Privacy policy

Last Updated: September 2026

Mila Rose of London Limited (Company Number: 13886560) ("we", "us", or "our") is committed to protecting and respecting your privacy.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit **www.milaroselondon.com** (the "Website") and place orders with us.

For the purposes of UK Data Protection Legislation (including the UK GDPR and the Data Protection Act 2018), **Mila Rose of London Limited** is the **Data Controller** responsible for your personal data.

1. Information We Collect

We collect and process the following categories of personal data:

* **Identity Data:** First name, last name, title, and date of birth (where applicable).
* **Contact Data:** Billing address, delivery address, email address, and telephone numbers.
* **Financial Data:** Payment card details and payment transaction history (processed securely via our third-party payment gateways; we do not store full credit card numbers on our servers).
* **Transaction Data:** Details of products purchased, order history, and payments made to us.
* **Technical Data:** IP address, browser type and version, time zone setting, browser plug-ins, operating system, and device identifiers.
* **Usage Data:** Information about how you navigate and interact with our Website.
* **Marketing & Communications Data:** Your preferences regarding receiving marketing updates from us and third parties.

---

2. How We Use Your Personal Data and Our Legal Basis
Under UK GDPR, we must have a valid legal basis to process your personal data. We use your data for the following purposes:

| Purpose / Activity | Type of Data | Lawful Basis for Processing |
| :--- | :--- | :--- |
| **To register you as a new customer** | Identity, Contact | Performance of a Contract with you |
| **To process & deliver your order** (including managing payments, fees, and postage) | Identity, Contact, Financial, Transaction | **1.** Performance of a Contract with you<br>**2.** Legitimate Interests (to recover debts due to us) |
| **To manage our relationship** (notifying you about changes to terms or policy) | Identity, Contact, Marketing | **1.** Performance of a Contract with you<br>**2.** Necessary to comply with a Legal Obligation |
| **To send you marketing emails or discounts** | Identity, Contact, Marketing | **Consent** (or Legitimate Interests for existing customers under 'Soft Opt-In' rules) |
| **To administer & protect our business/site** (troubleshooting, data analysis, fraud prevention) | Technical, Usage | **1.** Legitimate Interests (running our business, IT security)<br>**2.** Necessary to comply with a Legal Obligation |
| **To deliver relevant content & ads to you** | Identity, Contact, Usage, Technical | Legitimate Interests (to study how customers use products and grow our business) |

3. Data Retention

We will retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying legal, accounting, tax, or reporting requirements.

* **Customer & Transaction Records:** Retained for **6 years** following the end of the tax year in which the transaction took place, in order to comply with UK tax authorities (HMRC).
* **Marketing Preferences:** Retained until you opt out or withdraw consent.

4. Data Sharing and Third-Party Processors

We share your personal data with trusted third-party service providers who assist in operating our e-commerce business:

* **E-Commerce Platform:** Shopify Inc. (hosts our online store and shopping cart).
* **Payment Gateways:** Shopify Payments, PayPal, Apple Pay, and Google Pay (to securely process payments).
* **Delivery & Postal Services:** Royal Mail and partner couriers (to fulfill and ship your orders).
* **Marketing Services:** Email marketing tools (where you have consented to receive updates).
* **Professional Advisers & Authorities:** Accountants, legal advisers, or law enforcement bodies when required by law.

All third-party processors are contractually required to respect the security of your personal data and treat it in accordance with UK data protection laws.

5. International Data Transfers

Some of our third-party service providers (such as Shopify) are based outside the United Kingdom, meaning processing of your personal data may involve a transfer outside the UK.

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
* The UK Government has officially declared the destination country to provide an adequate level of protection for personal data; or
* We enter into specific **Standard Contractual Clauses** or the **UK International Data Transfer Agreement (IDTA)** approved by the UK Information Commissioner's Office (ICO).

6. Your Legal Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

* **Right of Access:** The right to request a copy of the personal data we hold about you (a "Data Subject Access Request").
* **Right to Rectification:** The right to request correction of inaccurate or incomplete personal data.
* **Right to Erasure:** The right to request the deletion of your personal data where there is no good reason for us continuing to process it.
* **Right to Object:** The right to object to our processing of your personal data where we rely on Legitimate Interests or direct marketing.
* **Right to Restrict Processing:** The right to ask us to suspend processing of your personal data in certain scenarios.
* **Right to Data Portability:** The right to request transfer of your personal data to you or a third party in a structured format.
* **Right to Withdraw Consent:** Where we rely on consent to process your data (e.g. email marketing), you have the right to withdraw consent at any time without affecting prior lawful processing.

To exercise any of these rights, please email us at **info@milaroselondon.com**.

7. Cookies Policy

Our Website uses essential and non-essential cookies to distinguish you from other users, optimize site functionality, and provide analytics. For detailed information on the cookies we use and how to manage your preferences, please see our Cookie Policy.

8. Changes to This Privacy Policy

We keep our Privacy Policy under regular review. Any updates will be published directly to this page.

9. Contact Details and Complaints

If you have any questions or wish to exercise your legal rights, please contact us at:

* **Data Controller:** Mila Rose of London Limited
* **Registered Office:** 2 Manor Farm Court, Old Wolverton Road, Old Wolverton, Milton Keynes, Buckinghamshire, MK12 5NN, United Kingdom
* **Email:** info@milaroselondon.com

You have the right to make a complaint at any time to the **Information Commissioner's Office (ICO)**, the UK supervisory authority for data protection issues ([www.ico.org.uk](https://www.ico.org.uk)). We would, however, appreciate the chance to address your concerns directly before you approach the ICO, so please reach out to us first.