Privacy Policy

Website services, marketing and advertising partners

This section explains the providers used on this website and the information involved. Depending on your choices and use of the website, information can include contact details, consent preferences, cookie and browser identifiers, IP address, device details, pages and products viewed, searches, basket activity, purchases and interactions with messages or adverts. Not every provider receives every category of information.

Attentive and Klaviyo: email, SMS and personalised messaging

We use Attentive and Klaviyo to manage subscriptions, deliver email and text messages, and measure and personalise communications. They may process your name, email address, telephone number, subscription and consent records, message interactions, and relevant browsing, basket and purchase activity. Attentive also supports back-in-stock requests. Where you subscribe to personalised marketing, website activity may be used to send relevant product or basket reminders.

Signing up for email or SMS marketing is a separate choice from accepting website cookies. Accepting Marketing cookies does not subscribe you to messages. You can unsubscribe from emails using the link in the message and from texts using the opt-out instructions in the text, including STOP where offered. A requested stock notification does not by itself authorise unrelated promotional messages. See Attentive's privacy notice and Klaviyo's privacy notice.

TikTok, Microsoft Advertising and OpenAI / ChatGPT Ads

We use TikTok advertising technology, Microsoft Advertising Universal Event Tracking (UET), and OpenAI's ChatGPT Ads measurement pixel to understand visits and conversions associated with advertising. Advertising measurement can use page and product activity, basket or purchase events, event times, product identifiers, order values, ad-click identifiers and cookie or browser identifiers. TikTok and Microsoft Advertising also support advertising audiences and remarketing. The information sent depends on the events and features configured.

Microsoft collects or receives personal data from this website to provide Microsoft Advertising. Its processing is explained in the Microsoft Privacy Statement. See also the TikTok Privacy Policy and OpenAI Privacy Policy. OpenAI measurement links website events with advertising interactions; it does not give us access to your private ChatGPT conversations.

AdRoll / NextRoll, including email capture

We use AdRoll, provided by NextRoll, Inc., for personalised advertising, retargeting, audience creation, frequency control and advertising measurement. It may process online identifiers, IP address, browser and device details, pages and products viewed, basket and purchase activity, and advertising interactions.

Our AdRoll integration has email capture enabled. This feature can collect an email address submitted through approved website forms and associate it with website activity. NextRoll also creates a hashed email identifier for advertising matching. Hashing does not make an identifier anonymous. NextRoll states that the actual email is used for our campaigns and that hashed emails may be used to improve advertising across its advertiser network. Any email marketing requires the relevant separate permission.

NextRoll acts as a controller for information collected through its advertising pixel and may share information with advertising and measurement partners. Its Service Privacy Notice describes these purposes, recipients, international transfers and rights. NextRoll describes a 13-month advertising-cookie lifetime and 12-month retention for browsing-history identifier data; these periods do not apply to all data. Its email collection guidance describes hashed-email retention as permanent, subject to applicable rights and its privacy notice. You can use its advertising opt-out in addition to our website consent controls.

Microsoft Clarity: usage analytics and session replay

We use Microsoft Clarity to understand how visitors interact with the website through heatmaps, interaction data and session replay. This can involve page views, clicks, scrolling, device and browser information, online identifiers and page content used to reconstruct a visit. Clarity uses masking for sensitive content; session replay is not a video from your camera. Microsoft processes data as explained in its Privacy Statement. Analytics and any advertising uses require the appropriate consent choices.

Elevar and advertising data connections

Elevar helps collect, organise and send website events to configured analytics and advertising services. These events may include browsing, basket and purchase activity, event identifiers and consent choices. Depending on the destination and enabled matching features, data can also include contact identifiers transformed into hashes. Browser tags and server-side connections may both be used to measure an event and avoid counting it twice. Server-side processing and hashing do not remove consent or data-protection requirements. The recipient services are described in this policy; an installed connection does not mean every possible destination or feature is enabled.

Lead Forensics: business visitor identification

We use Lead Forensics to help identify businesses visiting our website for business-to-business sales and marketing. The integration uses IP addresses, pages viewed and browser/device information to associate visits with business information. Marketing consent is required for this website's Lead Forensics tracking. For its processing and rights information, see Lead Forensics' privacy and compliance information.

Reviews, search, product protection and customer support

• Judge.me and Trustpilot: review collection, verification and display. Where we request or you submit a review, relevant information may include your name, email address, product or order details, rating and review content. Published reviews may show your chosen display name and submitted content. Embedded review widgets also receive technical information needed to display them. See Judge.me's notice and Trustpilot's notice.
• Doofinder: where its search service is used, it processes search terms, selected results, product interactions and relevant technical or session identifiers to provide and improve product search. Search-related storage may include local storage as well as cookies. Optional analytics or personalisation requires the appropriate consent. See Doofinder's notice.
• Loxa: where you request or purchase product protection, relevant contact, product, order and cover information is shared to arrange and administer the protection and related claims. Loxa and the relevant insurance providers explain their processing in the notices supplied with the cover. See Loxa's notice.
• Aircall: where used to handle a customer-service call, it processes telephone numbers, call metadata and relevant customer or order context. Recordings and voicemail may be processed where enabled and notified to you. This supports enquiries, service quality and dispute handling. See Aircall's privacy information.

Consent, legal bases and your choices

Marketing consent is required for advertising tracking and related personal-data processing described above. Analytics-only consent does not authorise advertising. Optional analytics and personalisation require the relevant consent choices. This applies to the purpose of processing regardless of whether a cookie, pixel, local storage or server-side connection is used. Simply browsing or reading this notice does not give consent.

We process information necessary to provide requested services, such as product protection or customer support, to perform a contract or take steps you request before entering one. Other service administration, fraud prevention and handling enquiries or disputes may rely on legitimate interests or legal obligations, as described elsewhere in this policy. These bases do not override a requirement for consent to tracking or electronic marketing.

Use Cookie settings, where available on the website, to review or withdraw optional consent. You may also block or delete cookies through your browser; deletion can reset saved choices. You can contact us using the details in this policy for help withdrawing consent or exercising your rights. Withdrawal does not affect processing that was lawful before it. You can continue shopping when you decline advertising cookies.

Retention and international processing

Cookie lifetimes and the retention of personal data are different. Cookie examples and provider information are in our Cookie Policy. We keep service and marketing records only for as long as needed for the purposes described, legal obligations and handling rights requests. We may retain limited suppression information to honour an unsubscribe. Providers that act as controllers explain their own retention criteria in their notices.

Some providers and their service providers process information outside the UK, including in the United States. Transfers must have an appropriate legal safeguard, such as an applicable UK adequacy arrangement or approved contractual safeguards. Contact us for information about safeguards relating to your data. Provider notices linked above explain their international processing.