Privacy Policy
Effective Date: March 2026
Last Reviewed: March 2026
BAESHA ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains in detail how we collect, use, store, transfer and safeguard your personal data when you visit our website, place an order, subscribe to communications or otherwise interact with our services.
For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), BAESHA is the data controller of your personal data.
If you have questions regarding this policy or wish to exercise your data rights, please contact:
Email: info@baesha.com
1. Categories of Personal Data We Collect
We may collect, use and store the following categories of personal data:
Identity Data
First and last name
Contact Data
Billing address
Delivery address
Email address
Telephone number
Transaction Data
Order details
Purchase history
Payment confirmation information (we do not store full card details)
Technical Data
IP address
Browser type and version
Time zone setting
Device type
Operating system
Website interaction data
Marketing & Communications Data
Marketing preferences
Email engagement history
Back-in-stock requests (including product and variant selected)
We do not knowingly collect personal data from children under the age of 13.
2. How and Why We Use Your Personal Data
We use personal data only where legally permitted. Primary purposes include:
Processing and fulfilling orders
Managing payments and preventing fraud
Delivering customer service support
Sending order confirmations and transactional communications
Sending marketing communications (where consent has been given)
Notifying customers when out-of-stock products return
Analysing demand trends and product performance
Improving website functionality and user experience
Protecting our business from misuse or unlawful activity
We do not sell or rent personal data.
3. Lawful Basis for Processing
We rely on the following lawful bases under UK GDPR:
Contract – to perform a contract with you when you purchase products.
Legitimate Interests – to operate, secure and improve our business, provided your rights do not override those interests.
Consent – for email marketing, certain cookies and optional communications.
Legal Obligation – to comply with tax, accounting and regulatory requirements.
Where processing is based on consent, you may withdraw consent at any time.
4. Sharing Your Personal Data
We may share personal data with carefully selected third parties who provide services essential to operating our business, including:
Shopify (ecommerce platform and hosting)
Klaviyo (email marketing and back-in-stock notifications)
Payment providers such as Shopify Payments and PayPal
IT and website service providers
Professional advisers (legal, accounting)
All third-party processors are required to handle personal data in accordance with applicable data protection law.
5. International Transfers
Some service providers may process data outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, including:
Standard Contractual Clauses (SCCs)
Adequacy decisions recognised under UK law
Contractual obligations requiring equivalent data protection standards
6. Cookies and Tracking Technologies
Our website uses cookies and similar technologies to:
Enable essential website functionality
Analyse website performance
Support marketing and advertising activities
Non-essential cookies are only placed with your consent. You may manage cookie preferences through your browser settings or website consent tools.
7. Data Retention Periods
We retain personal data only for as long as necessary for the purposes outlined in this policy.
Typical retention periods include:
Order and transaction data: up to 6 years (for tax and accounting compliance)
Marketing data: until you unsubscribe or withdraw consent
Back-in-stock requests: retained for operational analysis unless deletion is requested
Data is securely deleted or anonymised when no longer required.
8. Your Data Protection Rights
Under UK GDPR, you have the right to:
Request access to your personal data
Request correction of inaccurate data
Request erasure of your personal data
Request restriction of processing
Object to processing based on legitimate interests
Withdraw consent at any time
Request transfer of your data to another provider (data portability)
Requests can be made by contacting info@baesha.com. We may request verification of identity before fulfilling certain requests.
You have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
Information Commissioner’s OfficeWycliffe HouseWater LaneWilmslowCheshireSK9 5AFUnited KingdomWebsite: https://www.ico.org.uk
9. Automated Decision-Making and Profiling
We do not carry out automated decision-making that produces legal or similarly significant effects. Limited profiling may occur for marketing and product demand analysis purposes; however, this does not materially affect your rights.
10. Data Security
We implement appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, disclosure or alteration. These measures include secure hosting, encrypted payment processing and restricted system access.
11. Data Breach Procedures
In the unlikely event of a personal data breach, we will assess risk promptly and notify the relevant supervisory authority and affected individuals where legally required.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect legal, operational or regulatory changes. The updated version will always be published on this page with the revised effective date.