Privacy Policy

Last updated: April 2026

1. Who We Are

Queen of Good Hair Limited ("we", "us", "our") is a company registered in England and Wales (Company Number: 13304183). Our registered address is 9 Dower House Gardens, Quorn, Loughborough, England, LE12 8DE.

We operate the website queenofgoodhair.com and supply premium, ethically sourced virgin hair extensions and hair toppers to customers across the UK and internationally.

We are the data controller of the personal information collected through this website. If you have any questions about how we use your personal data, please contact us at:

📧 [email protected]

2. What Personal Data We Collect

We collect personal data when you interact with us. This may include:

Information you provide directly

• Name, email address, phone number and delivery/billing address when you place an order or create an account
• Payment information (processed securely by our payment provider — we do not store card details)
• Your communications with us via email, social media or contact forms
• Your preferences and interests if you complete a quiz, survey or sign up to our newsletter via Klaviyo

Information collected automatically

• IP address, browser type and device information
• Pages you visit, how long you spend on them, and how you arrived at our site
• Cookie data and tracking pixels (see Section 7)
• Information about your purchase history and browsing behaviour on our website

3. How We Use Your Personal Data

We use your personal data on the following legal bases under UK GDPR:

Performance of a contract

• Processing and fulfilling your orders
• Sending order confirmations, shipping updates and delivery notifications
• Handling returns, refunds and customer service enquiries

Legitimate interests

• Preventing fraud and ensuring the security of our website
• Analysing how our website is used so we can improve it
• Sending you relevant product recommendations based on your purchase history (you can opt out at any time)
• Running our salon partner and affiliate programme

Consent

• Sending you marketing emails and SMS messages via Klaviyo (only where you have opted in)
• Placing non-essential cookies and tracking technologies on your device
• Sharing data with advertising platforms such as Meta (Facebook/Instagram) and Google for targeted advertising

Legal obligation

• Keeping financial and tax records as required by HMRC
• Complying with any legal requests from regulatory authorities

4. Who We Share Your Data With

We only share your personal data with third parties where necessary to provide our services or where you have given consent. These include:

Third Party	Purpose	Location
Shopify	Our e-commerce platform — stores your order and account data	USA (Standard Contractual Clauses)
Klaviyo	Email and SMS marketing	USA (Standard Contractual Clauses)
Stripe / PayPal	Secure payment processing	USA/EU (Standard Contractual Clauses)
Royal Mail / Courier partners	Order delivery	UK
Google Analytics	Website analytics	USA (Standard Contractual Clauses)
Meta (Facebook/Instagram)	Advertising and retargeting (with your consent)	USA (Standard Contractual Clauses)
Trustpilot	Customer review invitations	Denmark/EU
Judge.me	Product review collection	USA (Standard Contractual Clauses)

We do not sell your personal data to third parties. Where data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR (typically Standard Contractual Clauses or adequacy decisions).

5. Your Rights Under UK GDPR

As a UK resident, you have the following rights in relation to your personal data:

• Right to access — You can request a copy of the personal data we hold about you
• Right to rectification — You can ask us to correct any inaccurate or incomplete data
• Right to erasure — You can ask us to delete your personal data in certain circumstances ("the right to be forgotten")
• Right to restrict processing — You can ask us to stop processing your data in certain circumstances
• Right to data portability — You can request your data in a structured, machine-readable format
• Right to object — You can object to us processing your data for direct marketing or profiling at any time
• Rights related to automated decision-making — We do not make solely automated decisions that significantly affect you
• Right to withdraw consent — Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before processing your request.

6. Marketing Communications

We will only send you marketing emails or SMS messages if you have opted in to receive them. You can unsubscribe at any time by:

• Clicking the "unsubscribe" link at the bottom of any marketing email
• Replying STOP to any SMS message
• Contacting us directly at [email protected]

We use Klaviyo to manage our email and SMS marketing. Your data is processed in accordance with Klaviyo's privacy policy and UK GDPR Standard Contractual Clauses.

7. Cookies and Tracking Technologies

We use cookies and similar technologies on our website in accordance with the Privacy and Electronic Communications Regulations (PECR).

Types of cookies we use

• Strictly necessary cookies — Required for the website to function (e.g. shopping basket, login session). These do not require your consent.
• Analytics cookies — Help us understand how visitors use our site (e.g. Google Analytics). Only placed with your consent.
• Marketing/advertising cookies — Used to show you relevant ads on other platforms (e.g. Meta Pixel, Google Ads). Only placed with your consent.
• Functional cookies — Remember your preferences to improve your experience. Only placed with your consent.

You can manage or withdraw your cookie consent at any time via the cookie settings banner on our website, or by adjusting your browser settings. Please note that disabling certain cookies may affect the functionality of our website.

8. How Long We Keep Your Data

• Order data — Retained for 7 years to comply with HMRC requirements
• Account data — Retained while your account is active; deleted within 30 days of an account deletion request
• Marketing data — Retained until you unsubscribe or withdraw consent
• Website analytics — Retained for up to 26 months
• Customer service correspondence — Retained for 3 years

9. Data Security

We take data security seriously. We use industry-standard security measures including:

• SSL/TLS encryption across our website (HTTPS)
• Secure payment processing via PCI-DSS compliant providers (we never store your card details)
• Access controls limiting who within our business can access personal data
• Regular security reviews

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and will contact affected individuals without undue delay.

10. Children's Privacy

Our website and products are not intended for children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Links to Other Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies before providing any personal data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. Where changes are significant, we will notify you by email or a prominent notice on our website.

13. How to Complain

If you are unhappy with how we have handled your personal data, please contact us first at [email protected] and we will do our best to resolve your concern.

If you remain unsatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

• 🌐 ico.org.uk
• 📞 0303 123 1113
• 📮 Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF