Privacy Policy

Last updated: 15 August 2026

Who we are

BombshellCo is the data controller responsible for the personal information collected through bombshellco.uk.

For privacy questions or requests, contact us at info@bombshellco.co.uk.

Information we collect

Depending on how you use our website, we may collect:

• Your name, email address, telephone number, billing address and delivery address

• Account details and login information

• Order details, products purchased, refunds and correspondence

• Reward points and account activity

• Marketing preferences

• Messages sent through our contact form or by email

• Technical information, including your IP address, browser, device and website activity

• Cookie and analytics information, where you have given consent

Payments are processed by the payment provider offered at checkout. BombshellCo does not store your complete payment card details.

Please avoid sending detailed medical information through our website. If you voluntarily provide information about your health or skin in an enquiry, we will only use it to respond to your request and will delete it when it is no longer needed. Where required, we rely on your explicit consent to process this information.

How we collect your information

We collect personal information when you:

• Place an order

• Create or use an account

• Earn or redeem reward points

• Contact us or submit a website form

• Subscribe to marketing emails

• Use or browse our website

• Accept optional cookies

We may also receive limited information from payment providers, delivery providers and fraud-prevention services—for example, confirmation that a payment was successful or that an order was delivered.

How and why we use your information

We use personal information to:

• Process payments, fulfil orders and arrange delivery

• Manage returns, refunds and customer accounts

• Respond to enquiries and provide customer service

• Operate our reward-points programme

• Maintain financial, tax and business records

• Prevent fraud and protect the security of our website

• Improve our website, products and customer experience

• Send marketing communications where permitted

• Understand website use through consented analytics

Our lawful bases under UK data-protection law are:

• Contract: when information is needed to process an order, provide an account or take steps requested by you

• Legal obligation: when we must retain records or comply with tax, accounting, consumer-protection or other legal requirements

• Legitimate interests: when necessary to operate and protect our business, respond to customers, prevent fraud and improve our services, provided your rights do not override those interests

• Consent: for optional cookies, analytics, certain marketing communications and any special-category information where explicit consent is required

You can withdraw consent at any time. Withdrawing consent does not affect processing that took place before it was withdrawn.

Marketing

We may send you BombshellCo news, offers and product information if you have consented or where the law otherwise permits us to do so.

You can unsubscribe at any time by clicking the unsubscribe link in an email or contacting info@bombshellco.co.uk.

You have the right to object to the use of your personal information for direct marketing at any time.

We do not sell your personal information to other businesses for marketing.

Cookies and analytics

Our website uses essential cookies needed for functions such as the shopping basket, checkout, account security and remembering privacy choices.

With your consent, we may also use analytics or marketing cookies to understand how visitors use the website and improve our services. Non-essential cookies should not be activated unless you choose to accept them.

You can accept, reject or manage non-essential cookies through the cookie controls on our website. You can also change your browser settings, although blocking essential cookies may prevent parts of the shop from working correctly.

Who we share information with

We only share information where it is necessary to operate the business, complete an order or meet a legal obligation. Recipients may include:

• Payment-processing providers

• Royal Mail and other delivery providers

• Website hosting, security and technical-support providers, including WP Engine and Cloudflare

• WordPress and WooCommerce service providers

• Email and marketing providers, including MailerLite where used

• Analytics providers, including Google where analytics cookies have been accepted

• Accountants, insurers, professional advisers and fraud-prevention providers

• Regulators, law-enforcement bodies or other authorities where legally required

These organisations receive only the information necessary for their role and are required to protect it appropriately.

International transfers

Some service providers may process information outside the United Kingdom.

Where personal information is transferred internationally, we take steps to ensure that appropriate safeguards are used. These may include UK adequacy regulations, the UK International Data Transfer Agreement or approved contractual protections.

How long we keep information

We keep personal information only for as long as it is needed for the purpose for which it was collected and to meet legal obligations.

Normally:

• Order, payment and accounting records are retained for up to six years

• Customer-service enquiries are generally retained for up to two years after the enquiry is resolved

• Account information is retained while the account remains active and for a reasonable period afterwards

• Marketing information is retained until you unsubscribe or withdraw consent, although we may keep a minimal suppression record to ensure we respect your request

• Cookie and analytics information is retained according to the relevant cookie or provider settings

Information may be retained for longer where required for a legal claim, dispute, fraud investigation or legal obligation.

How we protect information

We use reasonable technical and organisational safeguards to protect personal information against unauthorised access, loss, alteration or disclosure.

No website or internet transmission is completely secure, but we regularly review the measures used to protect our website and customer information.

Your data-protection rights

Depending on the circumstances, you may have the right to:

• Ask for a copy of your personal information

• Correct inaccurate or incomplete information

• Ask us to delete information

• Ask us to restrict how information is used

• Object to certain processing

• Receive certain information in a portable format

• Withdraw consent at any time

• Object to direct marketing at any time

These rights are not absolute and may depend on the reason we process the information.

To exercise a right, email info@bombshellco.co.uk. We may need to confirm your identity before completing a request. We normally respond within one month.

Automated decisions

We do not use personal information to make solely automated decisions that have legal or similarly significant effects on customers.

Children’s information

Our website and products are not directed specifically at children, and we do not knowingly collect personal information from children through the website.

Third-party links

Our website may contain links to other websites. BombshellCo is not responsible for how those organisations collect or use personal information. Please read their privacy policies before providing information.

Complaints

Please contact us first if you have concerns about how we use your information so that we can try to resolve them.

You also have the right to complain to the Information Commissioner’s Office:

Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113

Changes to this policy

We may update this privacy policy when our services, providers or legal obligations change. The latest version and its updated date will always be published on this page.

Contact

BombshellCo
Southampton, United Kingdom
Email: info@bombshellco.co.uk
Website: https://bombshellco.uk

This document was last updated on 10 January 2026