Privacy Policy

HARRISON JAMES LTD (company number 14883325, registered office 31 Tudor Way, Brackley, England, NN13 6NH) is the data controller for personal information collected through https://www.harrisonsbeauty.com. We trade as Harrison's Beauty.

We're a small company and we haven't appointed a Data Protection Officer. UK GDPR only requires one of public authorities and organisations whose core activity is large-scale monitoring or large-scale processing of special category data, and we're none of those. Privacy questions and rights requests go to privacy@harrisonsbeauty.com, which is read by a person, not a queue.

Buying through our TikTok Shop is a separate matter. TikTok is its own controller for what happens inside that platform and its privacy policy governs it. We receive the order and delivery details it passes to us, and this policy covers what we do with those from that point on.

Each thing we do with your data sits on one of these bases under UK GDPR Article 6.

We don't do automated decision-making or profiling, and we've never sold or rented personal data to anyone.

A short list, because we run a short operation. Each of these processes data on our instructions under a written agreement.

We'll also disclose data where the law requires it, or to establish or defend a legal claim.

We use one strictly necessary browser storage entry to remember your cookie choice, so the banner stops asking. PECR lets us set that without consent, because without it we couldn't honour your answer.

Everything else is analytics, and analytics only loads after you press Accept. Nothing is set before you choose, and rejecting leaves the site fully usable.

• • Order and sales records: six years after the end of the financial year they fall in, which is what HMRC requires of company records.
• • Customer correspondence: two years after the thread goes quiet, unless it relates to a complaint or a claim.
• • Analytics data: 14 months, the Google Analytics 4 retention setting we use.
• • Your cookie choice: stored in your own browser until you clear it or use the control above.

What we actually do, rather than what sounds reassuring. The site is served over HTTPS. Accounts that hold customer data use multi-factor authentication. Access is limited to the people who need it, which at our size is a very short list. We don't run our own payment infrastructure, so card data never reaches us.

We don't commission penetration tests or formal security audits, and we're not going to claim we do. If that changes, this paragraph changes with it.

If a breach happens that risks your rights and freedoms, we'll report it to the ICO within 72 hours and tell you where the risk to you is high.

Some of the services above process data outside the UK. Where they do, the transfer relies on UK adequacy regulations for that country, or on the UK's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment behind it.

Ask us at privacy@harrisonsbeauty.com and we'll tell you which mechanism covers a given service.

Email privacy@harrisonsbeauty.com and we'll respond within one month. It's free. If a request is genuinely excessive or repetitive we can charge a reasonable fee or refuse, and we'll explain why if we ever do. We may ask you to confirm who you are before we hand anything over.

Tell us first if you'd like to, but you don't have to. You have the right to complain directly to the Information Commissioner's Office, the UK's data protection regulator.

We'll update this page when what we do changes, and move the date at the top when we do. For anything material we'll say so on the site, and email you if we hold your address and the change affects you.