructions, keep it secure, and comply with applicable data protection law.

We do not sell your personal data.

International transfers

Some of our service providers (including Shopify and Klaviyo) are based outside the UK, principally in the United States. Where your data is transferred outside the UK, we rely on appropriate safeguards — typically the UK Addendum to the EU Standard Contractual Clauses, or transfers to countries deemed adequate by the UK government.

How long we keep your information

Order records: 7 years (HMRC and tax law requirements)
Account details: until you delete your account, or after 3 years of inactivity
Marketing data: until you unsubscribe; we then hold minimal suppression-list data indefinitely to ensure we do not re-contact you
Customer service correspondence: 3 years after last contact
Website analytics data: up to 26 months

Cookies and similar technologies

Our site uses cookies. Strictly necessary cookies (for example, to keep items in your basket or keep you logged in) are always active because the site cannot function without them. All other cookies — analytics, functional and marketing — are only set with your prior consent, which you can give, refuse or withdraw through the cookie banner on our site. You can also manage cookies through your browser settings, although this may affect how the site works for you.

Your rights

Under UK GDPR, you have the right to:

Request access to the personal data we hold about you
Ask us to correct inaccurate or incomplete data
Request deletion of your data, subject to our legal obligations to retain certain records
Ask us to restrict or object to how we process your data
Receive your data in a portable format
Withdraw any consent you have given, at any time
Not be subject to automated decision-making that produces legal or similarly significant effects

To exercise any of these rights, email hello@saintluke.co. We will respond within one month.

If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner's Office:

Website: ico.org.uk
Helpline: 0303 123 1113

Security

We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss or misuse, including encryption in transit (TLS/HTTPS), access controls on our systems, and working with reputable processors. You are responsible for keeping your account password confidential and for all activity under your account. We will not be responsible for losses arising from unauthorised use of your password unless caused by our negligence. If you suspect your account has been compromised, contact us immediately.

Third-party links

Our site may contain links to external sites. We are not responsible for the privacy practices or content of those sites, and this notice does not apply to them.

Children

Our products are intended to be purchased by adults. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to this notice

We may update this notice from time to time. The current version will always be posted on this page with the "last updated" date below.

Last updated: 23/04/2026