Contents
1. Overview & Data Controller
Welcome to Hazel & Hush ("Hazel & Hush", "we", "us", or "our"). This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit our website, explore our heirloom collection, or purchase physical baby knitwear and nursery companions for tracked delivery worldwide.
Data Controller Identification
For individuals residing within the United Kingdom and the European Economic Area (EEA), Hazel & Hush operates as the primary Data Controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For residents of the United States, we comply with applicable federal and state privacy statutes, including the California Consumer Privacy Act (CCPA/CPRA).
2. Information We Collect
We adhere strictly to the principle of data minimisation. We only request and process personal details necessary to handcraft, safely package, invoice, and deliver your heirloom items.
Contact & Delivery Details
Full name of purchaser and recipient
Shipping address (Street, City, Postal/ZIP Code, and Country)
Email address for dispatch & tracking notices
Telephone number (required for courier delivery updates)
Gifting & Keepsake Inscriptions
Gift recipient's name and nursery delivery address
Custom handwritten calligraphy messages (up to 200 characters)
Heirloom milestone and nursery notes
Technical & Browsing Information
When you browse our boutique, our servers automatically receive diagnostic logs including IP address, browser type and version, timezone setting, referring website URL, and pages viewed. This data is utilized solely for site performance, anti-fraud telemetry, and rendering responsive layouts.
Newsletter, Launch Notification & Contact Forms
When you use "Join Us", "Notify Me" or our contact form, we store your email address, the time of your request, the page you were on, your IP address and its country, and your browser details, as a record of your consent and to keep our forms safe from abuse. A contact message also stores your name, the topic you chose, an optional order reference and your message.
3. How We Use Your Personal Data
We process your personal information exclusively for the following transparent purposes:
Fulfilling & Delivering Orders: Preparing your merino pieces, verifying stock, hand-inscribing gift calligraphy, printing courier slips, and arranging prompt tracked worldwide delivery.
Transactional Communications: Sending order confirmations, payment receipts, tracking identifiers, and delivery updates.
Customer Concierge Support: Answering your inquiries regarding yarn care, washing instructions, sizing guidance, and order status.
Private Journal & Quiet Reflections: Sending our periodic seasonal journal, newborn care notes, and private release invitations — only when you have explicitly opted in. You may unsubscribe with a single click at any time.
Fraud Prevention & Legal Compliance: Safeguarding against illicit chargebacks, verifying card legitimacy, and maintaining mandatory tax and fiscal records.
4. Lawful Basis for Processing (UK & EU GDPR)
Under the UK General Data Protection Regulation (UK GDPR), our processing of your personal data rests upon defined legal grounds:
Purpose | Legal Basis (UK / EU GDPR) |
|---|---|
Order Processing & Shipping | Performance of a Contract (Article 6(1)(b)) — necessary to deliver your physical goods. |
Payment & Invoicing | Legal Obligation (Article 6(1)(c)) & Performance of Contract — statutory accounting and customs duties. |
Customer Care & Quality | Legitimate Interests (Article 6(1)(f)) — ensuring exceptional boutique service and product longevity. |
Private Journal Newsletter | Explicit Consent (Article 6(1)(a)) — freely given, revocable at any moment. |
5. Sharing & Disclosure to Third Parties
Our Unconditional Vow:
We will never sell, lease, trade, or monetize your personal information to third-party data brokers, advertising networks, or marketing syndicates.
We share only the minimum required information with vetted, certified service partners who assist us in fulfilling your order:
Carriers & Couriers: Tracked international courier partners (including DHL Express and national postal services) receive recipient names, destination addresses, and contact phone numbers solely to execute physical door-to-door delivery and send SMS tracking.
Payment Gateways: Monobank Acquiring and WayForPay process transactions through encrypted PCI-DSS Level 1 channels.
Cloud Infrastructure: Encrypted, secure cloud hosting providers complying with ISO 27001 and SOC 2 security protocols.
Statutory Authorities: Customs border authorities for cross-border international declarations, or as required by court order.
6. Payment Security & Tokenisation
All financial transactions initiated on Hazel & Hush are processed via verified, bank-grade payment gateways (Monobank Acquiring and WayForPay).
Zero Card Storage Policy
Hazel & Hush never collects, intercepts, views, or stores your 16-digit credit card number, CVV security code, or bank credentials. Payment authorization is conducted via tokenised TLS 1.3 encryption directly between your device and the acquiring bank, supporting Apple Pay, Google Pay, and 3D-Secure 2.0 verification.
7. International Data Transfers
Because we proudly serve families worldwide, personal data associated with cross-border fulfillment may be processed across international jurisdictions.
Where cross-border transfers occur, we implement robust contractual safeguards, including the UK International Data Transfer Addendum (IDTA) and European Standard Contractual Clauses (SCCs), guaranteeing that your data remains shielded under the highest standards of confidentiality.
8. Data Retention Policy
We retain personal data only for as long as necessary to achieve the specific purposes outlined in this policy:
Order & Fiscal Records: Stored for 6 to 7 years in compliance with UK HMRC, US IRS, and European statutory accounting regulations.
Customer Inquiries & Care: Stored for 24 months after resolution to maintain continuity of care for your family's collection.
Journal Subscriptions: Maintained until you choose to unsubscribe, upon which your email is immediately archived and ceased from all marketing broadcasts.
9. Your Legal Rights (UK GDPR & US CCPA)
Depending on your place of residence, you are entitled to exercise significant statutory rights over your personal data:
UK & European Residents
Right to Access: Request a complete copy of data we hold about you.
Right to Rectification: Correct inaccurate or incomplete addresses.
Right to Erasure: Request deletion ("Right to be Forgotten").
Right to Object & Restrict: Halt specific data usages.
Right to Data Portability: Obtain your records in standard format.
United States & California Residents
Right to Know: Disclosures on categories of data collected and shared.
Do Not Sell My Info: We confirm we do not sell your personal data.
Non-Discrimination: Equal service regardless of privacy exercise.
Right to Correct & Delete: Amend or purge historical records.
To exercise any of the rights listed above, please email our concierge team at [email protected]. We respond to all verified requests within thirty (30) days without charge.
10. Cookies & Local Storage
We deploy a strictly minimal, transparent approach to browser storage:
Essential Functionality Only
Our boutique keeps only the following without asking, because the shop cannot work properly without them. None of them is ever shared with advertisers.
Shopping Bag (
hh_cart): A first-party cookie, set when you first add a piece to your bag and kept for 60 days. It holds only a random, signed identifier that scripts on the page cannot read; the pieces in your bag are kept on our servers, so they stay with you from page to page and through checkout.Cookie Choice (
hh_consent): A first-party cookie that remembers your analytics and marketing choice for 180 days, so we do not ask again on every page.Currency Preference: Browser
localStorage(key:hazel_currency_preference) remembers the currency in which you prefer to see our prices.Session Notes: Browser
sessionStorage, cleared when you close the tab, remembers whether our cookie banner should ask you (hh_consent_region) and which orders have already been counted (hh_ga_purchase_followed by the order number), so a purchase is never counted twice.Pre-Launch Page: While our boutique is preparing to open, the countdown's end time (
hh_launch_target_timestamp) is kept inlocalStorageon your device only. The email address you enter under "Notify Me" is not kept on your device: it is stored on our server together with the time, the page you were on, your IP address and its country, and your browser details, so that we can send you a single invitation when our doors open and keep a record of your consent. We keep it until you unsubscribe or ask us to delete it. After you unsubscribe we keep only your email address, marked as unsubscribed, so that we never write to you again; ask us and we will delete it entirely. To unsubscribe or to have it deleted, email [email protected].If an earlier visit kept your bag on your device, it is moved to your server-side bag once and then removed from your device. You can control or clear cookies and local storage through your browser preferences at any time. Note that clearing cookies will empty your current shopping bag.
Analytics & Marketing Cookies
To understand how families discover our boutique (for example, which pieces are viewed, added to the bag, and purchased), we use Google Analytics 4, loaded through Google Tag Manager. When permitted, Google Analytics sets first-party cookies (such as
_ga) and receives your IP address, device and browser details, and the pages you visit. We never send your name, email address, postal address, or telephone number to Google.
UK, EEA & Switzerland: Analytics cookies are set only after you choose "Accept all" or switch on Analytics under "Settings" in our cookie banner. Until then, or if you decline, Google's tags set no cookies and send only anonymous signals without identifiers, which Google uses for aggregated measurement.
All Other Regions: Analytics is on by default, and you may switch it off at any time.
Marketing Cookies: Cookies that measure or personalise our advertising are set only with your consent, wherever you reside.
To decide whether to ask before any analytics cookie is set, your browser asks our network provider, Cloudflare, for the country of your IP address; only the answer to that question is kept, in your browser, for the current browsing session. Your choice is stored for 180 days in a first-party cookie named
hh_consent, and you may change it at any time through "Cookie settings" at the bottom of every page.Google processes this data as described in its Privacy Policy; see also how Google uses information from sites that use its services.
11. Children's Privacy Notice (COPPA)
While our heirloom knitwear and nursery companions are lovingly crafted for infants and newborns, our website, boutique catalog, and purchasing facilities are intended exclusively for adult parents, grandparents, family, and gift-givers aged eighteen (18) and older.
We do not knowingly solicit or collect personal information directly from children under the age of 13 (or under 16 in the UK/EEA). If we learn that a minor has submitted personal information without verified parental consent, we will delete that data immediately.
12. Contact Our Concierge
If you have questions, reflections, or requests regarding this Privacy Policy, please reach out to our dedicated team:
Direct Correspondence
Hazel & Hush Boutique Care
Email: [email protected]
General Inquiries: [email protected]Supervisory Authority
If you reside in the UK and feel your privacy has been infringed, you retain the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).