Privacy and Cookies Policy

EB Online Ltd trading as English Brands

Last updated: 04/08/2026

This policy explains what personal data we collect when you use english-brands.co.uk or buy from us, why we collect it, who we share it with, and what rights you have. It applies to our UK website and to customers ordering through it.

1. Who we are

EB Online Ltd is the data controller for the personal data described in this policy.

Company registration number: 15389641
Registered office: 20 Wenlock Road, London, N1 7GU, United Kingdom
Trading address: Unit GC08, Heatherbank Road, Bournemouth, BH4 8EA, United
Kingdom
Information Commissioner’s Office registration number: C1446658
Data protection contact: help@english-brands.co.uk
Telephone: +44 (0) 1202 93 40 50

We are not required to appoint a Data Protection Officer.

2. What personal data we collect

When you place an order Name; billing address; delivery address; email address; telephone number; order contents and value; delivery instructions; order and returns history; correspondence with us.

Payment data Payment is processed by our payment providers. We receive confirmation of payment, the last four digits of the card, the card type and the billing address. We do not receive or store full card numbers or security codes.

When you create an account Login credentials (stored in encrypted form by Shopify),
saved addresses, wishlist and saved items.

When you contact us Your name, contact details, and the content of your emails, calls,
messages and social media enquiries.

When you subscribe to marketing Email address, name, and your engagement with our
emails (whether they were opened and which links you clicked).

When you leave a review Your name or display name, your review content and the product concerned.

Automatically, when you browse IP address, device type, browser, operating system, referring website, pages viewed, time spent, and actions taken on the site. Some of this is collected through cookies — see section 8. Analytics and advertising data are collected only where you have consented.

We do not knowingly collect data from children under 16. Our products are sold to adults.

3. Why we use it, and our lawful basis

What we use it for	Lawful basis (UK GDPR Art. 6)
Taking and fulfilling your order; delivery; exchanges and refunds	Performance of a contract
Answering your enquiries and handling complaints	Performance of a contract, or our legitimate interest in responding to enquiries
Taking payment and preventing fraudulent transactions	Performance of a contract; legitimate interest in preventing fraud; legal obligation
Keeping records of sales, VAT and customs declarations	Legal obligation
Marketing emails to existing customers about similar products	Legitimate interest, relying on the “soft opt-in” under PECR — you may object at any time
Marketing emails to people who are not customers	Consent
Analytics and advertising cookies	Consent
Displaying reviews you submit	Consent
Establishing, exercising or defending legal claims	Legitimate interest; legal obligation

Where we rely on legitimate interests, we have assessed that our interest is not overridden
by your rights. You can ask us for details of that assessment.

4. Who we share it with

We use the following categories of service provider, who process data on our instructions under written contracts:

Provider	Purpose	Data shared
Shopify	E-commerce platform, hosting, checkout, customer accounts, order management	All order and account data
Shopify Payments	Card payment processing, fraud screening, refunds	Name, address, email, telephone, order value, payment data
PayPal	Payment processing and refunds	Name, email, order value
Royal Mail, UPS	Delivery, tracking and loss claims	Delivery name, address, email, telephone
Mailchimp / Klaviyo	Marketing emails	Name, email, purchase and engagement history
Google Analytics	Website analytics, where you have consented	Online identifiers, IP address (truncated), browsing behaviour
Meta / Google Ads	Advertising measurement, where you have consented	Online identifiers, browsing and purchase events
Microsoft 365	Business email and document storage	Correspondence and order copies
Review Platforms	Collecting and publishing product reviews	Name, email, order details
Accountant / Bookkeeper	Statutory accounts, VAT returns	Transaction records
HM Revenue & Customs and overseas customs authorities	Customs declarations and tax	Name, address, order contents and value

We may also disclose data where required by law, to enforce our terms, to protect our rights or the safety of others, or in connection with the sale or transfer of our business or assets.

We do not sell your personal data.

5. International transfers

Some of our providers are based outside the United Kingdom.

Shopify is headquartered in Canada, which benefits from UK adequacy regulations, and uses infrastructure in other countries.
Where data is transferred to a country without UK adequacy regulations (including the United States), the transfer is protected by the UK International Data Transfer
Addendum to the EU Standard Contractual Clauses, or the UK extension to the EU–
US Data Privacy Framework, together with additional safeguards.

You can request a copy of the relevant safeguards by contacting us.

6. How long we keep it

Data	Retention period
Order and transaction records	6 years from the end of the financial year in which the order was placed (HMRC and Limitation Act requirements)
Customer accounts	Until you ask us to close the account, or after 3 years of inactivity
Marketing subscriber data	Until you unsubscribe, then a suppression record only
Customer service correspondence	2 years from the last contact, or 6 years where it relates to an order or complaint
Website analytics data	14 months
CCTV or premises
records, if any	1 year

When retention periods expire we delete the data or anonymise it.

7. Your rights

Under the UK GDPR you have the right to:

be informed about how we use your data — this policy;
access the personal data we hold about you;
have inaccurate data rectified;
have your data erased, where we no longer need it and no legal obligation requires us to keep it (note that we must retain order records for six years);
restrict how we process your data while a query is resolved;
receive your data in a portable format, or have it transmitted to another controller (data portability);
object to processing based on legitimate interests;
object to direct marketing at any time — this right is absolute;
withdraw consent at any time, where we rely on consent. This does not affect
processing carried out before withdrawal.

We do not carry out automated decision-making that produces legal or similarly significant effects. Our payment providers apply automated fraud scoring to transactions; where an order is declined on that basis you may contact us for a human review.

To exercise any right, email help@english-brands.co.uk or write to us at the trading
address above. We will respond within one month. There is no charge unless a request is
manifestly unfounded or excessive.

You can unsubscribe from marketing emails using the link in any email, or by contacting us.

Complaints. If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office:

ico.org.uk/make-a-complaint
0303 123 1113
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

8. Cookies and similar technologies

A cookie is a small file placed on your device when you visit a website. We also use pixels
and local storage, which work in a similar way.

Strictly necessary cookies are set automatically, because the site cannot function without
them. Everything else — analytics, personalisation and advertising — is set only if you
agree through the cookie banner shown on your first visit. You can change your choice at
any time via Cookie settings / the link in our website footer

Category	What it does	Examples	Set without consent?
Strictly necessary	Keeps your basket, session and checkout working; security and fraud prevention; records your cookie choices	`cart`, `_secure_session_id`, `_tracking_consent`, `secure_customer_sig`, Cloudflare security cookies	Yes
Functional	Remembers preferences such as language, currency and region	`localization`, `keep_alive`	No
Analytics	Tells us how many people visit, which pages they use and where they arrived from	`_shopify_y`, `_shopify_s`, Google Analytics `_ga`	No
Marketing	Measures advertising performance and shows relevant ads on other sites	Meta Pixel / Google Ads cookies	No

Our cookie banner lists the specific cookies in use at any time, which may change as we add or remove services.
You can also block or delete cookies through your browser settings, though the site may not work correctly if you block strictly necessary cookies.

9. Security

We hold your data on the Shopify platform, which maintains PCI DSS Level 1 certification and encrypts data in transit and at rest. Access to customer data within our business is restricted to staff who need it, protected by individual accounts and multi-factor authentication. Our email and business systems are hosted by Microsoft.

No system is completely secure. If a breach occurs that is likely to result in a high risk to
your rights and freedoms, we will notify you and the ICO as required by law.

10. Links to other sites

Our website links to third-party sites, including brand websites and social media. This policy does not cover them. Please read their own privacy policies before providing data to them.

11. Changes to this policy

We may update this policy. The date at the top shows when it was last changed. If we make a significant change we will tell you by email or by a notice on the website.