Privacy policy
Hadrill Hair
Privacy Policy
1. Purpose of this Policy
This Privacy Policy explains how Hadrill Hair ("Hadrill Hair", "we", "us", "our") collects, uses, discloses, and protects personal data when you visit hadrillhair.com (the "Site"), use our services, interact with us, or purchase our products (together, the "Services").
It is intended to meet the requirements of applicable data protection and privacy laws, including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, and relevant US federal and state privacy laws where they apply to us.
2. Who We Are (Controller)
The Site is operated by Hadrill Hair Ltd, trading as Hadrill Hair, a company registered in England and Wales under company number 17366295 (the "Company").
For the purposes of the GDPR and UK GDPR, Hadrill Hair Ltd is the "controller" of your personal data collected through the Site and the Services.
You can contact us using the contact details provided on the Site and in your order confirmation, or via the contact methods set out in section 14 below.
3. Personal Data We Collect
The personal data we collect about you will depend on how you interact with us and the Services. We may collect and process the following categories of personal data:
Identity and contact data: name, title, billing and shipping address, email address, telephone number, account login details.
Order and transaction data: details of products you purchase, dates and times of orders, order value, discounts used, payment status, returns and refund details.
Payment data: limited payment information such as card type and last four digits of your card number, payment method and transaction IDs; full card details are processed by our payment service providers and are not stored by us.
Account data: username, password (stored in hashed form), order history, saved addresses, preferences.
Communications data: messages you send to us (for example via email, forms, live chat or social media), feedback, reviews and survey responses.
Marketing and preference data: your choices about receiving marketing from us, subscription status, and information about your interests where you choose to share it.
Usage and technical data: IP address, device identifiers, browser type and version, time zone setting, operating system, referring URLs, pages viewed, clicks, time spent on pages, and other information about how you use and navigate the Site.
Cookie and tracking data: information collected through cookies and similar technologies, as described in section 6.
Social media data: information from your public profile and interactions with our content when you engage with our social media pages or log in using social media (where available).
We do not intentionally collect special categories of personal data (such as health data) or information about criminal convictions through the Site, and we ask you not to provide such data to us.
4. How We Collect Your Personal Data
We collect personal data in the following ways:
Directly from you: when you place an order, create an account, sign up for marketing, contact us, take part in a survey or competition, or otherwise communicate with us.
Automatically: when you use the Site, through cookies, pixels, log files and similar technologies that record your interactions and technical information (see section 6).
From third parties: such as payment service providers, analytics providers, advertising networks, and social media platforms, to the extent permitted by their privacy policies and applicable law.
5. How We Use Your Personal Data (Purposes and Legal Bases)
We use your personal data for the purposes and on the legal bases set out below. Where GDPR/UK GDPR applies, we rely on one or more of the following legal bases: performance of a contract, compliance with legal obligations, legitimate interests, and consent.
To process and fulfil your orders: managing orders, providing products, arranging delivery, handling payments, and providing customer service. Legal basis: performance of a contract; compliance with legal obligations.
To manage your account: creating and maintaining your online account, enabling you to view order history and saved details. Legal basis: performance of a contract; legitimate interests in providing account functionality.
To provide customer support: responding to your queries, requests and complaints. Legal basis: performance of a contract; legitimate interests in operating our business and improving our services.
To manage returns, refunds and warranties: handling returns and warranty claims and complying with consumer protection laws. Legal basis: performance of a contract; legal obligations.
To send service communications: sending order confirmations, delivery updates, changes to our terms, or other non‑marketing communications. Legal basis: performance of a contract; legal obligations.
To send marketing communications: sending emails, SMS or other messages about our products, offers, news and events, where permitted by law and your preferences. Legal basis: consent (where required); legitimate interests in promoting our business (where permitted by law).
To personalise content and offers: tailoring content, recommendations and marketing to your interests based on your interactions with us. Legal basis: legitimate interests; consent where required for profiling or cookies.
To run promotions, surveys and competitions: administering entries and communicating with participants. Legal basis: performance of a contract; legitimate interests.
To improve and secure our Site and Services: monitoring performance, analysing usage, testing features, detecting and preventing fraud and abuse, and maintaining security. Legal basis: legitimate interests in operating and securing our business; legal obligations.
To comply with legal and regulatory requirements: keeping records, responding to lawful requests from authorities, and complying with tax, accounting, consumer and data protection laws. Legal basis: legal obligations; legitimate interests.
Where we rely on consent, you may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
AI Chat
Our website offers an AI assistant for product questions, hair care guidance and shopping recommendations. You are chatting with AI rather than a person. You can contact our team at info@hadrillhair.com instead.
Information processed. We process the messages you send, the assistant's replies, conversation identifiers and timestamps. We also process technical information for security and abuse prevention, including your IP address through our hosting and verification services and a pseudonymous IP-derived identifier in our chat records. Your browser uses session storage to keep the chat session available while you browse. Please do not send payment details, passwords or sensitive personal information through the chat. You can optionally upload one to three hair photos for a colour comparison with your chosen Hadrill range. No face is needed. Do not upload identity documents or photos of other people without their permission.
Optional hair-photo comparisons. We ask for your agreement before sending your selected hair photos through Cloudflare and OpenRouter to Google’s Gemini model on Google Vertex AI for a colour comparison. We do not use this feature to identify you. Hadrill does not save uploaded photos, pixel samples or hair-region masks in its chat records or image storage. We save the comparison result, selected product and shade references, photo count and consent/version details with your chat for service review under the retention described below. You can remove a selected photo before sending it, or use the text chat without uploading photos.
Why we use it. We use this information to answer questions, suggest relevant products, maintain conversation context, review the quality of replies and protect the service from misuse. Our legal basis under the UK GDPR and EU GDPR is our legitimate interest in providing useful customer support, improving service quality and keeping the service secure. Where your enquiry concerns an existing or proposed purchase, processing may also be necessary to perform our contract with you or take steps at your request before entering into one.
Service providers. Cloudflare hosts, stores and protects the chat, including automated abuse verification. Relevant text messages and conversation history are sent through OpenRouter to DeepInfra, which runs the DeepSeek model for normal chat replies. Hair photos you agree to submit for a colour comparison are sent through OpenRouter to Google Vertex AI, using Google’s Gemini model and a US provider endpoint. The photo comparison receives your selected photos and Hadrill shade references, without your text-chat history. We configure both routes to exclude providers that use prompts for training and to require endpoints designated for zero data retention for model inference. This setting does not delete the conversation records that we retain ourselves. Providers may process information outside the UK, including in the United States; the international-transfer provisions of this Policy apply. We do not represent that all chat processing takes place exclusively in the UK or the United States.
Saved chats and your choices. Messages and replies have no automatic expiry and remain saved for service review until our team manually deletes them. Closing the widget, starting a new conversation or expiry of a chat session does not delete these records. You can request access, correction or deletion, or object to processing based on legitimate interests, by emailing info@hadrillhair.com. Please include the approximate date of your chat and enough information to help us identify it, without sending sensitive information unnecessarily. The rights and exceptions described in this Policy apply.
AI limitations. Replies can be inaccurate. Colour suggestions are AI estimates, not a guaranteed physical match. We may show up to three possible shades in order. Any percentages shown on earlier comparisons describe photographic colour similarity, not a probability of a correct match. Lighting, cameras and screens affect the comparison. The assistant does not decide refund or warranty entitlement or make other decisions with legal or similarly significant effects. Contact our team if a reply needs checking.
6. Cookies and Similar Technologies
We use cookies and similar technologies (such as pixels and tags) to operate the Site, remember your preferences, analyse how you use our Services, and deliver relevant advertising.
Essential cookies and browser storage help the Site and requested chat service function. Non-essential cookies and similar technologies may be used for analytics, personalisation and advertising. Where the cookie banner is displayed, use its Manage preferences controls to choose the available cookie categories, or decline non-essential cookies. Your browser settings also let you block or remove cookies, although this may affect Site features.
Where required by law, we will obtain your consent before setting non‑essential cookies on your device.
7. How We Share Your Personal Data
We share personal data only for the purposes described in this Policy. This includes certain contact identifiers, shopping and order information, and usage or device information shared with advertising, marketing and analytics partners to measure campaigns and show relevant advertising. Depending on where you live and how a service uses the information, these activities may be treated as a "sale", "sharing" or "targeted advertising" under applicable US state privacy laws, even where no money is exchanged.
Where applicable, you can opt out through our Your Privacy Choices page. We recognise Global Privacy Control signals in regions where applicable. Where consent is required for non-essential cookies or similar technologies, you can accept or decline them through the cookie banner and manage the available preferences. You can also contact us at info@hadrillhair.com to exercise applicable privacy rights.
Shopify and enhanced services
Shopify hosts our online store. Shopify Network Intelligence is enabled, which allows Shopify to use data from your interactions with our store together with data from interactions with other merchants and Shopify to provide enhanced services, such as personalisation, performance improvements and advertising. Shopify processes that information for those enhanced services as described in its Consumer Privacy Policy and is responsible for that processing, including applicable privacy-rights requests. You can also use Shopify's Privacy Portal. No other merchant can view our customer data through Shopify Network Intelligence.
We may also share personal data with the following recipients where necessary for the purposes described in this Policy:
Group companies and brands: other entities under common ownership or control with Hadrill Hair Ltd, where necessary for internal administration and to provide our Services.
Service providers: third‑party vendors who perform services on our behalf, such as payment processors, fraud‑prevention providers, IT and hosting providers, logistics and delivery companies, marketing and advertising partners, analytics providers, and customer support tools.
Professional advisers: lawyers, auditors, accountants and insurers who provide professional services to us.
Authorities and regulators: law enforcement, regulators, courts and government bodies where we are required or permitted by law to disclose your data, or to protect our rights or the rights of others.
Business transferees: third parties in connection with any actual or potential merger, acquisition, sale of assets, restructuring or similar transaction involving our business, in which case personal data may be transferred as part of the transaction, subject to appropriate safeguards.
8. International Transfers
We are based in the United Kingdom. Your personal data may be processed in the UK, Australia, the United States and other countries where our authorised staff and service providers are located.
If you are located in the EU or UK, this means your personal data may be transferred to countries outside the European Economic Area (EEA) and the UK that may not provide the same level of data protection as your home jurisdiction.
Where we transfer personal data from the EEA or UK to a country that has not been deemed to provide an adequate level of protection, we will implement appropriate safeguards, such as entering into standard contractual clauses approved by the European Commission or UK authorities, or relying on another lawful transfer mechanism, unless an exemption applies.
You can contact us for more information about international transfers and the safeguards we use.
9. Data Retention
We keep your personal data only for as long as necessary to fulfil the purposes for which we collected it, including to meet legal, accounting or reporting requirements.
In determining retention periods, we consider the amount, nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes of processing, and whether we can achieve those purposes through other means, as well as applicable legal requirements.
For example, we typically retain:
order and transaction records for the period required by tax and consumer laws;
account data for as long as your account is active and for a reasonable period thereafter;
marketing data until you opt out or your consent is withdrawn, plus a short period to record your preference.
10. Security of Your Personal Data
We take appropriate technical and organisational measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.
Measures may include encryption, access controls, secure hosting environments, and regular monitoring of our systems. However, no method of transmission or storage is completely secure and we cannot guarantee absolute security.
You are responsible for keeping your account credentials confidential and for notifying us promptly if you suspect any unauthorised access to your account.
11. Your Rights (EU and UK)
If you are in the EU or UK, you have certain rights in relation to your personal data under the GDPR/UK GDPR, subject to conditions and limitations.
Right of access: to obtain confirmation whether we process your personal data and to request a copy.
Right to rectification: to request correction of inaccurate or incomplete data.
Right to erasure: to request deletion of your data in certain circumstances.
Right to restriction: to request restriction of processing in certain circumstances.
Right to data portability: to receive your data in a structured, commonly used and machine‑readable format and to transmit it to another controller, where technically feasible.
Right to object: to object to processing based on legitimate interests, including profiling, and to direct marketing at any time.
Rights in relation to automated decision‑making: where we carry out automated decisions that have legal or similarly significant effects, you may have rights to human intervention and to contest the decision.
You also have the right to lodge a complaint with your local supervisory authority if you are concerned about how we process your personal data.
You can also complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint/.
12. Your Rights and Choices (US and Other Regions)
Depending on where you live in the US and other jurisdictions, you may have additional privacy rights under applicable state or local laws, which may include rights to know, access, correct, delete or opt out of certain processing of your personal information.
Where such laws apply to us, you can exercise your rights by contacting us using the details in section 14 or via any dedicated "privacy choices" tools or links we provide on the Site.
You may also have the right to designate an authorised agent to make certain requests on your behalf under some US state laws.
13. Marketing Communications and Preferences
You can choose whether to receive marketing communications from us. We may send you marketing messages by email, SMS, or other channels, where permitted by law and in accordance with your preferences.
You can opt out of marketing at any time by:
clicking the "unsubscribe" link in an email;
following the instructions in an SMS or other message; or
contacting us using the details in section 14.
Even if you opt out of marketing, we may still send you non‑marketing messages, such as service and transactional emails about your orders.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time, for example to reflect changes in our practices, technologies, legal requirements or for other operational reasons.
When we make changes, we will update the "Last updated" date at the top of this page and, where appropriate, provide additional notice (such as by email or a notice on the Site). We encourage you to review this Policy periodically to stay informed about how we handle your personal data.
14. How to Contact Us
If you have any questions about this Privacy Policy, our use of your personal data, or if you wish to exercise your rights, please contact us:
71–75 Shelton Street, Covent Garden
London, United Kingdom, WC2H 9JQ
