Privacy policy
Last updated: 8 March 2026
1. Who we are
This website, theflowbrand.co.uk ("the Site"), is operated by Imagiland UK LTD, a company registered in England and Wales under company number 15905615, trading as The Flow Brand.
Registered address: 124-128 City Road, London, England, EC1V 2NX
Data controller contact: privacy@theflowbrand.co.uk
Imagiland UK LTD is a subsidiary of Imagiland S.L., registered in Spain. For the purposes of UK data protection law, Imagiland UK LTD is the data controller responsible for your personal data collected through this Site.
We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. What personal data we collect
We collect different types of personal data depending on how you interact with us:
When you browse the Site
Your device automatically shares certain technical data with our servers. This includes your IP address, browser type and version, operating system, referring website, pages visited, time and date of your visit, and time spent on pages. This data is collected through Shopify's built-in analytics.
When you create an account or place an order
We collect the information you provide directly to us, including your full name, email address, delivery address, billing address, phone number (if provided), and order details (products purchased, quantities, and prices).
When you sign up to our mailing list
We collect your email address and, if provided, your name and any preferences you indicate (such as product interests).
When you contact us
We collect whatever personal data you include in your message, typically your name, email address, and the content of your enquiry.
When you use our video tutorials
Our product kits include access to guided video tutorials. When you access these tutorials, we may collect data about which tutorials you view and when, in order to improve our content and your experience.
Data we do not collect
We do not knowingly collect any special category data (such as data about your health, race, religion, or political opinions). We do not collect payment card details — all payment processing is handled securely by Shopify Payments, and we never see or store your full card number.
3. How and why we use your data
We only process your personal data when we have a lawful basis to do so. The table below sets out the purposes for which we use your data and the legal basis we rely on in each case.
| Purpose | Data used | Lawful basis |
|---|---|---|
| To process and fulfil your orders | Name, address, email, phone, order details | Performance of a contract with you |
| To send you order confirmations, shipping updates, and delivery notifications | Name, email, order details | Performance of a contract with you |
| To handle returns, refunds, and customer service enquiries | Name, email, address, order details, correspondence | Performance of a contract with you |
| To send you marketing emails about our products, offers, and news | Email, name | Your consent (you can withdraw this at any time) |
| To improve our Site, products, and services | Technical browsing data, anonymised purchase data | Our legitimate interest in improving our business |
| To detect and prevent fraud | Name, address, email, IP address, order details | Our legitimate interest in protecting our business and customers |
| To comply with legal and regulatory obligations | Varies | Legal obligation |
Where we rely on legitimate interests, we have carried out a balancing test to ensure our interests do not override your rights and freedoms.
4. Marketing communications
We will only send you marketing communications (such as newsletters, product launches, and special offers) if you have given us your explicit consent, for example by signing up through a form on our Site.
Every marketing email we send includes an unsubscribe link. You can opt out at any time by clicking that link, or by contacting us at privacy@theflowbrand.co.uk. We will process your unsubscribe request promptly.
Our email marketing is managed through Klaviyo, a third-party email service provider. Klaviyo processes your data on our behalf and in accordance with our instructions. Klaviyo's privacy policy is available at https://www.klaviyo.com/legal/privacy-notice.
5. Who we share your data with
We do not sell your personal data to anyone. We share your data only with trusted third parties who help us operate our business, and only to the extent necessary:
| Third party | Purpose | Data shared |
|---|---|---|
| Shopify | E-commerce platform, hosting, payment processing, and analytics | All order and browsing data |
| Klaviyo | Email marketing | Email address, name, purchase history (for personalisation) |
| Our fulfilment warehouse | Picking, packing, and dispatching orders | Name, delivery address, order details |
| Royal Mail / delivery carriers | Delivering your order | Name, delivery address, phone number (for delivery notifications) |
We may also share your data with professional advisors (such as accountants or solicitors) where necessary, and with law enforcement or regulatory bodies if required by law.
6. International data transfers
Some of the third parties we use are based outside the United Kingdom:
Shopify Inc. is headquartered in Canada, with servers and infrastructure in Canada and the United States. Shopify relies on Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO) as a safeguard for international transfers.
Klaviyo Inc. is headquartered in the United States. Klaviyo also relies on Standard Contractual Clauses and participates in the EU-US Data Privacy Framework to protect transferred data.
Our parent company, Imagiland S.L., is based in Spain. As an EU member state, Spain benefits from an adequacy decision under UK GDPR, meaning personal data can flow freely between the UK and Spain without additional safeguards.
We only transfer your data internationally where adequate protections are in place, as described above.
7. Cookies
Cookies are small text files placed on your device when you visit our Site.
Essential cookies
These are strictly necessary for the Site to function and cannot be switched off. They include cookies that enable your shopping cart, checkout process, and account login. We do not need your consent for these.
Analytics cookies
Shopify's built-in analytics use cookies to help us understand how visitors interact with the Site, including which pages are visited most often, how long visitors stay, and where they arrive from. This data is aggregated and anonymised where possible.
Marketing cookies
If you consent, Klaviyo may place cookies to help us understand how you interact with our marketing emails and to personalise your experience.
You can manage your cookie preferences at any time through the cookie banner on our Site, or by adjusting your browser settings. Please note that disabling essential cookies may affect the functionality of the Site.
A full cookie policy will be available as a separate document on our Site.
8. How long we keep your data
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:
| Data type | Retention period | Reason |
|---|---|---|
| Order and transaction records | 6 years from the date of the transaction | UK tax and accounting obligations (HMRC) |
| Customer account data | For the duration of your account, plus 2 years after closure or last activity | To provide our services and handle any post-purchase queries |
| Marketing consent records | Until you unsubscribe, plus 6 months | To prove we had valid consent, and to process unsubscribe |
| Customer service correspondence | 3 years from resolution | To handle follow-up queries and improve service |
| Browsing and analytics data | 26 months | Shopify's default analytics retention |
When the retention period expires, we securely delete or anonymise your data.
9. Your rights
Under UK GDPR, you have the following rights in relation to your personal data:
Right of access — You can request a copy of the personal data we hold about you (a "subject access request").
Right to rectification — You can ask us to correct any inaccurate or incomplete data we hold about you.
Right to erasure — You can ask us to delete your personal data in certain circumstances (sometimes called the "right to be forgotten").
Right to restrict processing — You can ask us to limit how we use your data in certain circumstances.
Right to data portability — You can ask us to provide your data in a structured, commonly used, machine-readable format, or to transfer it to another organisation.
Right to object — You can object to our processing of your data where we rely on legitimate interests as the lawful basis. You can also object to direct marketing at any time.
Right to withdraw consent — Where we rely on your consent (such as for marketing emails), you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, please contact us at privacy@theflowbrand.co.uk. We will respond to your request within one month, as required by law. In complex cases, we may extend this by up to two further months, but we will let you know if that is necessary.
There is no fee for exercising your rights in most cases. If a request is clearly unfounded or excessive, we may charge a reasonable fee or refuse the request, in line with ICO guidance.
10. Children
Our products are designed for adults. We do not knowingly collect personal data from anyone under the age of 16. If you believe we have collected data from a child under 16, please contact us at privacy@theflowbrand.co.uk and we will delete it promptly.
11. Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. These measures include encryption of data in transit (SSL/TLS), secure payment processing through Shopify Payments (PCI DSS compliant), and access controls limiting who within our organisation can view your data.
However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security.
12. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page. For significant changes, we may also notify you by email if you are a registered customer or subscriber.
We encourage you to review this policy periodically.
13. How to complain
If you are unhappy with how we have handled your personal data, we would like the opportunity to put things right. Please contact us first at privacy@theflowbrand.co.uk.
If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:
Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Telephone: 0303 123 1113 Website: https://ico.org.uk/make-a-complaint/
Imagiland UK LTD | Company No. 15905615 | 124-128 City Road, London, EC1V 2NX | privacy@theflowbrand.co.uk
