Privacy Policy
1. Who we are
Bare La Terre is a trading name of BARE LA TERRE LIMITED, a company registered in England and Wales.
| Company number | 16643600 |
|---|---|
| Registered office | 5 Central Parade, Station Road, Sidcup, England, DA15 7DH |
| privacy@barelaterre.com (privacy matters) · smile@barelaterre.com (general enquiries) |
We are the data controller for the personal data described in this policy. That means we decide why and how your personal data is used, and we are responsible to you and to the Information Commissioner’s Office for looking after it properly.
We are registered with the Information Commissioner’s Office under registration number ZC094692.
Last updated: 28 October 2026
2. About this policy, and who it is for
We make skincare designed for children aged 8 to 13. Our products are for children; our shop is for adults.
Only adults can buy from us, hold an account with us, or sign up to our emails. We do not sell to children, we do not create accounts for children, and we do not ask for or keep any personal information about the child the products are for — not their name, not their age, not their skin type, not photographs. If you are buying our products for a child, we hold information about you, not about them.
We know that children will nonetheless visit this website — that is who our products are for, and we would expect them to look. Section 9 explains what that means and what we do about it. We have also written a short, plain-English version of this policy for younger readers: Privacy — the short version.
This policy explains what personal data we collect from adults who visit, buy from, or contact us, why we collect it, how long we keep it, and what rights you have. Please read it alongside our Cookie Policy.
3. The personal data we collect
We collect only what we need to run a shop. We do not build profiles of you, and we do not sell your personal data to anyone.
| Category | What it includes | Where it comes from |
|---|---|---|
| Identity and contact | Your name, email address, delivery address, billing address, telephone number | Directly from you |
| Order | Products ordered, order number and date, order value, delivery status, returns, exchanges and refunds | Directly from you, and from our fulfilment and delivery partners |
| Payment | Payment method, the last four digits and expiry date of your card, the outcome of the payment, billing address | From our payment processor. We never see or store your full card number. Your card details go directly to our payment processor and are handled by them under their own security standards (PCI DSS) |
| Account | Your username, an encrypted version of your password, saved addresses, order history, your marketing preferences | Directly from you |
| Correspondence | The content of emails, messages, review submissions and any other communications you send us, and our replies | Directly from you |
| Reviews | Any product review you choose to publish, and the display name shown against it | Directly from you |
| Technical | IP address, browser type and version, device type, operating system, time zone, and the pages you viewed on our site | Automatically, via cookies and similar technologies — only where you have consented, except for the small number of cookies that are strictly necessary to make the site work |
We do not collect:
- any information about children, including the child a product is bought for;
- health information such as skin conditions, allergies, sensitivities, diagnoses or medications — we do not operate a skin quiz, skin diagnostic or photo-upload tool;
- photographs of you or of any child;
- special category data of any kind (racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health, sex life or sexual orientation);
- information about criminal convictions or offences.
If we ever change this — for example if we introduce a product-finder tool — we will update this policy first and tell you before we start.
4. Why we use your personal data, and our lawful basis
UK data protection law requires us to have a “lawful basis” for everything we do with your personal data. Here is ours, purpose by purpose.
| What we do | Why | Lawful basis |
|---|---|---|
| Take, process and deliver your order; handle returns, exchanges and refunds | To give you what you paid for | Contract — Article 6(1)(b) UK GDPR: necessary to perform our contract with you |
| Create and run your customer account | So you can track orders and check out faster | Contract — Article 6(1)(b) |
| Take payment and prevent fraud | To get paid, and to protect you and us from fraudulent transactions | Contract — Article 6(1)(b), and legitimate interests — Article 6(1)(f): our interest in preventing fraud and financial loss |
| Keep accounting, VAT and tax records | Because the law requires it | Legal obligation — Article 6(1)(c) |
| Answer your questions and provide customer support | To help you | Contract — Article 6(1)(b) where it relates to an order; otherwise legitimate interests — Article 6(1)(f): our interest in running a responsive business |
| Send you marketing emails if you have asked us to | To tell you about products you may like | Consent — Article 6(1)(a) |
| Send marketing emails about similar products to people who have bought from us and did not opt out at the time | To keep existing customers informed | Legitimate interests — Article 6(1)(f), relying on the “soft opt-in” in regulation 22(3) of PECR. You can stop these at any time, in one click, from any email |
| Publish product reviews you submit | So other customers can see honest feedback | Consent — Article 6(1)(a) |
| Measure how the website is used, using analytics cookies | To fix problems and improve the site | Consent — Article 6(1)(a). Analytics cookies only run if you accept them |
| Keep the site and our systems secure, and keep basic security logs | To protect the site from attack and misuse | Legitimate interests — Article 6(1)(f): our interest in the security of our service |
| Comply with legal obligations, respond to lawful requests, and establish or defend legal claims | Because we have to, or to protect our position | Legal obligation — Article 6(1)(c), and legitimate interests — Article 6(1)(f) |
| Measure and show our ads on Instagram, Facebook and TikTok (Meta and TikTok pixels) | To see which of our posts and ads lead to visits and orders | Consent — Article 6(1)(a) |
Where we rely on legitimate interests, we have weighed our interests against your rights and concluded that our processing is proportionate and would not be unexpected or intrusive. You can ask us for a summary of that assessment at any time, and you can object to the processing (see section 8).
Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect anything we did lawfully before you withdrew it.
Automated decision-making. We do not carry out profiling or automated decision-making that produces legal effects for you or similarly significantly affects you. We do not use behavioural or “personalised” advertising, except through the Meta and TikTok pixels if you accept marketing cookies (see section 7), we do not build inferences about you, and we do not take part in cross-merchant advertising schemes that share your shopping activity with other retailers.
Providing your data. You do not have to give us any personal data. But if you do not give us the identity, contact, delivery and payment information marked as required at checkout, we cannot accept or fulfil an order — there is no way for us to send you a product without knowing where to send it.
5. Who we share your personal data with
We share personal data only where we need to, and only with organisations who are contractually bound to protect it, to use it solely on our instructions, and not to use it for their own purposes.
| Who | What they do | Their role |
|---|---|---|
| Shopify | Hosts our online shop and processes orders | Our processor |
| Stripe Payments | Takes card payments and screens transactions for fraud | Independent controller for its own fraud-prevention and regulatory purposes |
| Samarkand Group and delivery carriers | Pick, pack and deliver your order | Our processors; carriers act as independent controllers for delivery records |
| Klaviyo | Sends our transactional and marketing emails | Our processor |
| JudgeMe | Collects and displays product reviews | Our processor |
| Google (Google Analytics) | Measures how the website is used, only if you accept analytics cookies | Our processor |
| Meta Platforms Ireland Limited | Marketing pixel and purchase reports for Instagram and Facebook | Joint controller for collecting the data on our site; independent controller for its own use |
| TikTok Technology Limited | Marketing pixel and purchase reports for TikTok | Joint controller for collecting the data on our site; independent controller for its own use |
| Vercel Inc. | Hosts this website | Our processor |
| Our web agency | Builds and runs this website, including click-and-scroll measurement, only if you accept analytics cookies | Our processor |
| Relax Tax Accountants, Balens Insurance, Gatsby Advisory | Professional services | Independent controllers, bound by professional confidentiality |
| HMRC, the ICO, courts, police and other authorities | Where we are legally required to disclose | Independent controllers |
We may also disclose personal data if our business is sold or reorganised, in which case the buyer would be bound by this policy in respect of data collected before the sale. We will tell you before that happens.
We do not sell your personal data. We do not share it with data brokers. We share it with Meta and TikTok only as described in section 7 and in our Cookie Policy; purchases are also reported to them by Shopify, our checkout provider. We do not take part in Shopify’s cross-merchant personalised advertising features — these are switched off for our shop.
6. How long we keep your personal data
| Data | How long | Why |
|---|---|---|
| Order, transaction and accounting records | 6 years from the end of the financial year in which the transaction took place | UK tax and VAT record-keeping requirements |
| Customer account (including saved addresses and order history) | While your account is open, then deleted 24 months after your last order or login, unless you close it sooner | To keep your account useful without holding data indefinitely |
| Customer service correspondence | 24 months from the date the query is closed | To handle follow-up questions, complaints and warranty issues |
| Marketing consent records | For as long as your consent is live, and 24 months after you withdraw it | To show we had a valid consent if challenged |
| Email suppression list (unsubscribes) | Indefinitely, and limited to the minimum needed | We have to keep a record that you opted out in order to honour it |
| Product reviews | While published, and 12 months after removal | To maintain the integrity of published reviews |
| Cookie consent records | 12 months, then we ask again | So we can show what you agreed to |
| Website analytics data | 14 months | Long enough to compare year-on-year; no longer |
| Abandoned basket data | 90 days | To help you resume a purchase |
| Security and fraud logs | 12 months | To investigate incidents |
| Data relating to an actual or threatened legal claim | Until the claim is resolved and the relevant limitation period has expired | To establish, exercise or defend legal claims |
When a retention period ends we delete the data securely, or anonymise it so that it can no longer be linked to you.
7. Cookies and similar technologies
We use a small number of strictly necessary cookies to make the site work — for example to remember what is in your basket and to keep you logged in. These do not require your consent, and you cannot turn them off without breaking the site.
Everything else — analytics, preference and marketing cookies — only runs if you accept it. Nothing non-essential is set before you choose. There are no pre-ticked boxes, refusing is as easy as accepting, and you can change your mind at any time via the “Cookie settings” link in the footer.
We do not use advertising, retargeting or tracking cookies other than the Meta and TikTok pixels, which only run if you accept them.
Full details of every cookie we set, what it does and how long it lasts are in our Cookie Policy.
8. Your rights
Under UK data protection law you have the following rights. They are free to exercise, and we will respond within one month. If your request is complex we may extend that by up to two further months, and we will tell you within the first month if we need to.
- Access. Get a copy of the personal data we hold about you, and information about how we use it.
- Rectification. Have inaccurate data corrected and incomplete data completed.
- Erasure. Have your data deleted, where there is no good reason for us to keep it. Note that we cannot delete order records we are legally required to retain for tax purposes.
- Restriction. Ask us to pause our use of your data in certain circumstances — for example while we check the accuracy of data you have challenged.
- Portability. Receive the data you gave us in a structured, commonly used, machine-readable format, or ask us to send it to someone else.
- Object. Object to processing based on our legitimate interests. You also have an absolute right to object to direct marketing — if you tell us to stop, we stop, with no questions asked and no need to give a reason.
- Withdraw consent. Where we rely on your consent, withdraw it at any time.
- Rights relating to automated decision-making. We do not carry out automated decision-making that has legal or similarly significant effects, so this right does not currently arise.
How to exercise them. Email privacy@barelaterre.com, or write to us at the registered office above. Please say clearly which right you want to exercise. We may need to verify your identity before we act — this protects you against someone else making a request in your name. If someone is acting on your behalf, we will need proof that you authorised them.
We will never charge you, or treat you any differently, for exercising your rights.
9. Children and this website
We do not sell to children and we do not knowingly collect personal data from anyone under 18. Accounts, purchases and marketing sign-ups are for adults only. If a child tries to place an order or create an account, we will not knowingly complete it.
But our products are made for 8-to-13-year-olds, so we expect children to visit this site, and we have designed it on that basis. In line with the Information Commissioner’s Office Age Appropriate Design Code, and with our duty under Article 25(1A) UK GDPR to consider how children can best be protected and supported:
- We apply the strongest protections to everyone. Rather than trying to work out who is a child, we simply apply the same high standard to every visitor. That is why the rest of this list applies to you whoever you are.
- We do not profile visitors ourselves and we do not use behavioural or personalised advertising anywhere on this site, except through the Meta and TikTok pixels, which are off by default and only run if someone accepts them in the cookie banner.
- Privacy settings are at their most protective by default. Nothing non-essential is switched on until someone chooses to switch it on.
- We do not collect location data.
- We collect as little as possible. Browsing our site sets no non-essential cookies unless you accept them, and we do not need you to tell us anything about yourself to look around.
- We do not use nudge techniques — countdowns, guilt-worded decline buttons, or designs that push anyone toward sharing more data or lowering their privacy settings.
- We think about wellbeing. We do not use anyone’s data to target messaging based on appearance or insecurity.
- We explain things plainly. Our short, child-friendly privacy notice is here: Privacy — the short version.
If you are a parent or guardian and you believe we hold personal data about your child, please contact us at privacy@barelaterre.com and we will investigate and delete it promptly.
10. Product reviews
If you submit a product review, it may be published on our website and will be visible to the public, including to children. Please do not include your full name, your child’s name or age, contact details, photographs, or any information about anyone’s health in a review. We moderate reviews before publication and will edit or reject anything that contains personal information of that kind.
You can ask us to remove your review at any time by emailing privacy@barelaterre.com.
11. Sending data outside the UK
Some of our suppliers are based outside the United Kingdom, or store data outside it. Where personal data leaves the UK, we make sure it is protected to a standard essentially equivalent to UK law, by relying on one of the following:
- UK adequacy regulations — the destination country has been assessed by the UK government as providing adequate protection;
- the UK Extension to the EU–US Data Privacy Framework, where the recipient is a US organisation with active certification covering the relevant data;
- the International Data Transfer Agreement (IDTA), or the UK Addendum to the European Commission’s Standard Contractual Clauses, supported by a transfer risk assessment.
You can request a copy of the safeguards we rely on for any particular transfer by emailing privacy@barelaterre.com.
12. How we protect your personal data
We take appropriate technical and organisational measures to keep your data secure, including:
- encryption of the website in transit (HTTPS/TLS) and encryption of data at rest by our hosting provider;
- access controls, so that staff and suppliers can only reach the data they need to do their job;
- multi-factor authentication on administrative accounts;
- storing passwords in hashed form — we cannot see your password;
- never storing full payment card numbers;
- written contracts with every supplier that handles personal data on our behalf, as required by Article 28 UK GDPR;
- keeping our systems and software up to date, and reviewing our security arrangements periodically.
No system can be guaranteed completely secure, but we take our responsibilities seriously. If a personal data breach happens that is likely to result in a high risk to your rights and freedoms, we will tell you without undue delay, and we will report qualifying breaches to the ICO within 72 hours.
13. Complaints
Please come to us first — we would rather fix it.
If you are unhappy with how we have handled your personal data, you have a right to complain to us directly, and we have a legal duty under section 164A of the Data Protection Act 2018 to take your complaint seriously.
How to complain: use our complaints form, email privacy@barelaterre.com, or write to us at the registered office above.
What happens next:
- We will acknowledge your complaint within 30 days of receiving it.
- We will investigate, make reasonable enquiries, and take appropriate steps without undue delay.
- We will write to you with the outcome, in plain language, normally within three months. If it is going to take longer, we will tell you why and keep you updated.
If you are still unhappy, you can complain to the Information Commissioner’s Office. You can go to the ICO at any point — you do not have to come to us first, though it usually gets things resolved faster.
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint
14. Links to other websites
Our site may link to other websites. We are not responsible for their privacy practices, and this policy does not apply to them. If you follow a link away from our site, please read the privacy policy of the site you land on.
15. Changes to this policy
We may update this policy from time to time. If we make a change that materially affects how we use your personal data, we will tell you directly — by email if we hold your address, and by a notice on the site — before the change takes effect. The date at the top of this policy shows when it was last updated. We keep previous versions and can supply one on request.
16. Contact us
Questions about this policy, or about your personal data:
Email: privacy@barelaterre.com
Post: Data Protection, Bare La Terre Limited, 5 Central Parade, Station Road, Sidcup, England, DA15 7DH
We have not appointed a Data Protection Officer, as we are not required to do so. Privacy enquiries are handled by Nicola Wood, Director, who is responsible for data protection at Bare La Terre.