Privacy policy

icon® operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the “Services”). icon® is powered by Shopify, which enables us to provide the Services to you.

This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase or other transaction using the Services or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described in this Privacy Policy.

Personal Information We Collect or Process

When we use the term “personal information,” we are referring to information that identifies or can reasonably be linked to you or another person. Personal information does not include information that is collected anonymously or that has been de-identified, so that it cannot identify or be reasonably linked to you. We may collect or process the following categories of personal information, including inferences drawn from this personal information, depending on how you interact with the Services, where you live, and as permitted or required by applicable law:

Contact details including your name, address, billing address, shipping address, phone number, and email address.

Financial information including credit card, debit card, and financial account numbers, payment card information, financial account information, transaction details, form of payment, payment confirmation and other payment details.

Account information including your username, password, security questions, preferences and settings.

Transaction information including the items you view, put in your cart, add to your wishlist, or purchase, return, exchange or cancel and your past transactions.

Communications with us including the information you include in communications with us, for example, when sending a customer support inquiry.

Device information including information about your device, browser, or network connection, your IP address, and other unique identifiers.

Usage information including information regarding your interaction with the Services, including how and when you interact with or navigate the Services.

Personal Information Sources

We may collect personal information from the following sources:

Directly from you including when you create an account, visit or use the Services, communicate with us, or otherwise provide us with your personal information;

From our service providers including when we engage them to enable certain technology and when they collect or process your personal information on our behalf;

From our partners or other third parties.

How We Use Your Personal Information

Depending on how you interact with us or which of the Services you use, we may use personal information for the following purposes, which have a valid basis under UK law:

Performance of a contract

Process and fulfil your orders

Manage payments, delivery, returns and exchanges

Provide customer account functionality

Legal obligation

To:

Comply with tax, accounting and regulatory requirements

Prevent fraud and meet legal requests

Legitimate interests

To:

Improve and personalise our Services

Maintain security and prevent misuse

Understand how customers use our Services

We ensure our legitimate interests are balanced against your rights.

Consent

We rely on your consent to:

Send marketing communications (where required)

Use non-essential cookies (see below)

You can withdraw your consent at any time.

Marketing Communications

Where permitted by law, we may send you marketing communications by email, SMS or post.

We will only do this:

With your consent, or

Where the “soft opt-in” applies (e.g. you are an existing customer and have been given the opportunity to opt out)

You can opt out at any time by:

Clicking “unsubscribe” in emails

Contacting us directly

How We Disclose Personal Information

In certain circumstances, we may disclose your personal information to third parties for legitimate purposes subject to this Privacy Policy. Such circumstances may include:

With Shopify, vendors and other third parties who perform services on our behalf (e.g. IT management, payment processing, data analytics, customer support, cloud storage, fulfillment and shipping). See below for a more detailed list of the third parties we contract with to supply certain products and services.

Recipient	Activity Carried Out	Sector	Location
Khaos Control	Sales Order Processing	Business Systems	UK
Tech n That	Shopify Website Development	Website Developers	UK
Zendesk	Customer communications software	Customer relationship management and messaging	Ireland
Klaviyo	Email Marketing	Marketing	US
DPD	Carrier	Transport	UK

Some of these organisations act as data processors on our behalf, while others may act as independent controllers.

With business and marketing partners to provide marketing services and advertise to you. For example, we use Shopify to support personalised advertising with third-party services based on your online activity with different merchants and websites. Our business and marketing partners will use your information in accordance with their own privacy notices. Depending on where you reside, you may have a right to direct us not to share information about you to show you targeted advertisements and marketing based on your online activity with different merchants and websites.

When you direct, request us or otherwise consent to our disclosure of certain information to third parties, such as to ship you products or through your use of social media widgets or login integrations.

With our affiliates or otherwise within our corporate group.

In connection with a business transaction such as a merger or bankruptcy, to comply with any applicable legal obligations (including to respond to subpoenas, search warrants and similar requests), to enforce any applicable terms of service or policies, and to protect or defend the Services, our rights, and the rights of our users or others.

How and Where Do You Store or Transfer My Personal Data?

We will store some of your personal data in the UK. This means that it will be fully protected under the Data Protection Legislation.

AND

We will store some of your personal data within the European Economic Area (the “EEA”). The EEA consists of all EU member states, plus Norway, Iceland, and Liechtenstein. This means that your personal data will be fully protected under the EU GDPR and/or to equivalent standards by law. Transfers of personal data to the EEA from the UK are permitted without additional safeguards.

AND

We may store some of your personal data in countries outside of the UK. These are known as “third countries”. We will take additional steps in order to ensure that your personal data is treated just as safely and securely as it would be within the UK and under the Data Protection Legislation as follows:

Please contact us using the details below in Part 15 for further information about the particular data protection safeguards used by us when transferring your personal data to a third country.

The security of your personal data is essential to us, and to protect your data, we take a number of important measures, including the following:

limiting access to your personal data to those employees, agents, contractors, and other third parties with a legitimate need to know and ensuring that they are subject to contractual duties of confidentiality or Data Processing Agreements;

procedures for dealing with data breaches (the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, your personal data) including notifying you and/or the Information Commissioner’s Office where we are legally required to do so;

We operate an internal Data Protection Policy to which all employees are subject. Under this, any actual or possible data breach is reported immediately to the Director responsible for, and trained in, data protection and information systems security. They initiate established protocols for investigation and mitigation within 24 hours, including any requirement to inform Data Subjects or the ICO.

Use of cookies

Our Site may place and access certain first-party Cookies on your computer or device. First-party Cookies are those placed directly by us and are used only by us. We use Cookies to facilitate and improve your experience of Our Site and to provide and improve our services.

All Cookies used by and on Our Site are used in accordance with current Cookie Law.

Before Cookies are placed on your computer or device, you will be shown a pop-up requesting your consent to set those Cookies. By giving your consent to the placing of Cookies you are enabling us to provide the best possible experience and service to you. You may, if you wish, deny consent to the placing of Cookies; however certain features of Our Site may not function fully or as intended.

Certain features of Our Site depend on Cookies to function. Cookie Law deems these Cookies to be “strictly necessary”. These Cookies are shown in the table below. Your consent will not be sought to place these Cookies, but it is still important that you are aware of them. You may still block these Cookies by changing your internet browser’s settings as detailed below, but please be aware that Our Site may not work properly if you do so.

The following first-party Cookies may be placed on your computer or device:

Name of Cookie	Purpose	Strictly Necessary
mage-messages	Tracks error messages and other notifications that are shown to the user, such as the cookie consent message, and various error messages. The message is deleted from the cookie after it is shown to the shopper.	Yes
product_data_storage	Stores configuration for product data related to Recently Viewed / Compared Products.	Yes
recently_compared_product	Stores product IDs of recently compared products.	Yes
recently_compared_product_previous	Stores product IDs of previously compared products for easy navigation.	Yes
recently_viewed_product	Stores product IDs of recently viewed products for easy navigation.	Yes
recently_viewed_product_previous	Stores product IDs of recently previously viewed products for easy navigation.	Yes
form_key	A security measure that appends a random string to all form submissions to protect the data from Cross-Site Request Forgery (CSRF).	Yes
mage-cache-sessid	The value of this cookie triggers the cleanup of local cache storage.	Yes
mage-cache-storage	Local storage of visitor-specific content that enables ecommerce functions.	Yes
mage-cache-storage-section-invalidation	Forces local storage of specific content sections that should be invalidated.	Yes
private_content_version	Appends a random, unique number and time to pages with customer content to prevent them from being cached on the server.	Yes
PRLST	Allows Stackpath firewall to create a page ID for site access	Yes
SPSI	Allows StackPath firewall to create a session ID for site access	Yes
UTGv2	Creates Unique ID to prevent ‘spoofing’ of user session.	Yes
adOtr	Identifies anonymised user behaviour to prevent ‘spoofing’.	Yes
spcsrf	Protection for the CSRF firewall module.	Yes
_fbp	Pixel cookie allowing Facebook to target content at logged-in Facebook users	No

Our Site uses analytics services provided by Google, Facebook, Trust Pilot and Hotjar. Website analytics refers to a set of tools used to collect and analyse anonymous usage information, enabling us to better understand how Our Site is used. This, in turn, enables us to improve Our Site and the products and services offered through it.

The analytics service(s) used by Our Site use Cookies to gather the required information. You do not have to allow us to use these Cookies, however whilst our use of them does not pose any risk to your privacy or your safe use of Our Site, it does enable us to continually improve Our Site, making it a better and more useful experience for you.

The analytics service(s) used by Our Site use(s) the following Cookies:

Name of Cookie	First / Third Party	Provider	Purpose
_ga	First	Google Analytics	Distinguishes visitors to Our Site.
_gid	First	Google Analytics	Distinguishes visitors to Our Site.
_fbp	First	Facebook	Pixel cookie providing analytics of Facebook users
_pin_unauth	First	Pinterest	Groups actions for users who cannot be identified by Pinterest.
_asc	Third	Trust Pilot	Used to display reviews from Trust Pilot
_auc	Third	Trust Pilot	Used to display reviews from Trust Pilot
ajsanonymousid	Third	Trust Pilot	Used to display reviews from Trust Pilot
ajsgroupid	Third	Trust Pilot	Used to display reviews from Trust Pilot
ajsuserid	Third	Trust Pilot	Used to display reviews from Trust Pilot
__RequestVerificationToken	Third	Trust Pilot	Used to display reviews from Trust Pilot
_auc	Third	Trust Pilot	Used to display reviews from Trust Pilot
csrf-canary	Third	Trust Pilot	Used to display reviews from Trust Pilot

In addition to the controls that we provide, you can choose to enable or disable Cookies in your internet browser. Most internet browsers also enable you to choose whether you wish to disable all Cookies or only third-party Cookies. By default, most internet browsers accept Cookies, but this can be changed. For further details, please consult the help menu in your internet browser or the documentation that came with your device.

You can choose to delete Cookies on your computer or device at any time, however you may lose any information that enables you to access Our Site more quickly and efficiently including, but not limited to, login and personalisation settings.

It is recommended that you keep your internet browser and operating system up-to-date and that you consult the help and guidance provided by the developer of your internet browser and manufacturer of your computer or device if you are unsure about adjusting your privacy settings.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services for you. Information you submit to the Services will be transmitted to and shared with Shopify as well as third parties that may be located in countries other than where you reside, in order to provide and improve the Services for you. In addition, to help protect, grow, and improve our business, we use certain Shopify enhanced features that incorporate data and information obtained from your interactions with our Store, along with other merchants and with Shopify. To provide these enhanced features, Shopify may make use of personal information collected about your interactions with our store, along with other merchants, and with Shopify. In these circumstances, Shopify is responsible for the processing of your personal information, including for responding to your requests to exercise your rights over use of your personal information for these purposes. To learn more about how Shopify uses your personal information and any rights you may have, you can visit the Shopify Consumer Privacy Policy . Depending on where you live, you may exercise certain rights with respect to your personal information here Shopify Privacy Portal Link.

Third Party Websites and Links

The Services may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on these sites. Information you provide on public or semi-public venues, including information you share on third-party social networking platforms may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use by us or by a third party. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed on the Services.

Children’s Data

The Services are not intended to be used by children, and we do not knowingly collect any personal information about children under the age of majority in your jurisdiction. If you are the parent or guardian of a child who has provided us with their personal information, you may contact us using the contact details set out below to request that it be deleted. As of the Effective Date of this Privacy Policy, we do not have actual knowledge that we “share” or “sell” (as those terms are defined in applicable law) personal information of individuals under 186 years of age.

Security and Retention of Your Information

Please be aware that no security measures are perfect or impenetrable, and we cannot guarantee “perfect security.” In addition, any information you send to us may not be secure while in transit. We recommend that you do not use unsecure channels to communicate sensitive or confidential information to us.

We retain personal information only as long as necessary, including:

Customer accounts: while active and for a reasonable period after this time

Marketing data: until you withdraw consent or after a period of inactivity

Your Rights and Choices

Under UK Data Protection Law, you have the right to:

Access your personal information

Request correction of inaccurate data

Request deletion of your data

Restrict or object to processing

Data portability

Withdraw consent at any time (where applicable)

Object to direct marketing

To exercise your rights, contact us using the details above.

You also have the right to lodge a complaint with the Information Commissioner’s Office.

If you reside in the UK or European Economic Area, and subject to exceptions and limitations provided by local law, you may exercise the following rights in addition to the rights outlined above:

Objection to Processing and Restriction of Processing

We will not discriminate against you for exercising any of these rights. We may need to verify your identity before we can process your requests, as permitted or required under applicable law. In accordance with applicable laws, you may designate an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us. We will respond to your request in a timely manner as required under applicable law.

Complaints

If you have complaints about how we process your personal information, please contact us using the contact details provided below so that we may try to resolve the issue.

Within the UK you may also contact the ICO directly. For the EEA, you can find a list of the responsible data protection supervisory authorities here.

International Transfers

Please note that we may transfer, store and process your personal information outside the country you live in.

If we transfer your personal information out of the European Economic Area or the United Kingdom, we will rely on recognized transfer mechanisms like the European Commission’s Standard Contractual Clauses, or any equivalent contracts issued by the relevant competent authority of the UK, as relevant, unless the data transfer is to a country that has been determined to provide an adequate level of protection.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on this website, update the “Last updated” date and provide notice as required by applicable law.

Contact