Privacy Policy

1. Who we are

Eastern Essence Co. ("we", "us", "our") is the data controller for personal information collected through this website and at our premises at 16 Carlton Terrace, London, E7 8LH, United Kingdom. We process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information we collect

We collect the following categories of personal data:

• Identity and contact data: name, email address, phone number, delivery and billing address.
• Account data: your login email and a securely hashed password. We never store passwords in plain text and cannot retrieve your password for you.
• Order data: items purchased, order value, fulfilment method (delivery or in-store collection), and collection or tracking references.
• Review data: any product review you submit, linked to your verified purchase.
• Wishlist data: products you save to your wishlist while signed in.
• Loyalty points data: your current points balance, and the points earned or redeemed on each order.
• Return data: if you request a return, the reason you select, any note you add, and our admin's decision and notes on it.
• Two-factor authentication data: if you choose to enable it, a secret key used only to verify the six-digit codes from your authenticator app. We do not have access to your authenticator app itself.
• Technical data: IP address, browser type, and session identifiers, collected automatically via essential cookies.
• Marketing data: your email address, if you sign up to our newsletter, and whether you've unsubscribed. This is separate from any account you may also hold, and does not require one.

We do not collect or store your payment card details. All payments are processed directly by Stripe, Inc., a PCI-DSS compliant payment processor, under its own privacy policy.

3. How we use your information

We process your personal data to:

• Create and manage your account;
• Process, fulfil, and deliver or prepare your order for collection;
• Send order confirmations, dispatch notifications, collection codes, and tracking information;
• Verify your identity when collecting an order in store;
• Confirm your eligibility to leave a product review;
• Review and resolve return requests;
• Track and apply your loyalty points balance;
• Send newsletter emails, if you've signed up, including an unsubscribe link in every one;
• Secure your account, including optional two-factor authentication;
• Respond to customer service enquiries; and
• Comply with our legal and tax obligations.

We rely on the legal bases of contract (to fulfil your order), legal obligation (for tax and accounting records), legitimate interest (for fraud prevention and essential site functionality), and consent (for newsletter emails, which you can withdraw at any time using the unsubscribe link in any newsletter email).

4. Sharing your information

We share personal data only where necessary: with Stripe to process payments, with delivery couriers to fulfil shipped orders, and with Resend to send transactional emails. Our store location page also embeds a Google Maps view, which may set its own cookies and process technical data under Google's privacy policy once it loads, independently of us. We do not sell, rent, or trade your personal data to third parties for marketing purposes.

Some of these providers (including Stripe and Resend) may process data on servers outside the UK. Where they do, they provide appropriate safeguards, such as the UK's International Data Transfer Addendum or an adequacy decision, as required under UK GDPR.

5. Data retention

We retain account and order data for as long as your account is active and for a further period afterwards as required for tax, accounting, and legal purposes (typically up to six years from the end of the relevant tax year). You may request earlier deletion of data not subject to a legal retention requirement.

6. Cookies

We use strictly necessary cookies to maintain your session, shopping cart, and sign-in state. These cookies cannot be disabled without affecting core site functionality, which is why we don't ask for consent to them (UK law doesn't require it for strictly necessary cookies) but do still let you know about them via the notice shown on your first visit. We do not currently use third-party advertising or analytics cookies. If that changes, we'll update this policy and ask for your consent first.

7. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate data;
• Request erasure of your data, subject to our legal retention obligations;
• Object to or restrict certain processing; and
• Request a copy of your data in a portable format.

To exercise any of these rights, contact us through our contact page. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Data security

We use industry-standard measures to protect your personal data, including salted password hashing (your password itself is never stored and can't be recovered, only reset), rate-limited sign-in and account actions to resist automated attacks, access controls restricting order and account data to authorised staff, and encrypted connections (HTTPS) across the site.

9. Contact

For any privacy-related questions or to exercise your data protection rights, contact us through our contact page or write to us at 16 Carlton Terrace, London E7 8LH.