Privacy policy

Belleza — Privacy Policy

Last updated: Oct 8, 2026

1. Who we are

Belleza is a trading name of Agustus Limited, a company registered in England and Wales under company number 17069635, whose registered office is at 54 Sutcliffe Street, Bolton BL1 8EU.

Agustus Limited is the data controller for the personal data described in this policy. That means we decide how and why your personal data is used, and we are responsible for looking after it.

How to contact us about your data:

• Email: Belleza.fromwithin@gmail.com

• Post: Data Protection, Agustus Limited, 54 Sutcliffe Street, Bolton BL1 8EU

We are a small business and are not required to appoint a Data Protection Officer. Privacy questions are handled by the company's director, who you can reach at the email address above.

2. What this policy covers

This policy explains what personal data we collect when you visit our website, buy from us, sign up to our emails or contact us; why we use it; who we share it with; how long we keep it; and what rights you have over it.

It is written to meet our obligations under:

• the UK General Data Protection Regulation (UK GDPR);

• the Data Protection Act 2018; and

• the Privacy and Electronic Communications Regulations 2003 (PECR), which govern marketing emails and cookies.

We sell to customers in the United Kingdom only, and this policy is written for UK law.

3. The personal data we collect

What we collect	Examples	Where it comes from
Identity and contact details	Name, delivery address, billing address, email address, phone number	You, when you order, create an account, sign up to emails or contact us
Order details	What you bought, order number, order date, order history, delivery status	You and our carrier
Payment details	Card type, last four digits, payment confirmation, billing address	Our payment provider. We never see or store your full card number
Account details	Username, password (stored encrypted), saved addresses, preferences	You
Marketing preferences	Whether you consented to emails, when, and whether you later unsubscribed	You
Messages you send us	The content of emails, contact form messages and social media messages	You
Reviews and content	Reviews, photographs or comments you submit	You
Technical data	IP address, browser type, device type, operating system, time zone	Automatically, from your device
Usage data	Pages viewed, items viewed or added to cart, how you arrived at our site	Automatically, through cookies and similar technologies

We do not knowingly collect any other categories of personal data. We do not buy personal data from third parties or data brokers.

4. Why we use your data, and our lawful basis

Under the UK GDPR we must have a lawful basis for everything we do with your personal data. This table sets out each purpose and the basis we rely on.

Why we use your data	Data used	Our lawful basis (UK GDPR Article 6)
To take and fulfil your order, arrange delivery, and handle returns and refunds	Identity, contact, order, payment	Performance of a contract — Article 6(1)(b)
To create and run your account	Account, identity, contact	Performance of a contract — Article 6(1)(b)
To answer your questions and provide customer service	Contact, order, messages	Performance of a contract, or legitimate interests in responding to enquiries — Article 6(1)(b) or 6(1)(f)
To send you marketing emails	Contact, marketing preferences	Consent — Article 6(1)(a), and regulation 22 of PECR
To run non-essential cookies and understand how our website is used	Technical, usage	Consent — Article 6(1)(a), and regulation 6 of PECR
To run essential cookies that make the site and basket work	Technical	Legitimate interests in providing a working website — Article 6(1)(f)
To prevent and investigate fraud and misuse of our website	Identity, payment, technical, order	Legitimate interests in protecting our business and our customers — Article 6(1)(f)
To publish a review you submitted	Reviews, first name	Consent — Article 6(1)(a)
To keep accounting, tax and company records	Identity, order, payment	Legal obligation — Article 6(1)(c)
To keep food safety and traceability records, and to handle a product safety issue or recall	Identity, contact, order	Legal obligation — Article 6(1)(c)
To establish, exercise or defend a legal claim	Whatever is relevant to the claim	Legitimate interests in protecting our legal position — Article 6(1)(f)

Where we rely on legitimate interests

Where the table says legitimate interests, we have considered whether our interest is outweighed by your rights, and we believe our use is reasonable and would not surprise you. You can object to any processing based on legitimate interests — see section 11 — and we will stop unless we have compelling grounds to continue.

If we ever want to use your data for a purpose not listed here, we will tell you first and, where the law requires it, ask your consent.

5. Health information

We do not ask you for health information and you should not send us any unless you choose to.

There is one situation where we may hold it. If you tell us you have had an adverse reaction to our product, what you tell us about your symptoms or health is special category data under Article 9 of the UK GDPR, which has extra protection.

Where that happens:

• we use it only to look into what happened, to meet our obligations as a food business, and to keep the record that food law requires us to keep;

• our lawful basis under Article 6 is legal obligation — Article 6(1)(c);

• our condition under Article 9 is public health — Article 9(2)(i), read with Schedule 1 of the Data Protection Act 2018;

• we may have to pass the report to the Food Standards Agency, our local authority or our manufacturer. Where we can report it without naming you, we will; and

• we keep it separately from your ordinary customer record, and only the director has access to it.

You are never required to give us health information. If you would rather not, you can report a problem with the product without describing your symptoms.

6. Marketing

We only send marketing emails to people who have asked for them.

When you sign up, we ask you to tick a box to confirm you want to hear from us. We record that you consented and when. We do not add you to our mailing list because you placed an order, and we do not pass your details to anyone else for their marketing.

Our emails cover new products, restocks, occasional offers and brand news.

You can unsubscribe at any time using the link at the bottom of every email, or by emailing us. There is no charge and we will not ask you why.

When you unsubscribe, we keep a note of your email address on a suppression list. This is so we do not email you again by mistake. We do not use that list for anything else.

Unsubscribing from marketing does not stop emails we have to send about an order you have placed, such as a dispatch confirmation or a safety notice.

7. Cookies

Cookies are small files placed on your device when you visit a website.

Type	What it does	Do we need your consent?
Essential	Keeps you logged in, remembers what is in your basket, lets checkout work, keeps the site secure	No — the site cannot work without these
Analytics	Tells us how many people visit, which pages they view, and where they came from	Yes
Marketing	Lets us and our advertising partners show you adverts and measure whether they worked	Yes

When you first visit, we ask whether you accept non-essential cookies. Analytics and marketing cookies are not set unless you accept them. You can change your mind at any time through the cookie settings link in our website footer.

You can also block or delete cookies in your browser settings, though some parts of our website may then not work properly.

Our website does not respond to "Do Not Track" browser signals, because there is no agreed standard for how to do so.

8. Who we share your data with

We share your personal data only where we need to. The organisations we use are:

• Shopify, which hosts our online shop and processes orders on our behalf;

• payment providers, which take and process your payment. They handle your card details directly — we never receive them;

• delivery carriers, which need your name, address and phone number or email to deliver your order;

• our email provider, which sends our marketing and order emails;

• analytics providers, where you have accepted analytics cookies;

• our manufacturer, but only where there is a product safety issue or recall, and only what is necessary;

• professional advisers, such as our accountant, where they need it to advise us; and

• regulators and authorities, such as HMRC, the Food Standards Agency, our local authority, the Information Commissioner's Office, the police or a court, where we are legally required to provide it.

Everyone acting on our behalf is bound by a contract requiring them to keep your data secure, use it only on our instructions, and not use it for their own purposes.

We do not sell your personal data, and we never will. We do not share it with anyone for their own marketing.

If our business were ever sold or transferred, your data would transfer with it, and we would tell you beforehand.

9. Sending data outside the UK

Some of the providers we use are based outside the United Kingdom, or store data outside it — Shopify and our email and analytics providers in particular.

Whenever your data leaves the UK, we make sure one of the following protections applies:

• the country has been formally recognised by the UK government as providing an adequate level of protection; or

• our contract with the provider includes the International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses, approved by the Information Commissioner.

You can ask us which protection applies to a particular provider by emailing Belleza.fromwithin@gmail.com.

10. How long we keep your data

We keep your data only as long as we need it.

Record	How long we keep it	Why
Order, invoice and payment records	6 years after the end of the financial year the order falls in	Required for tax and company records
Food safety and traceability records	10 years from the date of sale	Covers the liability period under the Consumer Protection Act 1987
Adverse reaction reports	10 years from the date reported	Product safety and the same liability period
Your account	While active, then 2 years after your last sign-in	So your order history and addresses are there when you return
Customer service emails and messages	2 years from the last message	Long enough to deal with a follow-up query
Marketing consent records	For as long as you are subscribed, plus 2 years	So we can show we had your consent if asked
Unsubscribe suppression list	Indefinitely	The only way to be sure we never email you again
Reviews you submitted	Until you ask us to remove them	They remain useful to other customers
Analytics and usage data	Up to 26 months	Long enough to compare one year with the next

When a retention period ends, we delete the data or anonymise it so it can no longer identify you.

If you ask us to delete your data, we will — but we may have to keep the order, tax and food safety records above until their periods expire, because the law requires it. We will tell you if that applies to you, and we will not use those records for anything else.

11. Your rights

The UK GDPR gives you the following rights over your personal data. They are free to use.

The right to be informed. To know what we do with your data. That is what this policy is for.

The right of access. To get a copy of the personal data we hold about you, and to be told how we use it. This is often called a subject access request.

The right to rectification. To have inaccurate data corrected, and incomplete data completed.

The right to erasure. To ask us to delete your data. Also called the right to be forgotten. It is not absolute — see the note in section 10 about records we are legally required to keep.

The right to restrict processing. To ask us to pause using your data, for example while we check whether it is accurate.

The right to data portability. To receive the data you gave us in a common, machine-readable format, or to have us send it to another organisation, where this is technically feasible.

The right to object. To object to processing based on our legitimate interests. You can also object to direct marketing at any time, and that objection is absolute — we must stop.

The right to withdraw consent. Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not make our earlier use of the data unlawful.

Rights relating to automated decision-making. See section 15.

How to exercise your rights

Email Belleza.fromwithin@gmail.com, or write to us at the address in section 1. Please tell us which right you want to use.

We will respond within one month. If your request is complex or you have made several, we may extend this by up to two further months, and we will tell you within the first month if we need to.

We may need to confirm your identity before we act, to make sure we are not giving your data to someone else. We will only ask for what we need to do that.

You can also ask someone else, such as a solicitor or a relative, to make a request for you. We will need to see evidence that you have authorised them.

12. How to complain

If you are unhappy with how we have handled your personal data, please tell us first at Belleza.fromwithin@gmail.com. We would rather hear about it and put it right.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at any time. You do not have to come to us first.

• Website: ico.org.uk/make-a-complaint

• Helpline: 0303 123 1113

• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

13. Children

Our products and website are intended for adults, and you must be 18 or over to place an order.

We do not knowingly collect personal data about anyone under 18, and we do not market to children.

If you believe a child has given us their personal data, please email Belleza.fromwithin@gmail.com and we will delete it.

14. Keeping your data secure

We take reasonable steps to protect your data. Our website runs over an encrypted connection, payment details are handled directly by our payment provider and never reach us, passwords are stored encrypted, and access to customer data is limited to those who need it.

No system is completely secure, and we cannot guarantee the security of data while it travels across the internet. Please do not send us sensitive information by email unless you have to.

If a data breach occurred that was likely to result in a risk to your rights and freedoms, we would report it to the Information Commissioner's Office within 72 hours of becoming aware of it, as the law requires. Where the risk to you was high, we would also tell you directly and without undue delay.

15. Automated decision-making

We do not make any decision about you by automated means alone that has a legal effect on you or otherwise significantly affects you.

Our payment provider may run automated fraud checks on a transaction, which can result in a payment being declined. If that happens and you believe it is wrong, email us and we will look into it ourselves.

Where you have accepted marketing cookies, our advertising partners may show you adverts based on pages you have viewed. You can stop this by withdrawing your cookie consent — see section 7.

16. Giving us your data, and changes to this policy

Do you have to give us your data?

You do not have to give us anything to browse our website.

If you want to buy from us, we need your name, delivery address, email address and payment details. Without them we cannot form a contract with you or deliver your order. Your phone number is optional, and we ask for it only so a carrier can contact you about a delivery.

Marketing emails, an account and reviews are all entirely optional, and declining them makes no difference to your order.

Changes to this policy

We may update this policy, for example if we start using a new provider or if the law changes. The current version is always on this page, and the date at the top tells you when it last changed.

If we make a change that materially affects how we use your data, we will tell you by email where we hold your email address.

Search our store