Privacy policy
Last updated: 15 October 2026
This policy explains how Havre de Luxe collects, uses, shares and protects your personal information when you visit our website, buy from us, contact us, or sign up for our emails and texts. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, the Privacy and Electronic Communications Regulations (PECR), and the privacy laws of the other countries and US states we sell to, where they apply.
1. Who we are
The controller of your personal information is McPhee Holdings Limited, trading as Havre de Luxe, a company registered in England and Wales (company number 12629807), registered office Unit 6 Lightwood Lane, Cotheridge, Worcester WR6 5LT, United Kingdom. We are registered with the UK Information Commissioner’s Office (ICO) under registration number ZC101578.
For any privacy question, request or complaint, email hey@havredeluxe.com with “Privacy” in the subject line. This is also the contact for our data protection lead.
2. What we collect
Information you give us
- Contact and delivery details: name, email address, phone number, billing and delivery addresses.
- Order details: products bought, prices, discounts used, and order history.
- Payment information: payments are handled by our payment providers. We do not see or store your full card number.
- Messages, chat conversations and photos you send to our care team, including photos of your handbags.
- Reviews, photos and videos you submit, and answers you give in our care quiz and Bag Finder.
- Marketing preferences, including your email and text message consent.
- Affiliate details, if you join our affiliate programme.
Information collected automatically
- Device and browser information, IP address, approximate location, and pages viewed.
- How you interact with our website, emails and texts, for example opens and clicks.
- Information from cookies, pixels and similar technologies, as set out in our Cookie Policy.
Information from others
- Payment providers, to confirm a payment and help prevent fraud.
- Social media platforms, if you message us, tag us or interact with our accounts or adverts.
- Carriers, with delivery updates.
We do not ask for sensitive information such as health or financial account details, and ask you not to send it to us.
3. How we use it, and our legal basis
| What we do | Legal basis (UK and EU) |
|---|---|
| Process, deliver and support your order, returns and guarantee claims | To perform our contract with you |
| Reply to your questions and give care guidance, including by live chat | Our legitimate interest in looking after our collectors, or contract |
| Send marketing emails and texts | Your consent, which you can withdraw at any time |
| Send emails to existing collectors about similar products | Our legitimate interest. We only do this where you gave us your details when buying or enquiring, were given the chance to opt out at the time, and every email has an unsubscribe link |
| Measure and improve our website and advertising, and show relevant ads | Your consent through our cookie banner, where the law requires it |
| Prevent fraud and keep our website and accounts secure | Our legitimate interest |
| Keep accounting and tax records and meet other legal duties | Legal obligation |
| Publish reviews and content you have shared with us | Your consent, which you can withdraw |
We do not sell your personal information for money. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our advertising partners may use information about your visits to show you relevant ads, which you can control as set out in section 8 and our Cookie Policy.
Live chat. Conversations in our website chat are recorded and stored by our care team platform so we can help you and keep a record of your request.
Text messages. Mobile numbers and text message consent are never shared with third parties or affiliates for their own marketing purposes.
4. Who we share it with
We share personal information only as needed with trusted service providers who act on our instructions, such as:
- our e-commerce platform (Shopify) and payment providers (such as Shopify Payments and PayPal);
- email, text message, WhatsApp and care team platforms (such as Klaviyo, Gorgias and Dondy);
- review and quiz platforms (such as Judge.me and Octane AI);
- delivery carriers and shipping services (such as Royal Mail, USPS, UPS, FedEx and DHL) and our fulfilment partners;
- analytics and advertising partners (such as Google, Meta, Pinterest and AppLovin), where you have agreed to cookies or have not opted out;
- our cookie consent provider (Pandectes) and our accounting software (Xero);
- our affiliate programme platform (GoAffPro), if you join as an affiliate or arrive through an affiliate link;
- professional advisers such as accountants, lawyers and insurers.
We may also share information if required by law, to protect our rights or the safety of others, or as part of a sale or restructure of our business.
5. International transfers
We are based in the United Kingdom, and some of our team and service providers are in the United States and other countries. When we transfer personal information outside the UK, we use recognised safeguards such as the UK International Data Transfer Agreement or Addendum, the UK Extension to the EU-US Data Privacy Framework, or other approved transfer mechanisms. You can ask us for details of the safeguard used.
6. Data deletion and retention
We keep personal information only for as long as we need it. Full details are in our Data Deletion Policy.
| Information | How long we keep it |
|---|---|
| Orders, invoices and payment records | 6 years from the end of the financial year of purchase, as required by UK tax law |
| Care team conversations and photos | 3 years from your last contact |
| Marketing contacts | Until you unsubscribe, or 3 years without any engagement |
| Reviews and content you share | While published, or until you ask us to remove them |
| Cookie and analytics data | As set out in our Cookie Policy |
Requesting deletion. Email hey@havredeluxe.com with “Delete my data” in the subject line. Once we have confirmed your identity, your data is erased within 30 days, except where we are required by law to keep it, for example order and tax records. Where we must keep some information, we keep only what the law requires and use it for no other purpose. If you unsubscribe, we keep your email address and phone number on a suppression list so we do not contact you again.
7. Your rights (UK and EU)
You have the right to:
- access the personal information we hold about you;
- correct inaccurate information;
- have your information deleted;
- restrict or object to how we use it, including the absolute right to object to direct marketing;
- receive your information in a portable format;
- withdraw consent at any time, without affecting anything we did before.
Email hey@havredeluxe.com to use any of these rights. There is no charge. We will respond within one month, which may be extended by up to two further months for complex requests, in which case we will tell you why. We may need to confirm your identity first.
8. Your rights in the United States
Depending on the state you live in, you may have the right to know what personal information we collect and how we use it, to access it, to correct it, to delete it, and to opt out of targeted advertising and of the “sale” or “sharing” of personal information as those terms are defined by state law.
- To use these rights, email hey@havredeluxe.com. We will respond within 45 days, which we may extend by a further 45 days where reasonably necessary, telling you why. If we decline a request, you may appeal by replying to our decision.
- To opt out of targeted advertising, use the cookie settings on our website or turn on Global Privacy Control in your browser, which we honour as an opt-out.
- We will not treat you differently for using your privacy rights.
- An authorised agent may make a request for you with your written permission.
9. Your rights in other countries
If you live in Australia, Canada, Singapore or another country with a privacy law, you have the rights that law gives you, such as access and correction. Email hey@havredeluxe.com and we will respond within the time your local law requires.
10. Complaints
If you are unhappy with how we have handled your information, please contact us first. We will acknowledge your complaint within 30 days and respond without undue delay. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113) or to the data protection authority where you live.
11. Keeping your information safe
We use appropriate technical and organisational measures to protect your information, and our service providers are required to do the same. If a data breach is likely to put you at risk, we will tell you and the relevant authorities as the law requires. No method of transmission over the internet is completely secure, so please avoid sending sensitive information by email or social media.
12. Children
Our website is not intended for children under 16 and we do not knowingly collect their personal information. If you believe a child has given us their information, please contact us and we will delete it.
13. Changes to this policy
We may update this policy from time to time. The latest version is always on this page, with the date it was last updated. If we make a significant change, we will tell you by email or on our website.