Privacy Policy

Last updated: 17 February 2026

1. Purpose of this Policy

This Privacy Policy explains how Hadrill Hair (“Hadrill Hair”, “we”, “us”, “our”) collects, uses, discloses, and protects personal data when you visit hadrillhair.com (the “Site”), use our services, interact with us, or purchase our products (together, the “Services”).

It is intended to meet the requirements of applicable data protection and privacy laws, including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, and relevant US federal and state privacy laws where they apply to us.

2. Who We Are (Controller)

The Site is operated by Hadrill Hair, a trading name of Emilly Hadrill Hair Pty Ltd, an Australian proprietary company limited by shares, ACN 168 434 857, ABN 85 168 434 857, registered in Queensland, Australia (the “Company”).

For the purposes of the GDPR and UK GDPR, Emilly Hadrill Hair Pty Ltd is the “controller” of your personal data collected through the Site and the Services.

You can contact us using the contact details provided on the Site and in your order confirmation, or via the contact methods set out in section 14 below.

3. Personal Data We Collect

The personal data we collect about you will depend on how you interact with us and the Services. We may collect and process the following categories of personal data:

• Identity and contact data: name, title, billing and shipping address, email address, telephone number, account login details.
• Order and transaction data: details of products you purchase, dates and times of orders, order value, discounts used, payment status, returns and refund details.
• Payment data: limited payment information such as card type and last four digits of your card number, payment method and transaction IDs; full card details are processed by our payment service providers and are not stored by us.
• Account data: username, password (stored in hashed form), order history, saved addresses, preferences.
• Communications data: messages you send to us (for example via email, forms, live chat or social media), feedback, reviews and survey responses.
• Marketing and preference data: your choices about receiving marketing from us, subscription status, and information about your interests where you choose to share it.
• Usage and technical data: IP address, device identifiers, browser type and version, time zone setting, operating system, referring URLs, pages viewed, clicks, time spent on pages, and other information about how you use and navigate the Site.
• Cookie and tracking data: information collected through cookies and similar technologies, as described in our Cookie Policy.
• Social media data: information from your public profile and interactions with our content when you engage with our social media pages or log in using social media (where available).

We do not intentionally collect special categories of personal data (such as health data) or information about criminal convictions through the Site, and we ask you not to provide such data to us.

4. How We Collect Your Personal Data

We collect personal data in the following ways:

• Directly from you: when you place an order, create an account, sign up for marketing, contact us, take part in a survey or competition, or otherwise communicate with us.
• Automatically: when you use the Site, through cookies, pixels, log files and similar technologies that record your interactions and technical information (see section 6 and our Cookie Policy).
• From third parties: such as payment service providers, analytics providers, advertising networks, and social media platforms, to the extent permitted by their privacy policies and applicable law.

5. How We Use Your Personal Data (Purposes and Legal Bases)

We use your personal data for the purposes and on the legal bases set out below. Where GDPR/UK GDPR applies, we rely on one or more of the following legal bases: performance of a contract, compliance with legal obligations, legitimate interests, and consent.

• To process and fulfil your orders: managing orders, providing products, arranging delivery, handling payments, and providing customer service. Legal basis: performance of a contract; compliance with legal obligations.
• To manage your account: creating and maintaining your online account, enabling you to view order history and saved details. Legal basis: performance of a contract; legitimate interests in providing account functionality.
• To provide customer support: responding to your queries, requests and complaints. Legal basis: performance of a contract; legitimate interests in operating our business and improving our services.
• To manage returns, refunds and warranties: handling returns and warranty claims and complying with consumer protection laws. Legal basis: performance of a contract; legal obligations.
• To send service communications: sending order confirmations, delivery updates, changes to our terms, or other non‑marketing communications. Legal basis: performance of a contract; legal obligations.
• To send marketing communications: sending emails, SMS or other messages about our products, offers, news and events, where permitted by law and your preferences. Legal basis: consent (where required); legitimate interests in promoting our business (where permitted by law).
• To personalise content and offers: tailoring content, recommendations and marketing to your interests based on your interactions with us. Legal basis: legitimate interests; consent where required for profiling or cookies.
• To run promotions, surveys and competitions: administering entries and communicating with participants. Legal basis: performance of a contract; legitimate interests.
• To improve and secure our Site and Services: monitoring performance, analysing usage, testing features, detecting and preventing fraud and abuse, and maintaining security. Legal basis: legitimate interests in operating and securing our business; legal obligations.
• To comply with legal and regulatory requirements: keeping records, responding to lawful requests from authorities, and complying with tax, accounting, consumer and data protection laws. Legal basis: legal obligations; legitimate interests.

Where we rely on consent, you may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

6. Cookies and Similar Technologies

We use cookies and similar technologies (such as pixels and tags) to operate the Site, remember your preferences, analyse how you use our Services, and deliver relevant advertising.

For detailed information about the cookies we use, the purposes for which we use them, and how you can manage your cookie preferences (including consent mechanisms for EU/UK visitors), please refer to our separate Cookie Policy.

Where required by law, we will obtain your consent before setting non‑essential cookies on your device.

7. How We Share Your Personal Data

We do not sell your personal data. We may share your personal data with the following categories of recipients, only as necessary for the purposes described in this Policy:

• Group companies and brands: other entities under common ownership or control with Emilly Hadrill Hair Pty Ltd, where necessary for internal administration and to provide our Services.
• Service providers: third‑party vendors who perform services on our behalf, such as payment processors, fraud‑prevention providers, IT and hosting providers, logistics and delivery companies, marketing and advertising partners, analytics providers, and customer support tools.
• Professional advisers: lawyers, auditors, accountants and insurers who provide professional services to us.
• Authorities and regulators: law enforcement, regulators, courts and government bodies where we are required or permitted by law to disclose your data, or to protect our rights or the rights of others.
• Business transferees: third parties in connection with any actual or potential merger, acquisition, sale of assets, restructuring or similar transaction involving our business, in which case personal data may be transferred as part of the transaction, subject to appropriate safeguards.

8. International Transfers

We are based in Australia and your personal data may be processed in Australia and in other countries where our service providers are located.

If you are located in the EU or UK, this means your personal data may be transferred to countries outside the European Economic Area (EEA) and the UK that may not provide the same level of data protection as your home jurisdiction.

Where we transfer personal data from the EEA or UK to a country that has not been deemed to provide an adequate level of protection, we will implement appropriate safeguards, such as entering into standard contractual clauses approved by the European Commission or UK authorities, or relying on another lawful transfer mechanism, unless an exemption applies.

You can contact us for more information about international transfers and the safeguards we use.

9. Data Retention

We keep your personal data only for as long as necessary to fulfil the purposes for which we collected it, including to meet legal, accounting or reporting requirements.

In determining retention periods, we consider the amount, nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes of processing, and whether we can achieve those purposes through other means, as well as applicable legal requirements.

For example, we typically retain:

• order and transaction records for the period required by tax and consumer laws;
• account data for as long as your account is active and for a reasonable period thereafter;
• marketing data until you opt out or your consent is withdrawn, plus a short period to record your preference.

10. Security of Your Personal Data

We take appropriate technical and organisational measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

Measures may include encryption, access controls, secure hosting environments, and regular monitoring of our systems. However, no method of transmission or storage is completely secure and we cannot guarantee absolute security.

You are responsible for keeping your account credentials confidential and for notifying us promptly if you suspect any unauthorised access to your account.

11. Your Rights (EU and UK)

If you are in the EU or UK, you have certain rights in relation to your personal data under the GDPR/UK GDPR, subject to conditions and limitations.

• Right of access: to obtain confirmation whether we process your personal data and to request a copy.
• Right to rectification: to request correction of inaccurate or incomplete data.
• Right to erasure: to request deletion of your data in certain circumstances.
• Right to restriction: to request restriction of processing in certain circumstances.
• Right to data portability: to receive your data in a structured, commonly used and machine‑readable format and to transmit it to another controller, where technically feasible.
• Right to object: to object to processing based on legitimate interests, including profiling, and to direct marketing at any time.
• Rights in relation to automated decision‑making: where we carry out automated decisions that have legal or similarly significant effects, you may have rights to human intervention and to contest the decision.

You also have the right to lodge a complaint with your local supervisory authority if you are concerned about how we process your personal data.

12. Your Rights and Choices (US and Other Regions)

Depending on where you live in the US and other jurisdictions, you may have additional privacy rights under applicable state or local laws, which may include rights to know, access, correct, delete or opt out of certain processing of your personal information.

Where such laws apply to us, you can exercise your rights by contacting us using the details in section 14 or via any dedicated “privacy choices” tools or links we provide on the Site.

You may also have the right to designate an authorised agent to make certain requests on your behalf under some US state laws.

13. Marketing Communications and Preferences

You can choose whether to receive marketing communications from us. We may send you marketing messages by email, SMS, or other channels, where permitted by law and in accordance with your preferences.

You can opt out of marketing at any time by:

• clicking the “unsubscribe” link in an email;
• following the instructions in an SMS or other message; or
• contacting us using the details in section 14.

Even if you opt out of marketing, we may still send you non‑marketing messages, such as service and transactional emails about your orders.

14. How to Contact Us

If you have any questions about this Privacy Policy, our use of your personal data, or if you wish to exercise your rights, please contact us using the contact details provided on the Site and in your order confirmation, or by using the following:

Email: info@hadrillhair.com
Postal: Emilly Hadrill Hair Pty Ltd, 41 Taree Street, Unit 1/41, Burleigh Heads, QLD 4220, Australia

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes in our practices, technologies, legal requirements or for other operational reasons.

When we make changes, we will update the “Last updated” date at the top of this page and, where appropriate, provide additional notice (such as by email or a notice on the Site). We encourage you to review this Policy periodically to stay informed about how we handle your personal data.