Privacy policy

Last updated: 19 August 2026

This policy explains how Curldrop Ltd ("Curldrop", "we", "us") collects, uses and protects your personal information when you visit curldrop.co.uk, buy from us, or interact with us. It also explains your rights and how to exercise them.

We're a UK business and we sell only in the United Kingdom. We handle your information in line with UK data protection law: the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

1. Who we are

Curldrop Ltd (company number 15993456) is the "data controller" responsible for your personal information. We're registered in England and Wales at Unit 1025, 90 Sanvey Gate, Leicester LE1 4BQ.

If you have any questions about this policy or your information, email us at policies@curldrop.co.uk or write to us at the address above.

2. The information we collect

Information you give us:

  • Your name and contact details (email address and delivery/billing address).
  • Account login details (such as your username and password).
  • Order details (what you bought, order value, and delivery information).
  • Your hair profile - the information you share through our Curl Concern Quiz or your account, such as curl type, porosity and the concerns you're shopping for.
  • Marketing preferences.
  • Messages you send us (customer service enquiries, reviews, survey or competition entries).
  • Referral and rewards information if you take part in our loyalty or referral programme, including your birthday if you choose to give it to us for a birthday treat.

Payment information: card payments are handled by our payment provider. We don't see or store your full card details.

Information we collect automatically when you use our site:

  • Device and connection information, including your IP address, browser type and operating system.
  • How you reach and move through our site, including the full URL clickstream to, through and from our site, the pages you view, and page interactions such as scrolling, clicks and mouse-overs.
  • Information collected through cookies and similar technologies (see section 6).

Information we receive from third parties:

  • Our platform and service providers (for example Shopify), our payment provider, our delivery partners, and our analytics and advertising partners, who share information that helps us fulfil orders, measure our marketing and keep the site secure.

3. How and why we use your information

We only use your information where the law allows. The table below sets out what we do and our lawful basis for it.

What we do Lawful basis
Process and deliver your orders, and manage returns and refunds Performance of our contract with you
Create and manage your account Performance of our contract with you
Send you marketing emails about products, offers and curl tips Your consent
Recommend products and personalise your experience (including quiz results) Your consent, or our legitimate interest in helping you find suitable products
Measure our advertising and show you relevant ads on other platforms Your consent (for advertising cookies and audience matching)
Understand and improve our site and services Our legitimate interest in improving what we offer (and your consent where the cookies used aren't essential)
Run our loyalty/referral programme and send birthday treats Performance of our contract with you, your consent, or our legitimate interest in rewarding customers
Prevent fraud and keep our site and your account secure Our legitimate interest in protecting our business and customers, and our legal obligations
Keep accounting and tax records and meet other legal duties Compliance with our legal obligations

Where we rely on legitimate interests, we do so only in a way that doesn't unduly affect your privacy, and you can object at any time (see section 12).

4. Profiling and personalisation

We use some of your information to personalise your experience - for example, using your Curl Concern Quiz answers to recommend suitable products, and using advertising cookies to show you more relevant ads on other websites and apps. Showing you ads based on your browsing is a form of "profiling" under UK GDPR. We rely on your consent for advertising and audience matching, and on our legitimate interests for on-site recommendations. We don't make any decisions about you by purely automated means that produce legal or similarly significant effects, and we don't use your hair profile to infer anything about your health or background - it simply reflects the preferences you tell us. You can ask us to stop this personalisation at any time by emailing policies@curldrop.co.uk.

5. Marketing and your choices

With your consent, we send curl tips, product news and offers by email. Every marketing email includes an unsubscribe link, and you can opt out at any time - including opting out of having your details used to match advertising audiences (see section 8) - by clicking unsubscribe or emailing policies@curldrop.co.uk. Opting out of marketing won't stop service messages about orders you've placed (for example order confirmations and delivery updates).

6. Cookies and similar technologies

We use three categories of cookie and similar technology:

  • Strictly necessary - needed to run the site, your basket and checkout. These don't require your consent.
  • Analytics - help us understand and improve the site, including Microsoft Clarity, which records how pages are used (such as clicks and scrolling) with sensitive input masked. You can object to these at any time using the Manage cookie preferences link in our footer.
  • Advertising - used to measure our campaigns and show you relevant ads. These are only set if you accept them.

When you first visit, you can accept or reject non-essential cookies, and you can change your choice at any time via the Manage cookie preferences link in our footer. Rejecting non-essential cookies is as easy as accepting them, and blocking some cookies may affect how the site works.

7. Who we share your information with

We share your information only with organisations that help us run Curldrop, and only as far as they need it. These include:

  • Shopify, which powers our online store.
  • Our payment provider, which processes your payment securely.
  • Our delivery partners, who deliver your orders.
  • Klaviyo, which sends our marketing and service emails on our behalf.
  • Our analytics and advertising partners (see section 8).
  • Reviews, loyalty and referral providers that run those features for us.
  • Professional advisers (such as accountants and lawyers) where needed.
  • Authorities or other organisations where we're required to by law, or to prevent fraud and protect our business and customers.
  • A buyer or successor if we sell or reorganise our business, in which case your information may be transferred as part of that deal.

We never sell your personal information.

8. Advertising and analytics partners

We work with the following partners to measure our marketing, understand how our site is used, and show you relevant ads on other platforms. Each sets its own cookies or receives data only where you have consented, and each has its own privacy policy:

  • Google (Google Ads, Google Analytics and Google Shopping) - measurement and advertising.
  • Meta (Facebook and Instagram) - measurement and advertising.
  • TikTok (including TikTok Shop) - measurement and advertising.
  • Microsoft Clarity - analytics and session-replay, as described in section 6.

Where we run ads, we may share a hashed (pseudonymised) version of your email address with Google, Meta, TikTok so that our ads reach - or deliberately exclude - relevant audiences ("custom audiences"). We only do this where you've consented to marketing, and matching does not give these partners the content of your account, order or payment details. You can opt out at any time by unsubscribing from marketing or emailing policies@curldrop.co.uk.

9. Where we store and process your information - international transfers

Some of our providers are based outside the UK. Whenever we transfer your personal information outside the UK, we make sure it's protected by an appropriate safeguard, such as:

  • the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; or
  • for certified providers in the United States, the UK Extension to the EU-US Data Privacy Framework.

You can ask us for details of the safeguard used for a particular transfer by emailing policies@curldrop.co.uk.

10. How long we keep your information

We keep your information only for as long as we need it:

  • Order and transaction records: at least 6 years after the end of the relevant tax year, to meet HMRC and accounting requirements.
  • Account and hair-profile information: for as long as your account is active; if you close your account or stay inactive for 24 months, we delete or anonymise it.
  • Marketing information: until you unsubscribe or withdraw consent, after which we keep a minimal record of your opt-out so we don't contact you again.
  • Customer service messages: for 2 years after your enquiry is resolved, or longer if needed to handle a dispute.

When we no longer need your information, we securely delete or anonymise it.

11. Security

We protect transactional information with strong encryption, and we use appropriate technical and organisational measures to keep your information safe. No transmission over the internet is ever completely secure, so any transmission is at your own risk - please keep your account password confidential and let us know straight away if you think your account has been misused. If a data breach affects your rights, we'll notify the ICO and, where required, you, in line with our legal obligations.

12. Your rights

Under UK data protection law you have the right to:

  • access the personal information we hold about you;
  • ask us to correct information that's wrong or incomplete;
  • ask us to delete your information ("right to erasure");
  • restrict or object to how we use your information, including for direct marketing and profiling;
  • receive certain information in a portable, machine-readable format; and
  • withdraw consent at any time, where we rely on it.

To exercise any of these, email policies@curldrop.co.uk. We'll respond within one month. Exercising your rights is free, and we won't treat you any differently for doing so.

13. Children

Our site isn't intended for children. We don't knowingly collect information from anyone under 13 (the age at which a child can consent to online services in the UK), and the site isn't aimed at under-18s. If you believe a child has given us their information, please contact us and we'll delete it.

14. Other websites and social media

Our site links to other websites, such as brand pages and our social media channels. Those sites have their own privacy policies, and we're not responsible for them. Anything you post on our social channels (for example Instagram and TikTok) is governed by that platform's privacy policy, not ours.

15. Changes to this policy

We may update this policy from time to time. When we do, we'll change the "last updated" date at the top and, if the changes are significant, we'll let you know. We review this policy at least every 6 months.

16. Contact us

Questions, requests or complaints about your information: Curldrop Ltd, Unit 1025, 90 Sanvey Gate, Leicester LE1 4BQ Email: policies@curldrop.co.uk