Privacy policy
Last updated: 13 September 2026
1. Introduction
1.1 About This Privacy Policy
This Privacy Policy explains how TheSafeHive (“TheSafeHive”, “we”, “us” or “our”) collects, uses, stores, shares and protects personal data when you visit or use our website, create an account, place an order, submit a review, contact us, subscribe to communications or otherwise interact with us.
We process personal data in accordance with applicable UK data protection and privacy laws, including:
- the UK General Data Protection Regulation (“UK GDPR”);
- the Data Protection Act 2018;
- the Data (Use and Access) Act 2025, where applicable; and
- the Privacy and Electronic Communications Regulations 2003 (“PECR”), where applicable.
This Privacy Policy also explains your data protection rights and how you can exercise them.
1.2 About TheSafeHive
TheSafeHive operates an online retail and informational platform offering selected personal-care and related products alongside evidence-led product, ingredient and verification information.
Customers may browse products, place orders, make payments, create or use customer accounts where available, submit product reviews and interact with educational content through our Shopify-powered online store.
1.3 Scope
This Privacy Policy applies to personal data processed through:
- our website;
- our Shopify online store and customer accounts;
- purchases, payments and orders;
- delivery and fulfilment;
- returns, refunds and customer support;
- contact and enquiry forms;
- product reviews;
- newsletter or marketing subscriptions, where offered;
- cookies and similar technologies;
- product nomination or other submission forms;
- communications with TheSafeHive; and
- systems and service providers used to operate our business.
2. Data Controller
2.1 Controller
For the purposes of UK data protection law, the data controller is the legal entity operating TheSafeHive.
Our full legal entity, company and contact information is provided in Section 22.
TheSafeHive determines the purposes and means by which personal data under our control is processed.
2.2 Privacy Enquiries
For questions about privacy, personal data or your data protection rights, please contact us using the privacy contact details provided in Section 22.
You may also contact us using the official contact form available on our website.
3. Personal Data We Collect
The personal data we collect depends on how you interact with TheSafeHive.
3.1 Identity and Contact Information
We may collect:
- your name;
- email address;
- telephone number;
- billing address;
- delivery address; and
- other contact information you choose to provide.
3.2 Customer Account Information
If you create or use a customer account, we may process:
- account identifiers;
- login-related information;
- account preferences;
- saved addresses;
- order history;
- account settings; and
- other information associated with your account.
Authentication information may also be processed by Shopify or other service providers supporting the account functionality.
3.3 Order and Transaction Information
When you purchase from TheSafeHive, we may process:
- products ordered;
- quantities;
- order number;
- order value;
- discounts applied;
- order date and status;
- shipping and delivery details;
- transaction identifiers;
- payment status;
- refunds;
- cancellations;
- returns;
- previous purchases; and
- other records relating to your transaction.
We may also process information concerning products placed in your cart or wishlist where those features are available.
3.4 Payment Information
Payments are processed through Shopify and/or payment service providers integrated with our store.
Payment providers may process information such as:
- card or payment account information;
- billing information;
- payment method;
- payment confirmation;
- transaction identifiers; and
- fraud-prevention information.
TheSafeHive does not ordinarily receive or store your complete payment card details directly. We may receive payment status and transaction information required to administer your order.
3.5 Delivery and Fulfilment Information
To deliver your order, we may process and share information including:
- name;
- delivery address;
- telephone number where required;
- email address where required;
- parcel information;
- delivery instructions;
- tracking information; and
- order reference information.
3.6 Reviews and User-Submitted Content
TheSafeHive uses Judge.me to support product reviews.
If you submit a review, we may process:
- your name or chosen display name;
- email address;
- star rating;
- written review;
- photographs or other content you choose to submit;
- product and order information associated with the review; and
- technical information used for review verification or moderation.
3.7 Communications and Enquiries
We may collect information you provide when you:
- contact customer support;
- use our contact form;
- email us;
- make a complaint;
- request a return or refund;
- exercise a data protection right; or
- otherwise communicate with us.
This may include the content of your message and related correspondence.
3.8 Marketing Preferences
Where marketing communications are offered, we may process:
- your email address;
- subscription status;
- consent records;
- marketing preferences;
- unsubscribe information; and
- engagement information relating to our communications.
3.9 Technical and Usage Information
When you visit our website, we and our authorised service providers may process technical information including:
- IP address;
- browser type;
- device type;
- operating system;
- network information;
- identifiers;
- pages visited;
- interactions with the website;
- referral information;
- timestamps;
- session information; and
- cookie or similar technology identifiers.
3.10 Information Required to Provide Our Services
Certain personal data is necessary for us to enter into or perform a contract with you.
For example, when you place an order, we may need information such as your:
- name;
- billing and delivery address;
- contact details;
- order information; and
- payment-related information.
Where this information is required to process or fulfil an order and you do not provide it, we may be unable to accept your order, process payment, arrange delivery, provide certain account functions or otherwise provide the requested service.
Where information is optional, we will make this clear where appropriate.
4. Special Category Personal Data
Certain information is given additional protection under UK GDPR and is known as special category data.
This includes information concerning health.
TheSafeHive does not normally request health or medical information through general contact forms, reviews, product nominations or customer accounts.
However, a customer may voluntarily mention information relating to matters such as:
- allergies;
- sensitivities;
- medical conditions;
- reactions to ingredients; or
- other health-related concerns.
You should avoid providing health or other special category data through general enquiries unless it is genuinely necessary.
We will not assume that voluntarily providing health information automatically constitutes explicit consent.
Where processing of special category data is necessary, we will only process it where both:
- an appropriate lawful basis under Article 6 UK GDPR applies; and
- an appropriate condition under Article 9 UK GDPR applies.
Where we rely on explicit consent, we will seek a clear and specific statement of consent.
Health information will not be used by TheSafeHive for unrelated marketing or advertising purposes.
Where special category information is unnecessary, we may delete, minimise or restrict it.
5. How We Collect Personal Data
Directly from You
For example when you:
- place an order;
- create an account;
- contact us;
- submit a form;
- request a refund or return;
- submit a review;
- subscribe to marketing; or
- exercise your privacy rights.
Automatically
Information may be collected through:
- cookies;
- server logs;
- website analytics;
- Shopify;
- security systems; and
- similar technologies.
From Service Providers and Integrated Services
We may receive information from organisations supporting our store, including:
- Shopify;
- payment providers;
- Judge.me;
- Royal Mail and delivery services;
- fraud-prevention or security services;
- analytics providers; and
- other applications connected to our store.
6. How and Why We Use Personal Data
We only process personal data where we have an appropriate purpose and lawful basis.
6.1 Processing Orders
We process personal data to:
- accept orders;
- process transactions;
- confirm purchases;
- provide order updates;
- manage customer accounts;
- prepare and dispatch orders;
- provide delivery tracking;
- process returns;
- issue refunds; and
- deal with order-related enquiries.
Lawful basis: Performance of a contract with you, or taking steps at your request before entering into a contract.
6.2 Customer Support and Enquiries
We process personal data to:
- answer questions;
- respond to support requests;
- manage complaints;
- resolve order issues; and
- maintain appropriate correspondence records.
Lawful basis: Contract where the enquiry relates to an order or proposed purchase, and/or our legitimate interests in providing effective customer service and managing our business.
6.3 Legal, Tax and Accounting Requirements
We may process and retain information where necessary to:
- maintain accounting records;
- comply with tax requirements;
- comply with consumer protection obligations;
- respond to lawful regulatory requests; and
- comply with other legal obligations.
Lawful basis: Legal obligation.
6.4 Security and Fraud Prevention
We may process information to:
- secure our website;
- protect customer accounts;
- detect fraudulent transactions;
- investigate suspicious activity;
- prevent misuse;
- protect TheSafeHive and our customers; and
- establish or defend legal claims.
Lawful basis: Legitimate interests and, where applicable, legal obligation.
Our legitimate interest is maintaining a secure and trustworthy ecommerce service.
6.5 Website and Service Improvement
We may use appropriate information to:
- understand how our website is used;
- diagnose technical problems;
- improve navigation;
- improve customer experience;
- measure website performance; and
- develop our services.
Where non-essential cookies or similar technologies are required for this activity, they will only be used where appropriate consent has been obtained.
Lawful basis: Legitimate interests for permitted essential operational activity and consent for non-essential cookies or tracking where required.
6.6 Product Reviews
We process information submitted through product reviews to:
- publish customer feedback;
- verify reviews where appropriate;
- moderate inappropriate content;
- maintain the integrity of our review system; and
- improve customer understanding of products.
Lawful basis: Legitimate interests in operating a transparent customer-review system and, where required, consent.
6.7 Direct Marketing
Where you actively choose to receive marketing communications, including by selecting the marketing option at checkout or through another subscription mechanism, we may use your contact information to send information about TheSafeHive products, promotions, services or updates.
Where consent is required, marketing consent will be obtained separately from the purchase itself.
Choosing not to receive marketing communications will not affect your ability to place an order.
You may withdraw your marketing consent at any time by:
- using the unsubscribe link included in our marketing emails; or
- contacting us using the privacy email address provided in Section 22.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
We may retain limited suppression information after you unsubscribe so that we can respect your preference and avoid sending further marketing communications.
Transactional communications relating to purchases, payments, shipping, returns, refunds or customer-service matters are not marketing communications and may still be sent where necessary.
Lawful basis: Consent where required by applicable law.
6.8 Business and Partnership Communications
We may process information relating to suppliers, brands, professional advisers, collaborators or other business contacts.
Lawful basis: Legitimate interests in managing and developing our business relationships.
7. Legitimate Interests
Where we rely on legitimate interests, we consider:
- the purpose of the processing;
- whether the processing is necessary;
- the impact on the individual; and
- whether your rights and freedoms override our interests.
Our legitimate interests may include:
- operating and protecting our business;
- providing customer service;
- preventing fraud;
- maintaining website security;
- improving our services;
- managing business relationships; and
- establishing, exercising or defending legal rights.
You may have the right to object to processing based on legitimate interests.
8. Cookies and Similar Technologies
TheSafeHive uses cookies and similar technologies to operate our website, provide ecommerce functionality, maintain security, understand website usage and, where applicable, support analytics, personalisation and marketing.
We use Shopify's Customer Privacy cookie banner to manage cookie and tracking preferences.
8.1 Strictly Necessary Cookies
Certain cookies and similar technologies are necessary for our website and online store to function. These may support:
- shopping cart functionality;
- checkout and payment processing;
- website and account security;
- customer authentication;
- fraud prevention;
- remembering privacy preferences; and
- other essential ecommerce functionality.
Where permitted by applicable law, strictly necessary technologies may be used without prior consent.
8.2 Non-Essential Cookies
Non-essential cookies and similar technologies may be used for purposes such as:
- analytics;
- performance measurement;
- marketing;
- advertising; and
- personalisation.
Where consent is required under applicable UK privacy law, these technologies will only be used after the required consent has been obtained.
8.3 Cookie Choices
Visitors in the United Kingdom are presented with Shopify's cookie consent controls, which allow them to:
- accept applicable non-essential cookies;
- reject applicable non-essential cookies; and
- manage individual privacy preferences.
You may change your available cookie preferences using the privacy or cookie preference controls provided on our website.
Changing or withdrawing consent does not affect the lawfulness of processing carried out before the preference was changed.
For further information about cookies and similar technologies used on our website, how they operate and how you can manage your preferences, please read our Cookie Policy.
9. Relationship with Shopify
Our online store is powered by Shopify.
Shopify processes personal data in connection with activities including:
- operating our online store;
- customer accounts;
- checkout;
- order processing;
- payment functionality;
- fraud prevention;
- analytics;
- security; and
- ecommerce infrastructure.
For customer personal data processed on our instructions in connection with the Shopify services we use, TheSafeHive generally acts as the controller and Shopify acts as a processor.
For certain Shopify services or enhanced functionality, Shopify may process personal data independently as a controller.
Where this applies, Shopify's own privacy terms govern that independent processing.
More information about Shopify's processing of consumer personal data is available at: privacy.shopify.com.
10. Sharing Personal Data
We only disclose personal data where there is an appropriate reason to do so.
We may share relevant information with the following categories of recipients.
10.1 Shopify
Shopify provides the ecommerce infrastructure used to operate our store.
10.2 Payment Providers
Payment providers process transactions and may carry out payment authentication and fraud-prevention activities.
10.3 Royal Mail Click & Drop
TheSafeHive uses Royal Mail Click & Drop, integrated with Shopify, to support order fulfilment and delivery.
We may provide Royal Mail with information necessary to deliver your order, such as:
- your name;
- delivery address;
- relevant contact information; and
- parcel or tracking information.
Royal Mail may also process personal data as an independent controller for certain purposes under its own legal obligations and privacy arrangements.
10.4 Judge.me
We use Judge.me to provide and manage product-review functionality.
Judge.me may process personal data relating to reviews, reviewer verification and associated customer or order information on our behalf.
10.5 Technology and Service Providers
We may use authorised providers for:
- hosting;
- cloud services;
- website functionality;
- security;
- analytics;
- customer communications;
- fulfilment;
- marketing; and
- technical support.
10.6 Professional Advisers
We may disclose information where necessary to:
- accountants;
- lawyers;
- insurers;
- auditors; and
- other professional advisers.
10.7 Legal and Regulatory Authorities
Personal data may be disclosed where required by law, court order or a lawful request from a regulator, public authority or law-enforcement body.
We do not sell personal data.
11. International Transfers
Some of our service providers may process or store personal data outside the United Kingdom.
Where personal data is transferred internationally, we take appropriate steps to ensure that the transfer complies with applicable UK data protection law.
Depending on the circumstances, safeguards may include:
- UK adequacy regulations;
- the UK International Data Transfer Agreement;
- the UK Addendum to the EU Standard Contractual Clauses; or
- another legally recognised transfer mechanism.
You may contact us using the privacy details in Section 22 if you would like further information about safeguards applicable to a particular transfer.
12. Data Retention
We do not retain personal data for longer than reasonably necessary for the purposes for which it was collected, unless longer retention is required or permitted by law.
Our general retention approach is as follows.
Orders, Transactions, Refunds and Accounting Records
Relevant financial, order, transaction and accounting records may be retained for up to six years, or longer where required by applicable tax, accounting, legal or regulatory obligations.
Customer Account Information
Account information may be retained while your account remains active and afterwards where necessary for legal, fraud-prevention, customer-service, transaction-record or dispute-resolution purposes.
Information that is no longer necessary will be deleted or anonymised where appropriate.
Customer Enquiries
General customer enquiries may normally be retained for up to 12 months after resolution, unless a longer period is necessary for legal, complaint or dispute purposes.
Business and Partnership Communications
Relevant business communications may be retained for up to 24 months, or longer where reasonably required for an ongoing business relationship or legal obligation.
Marketing Information
Marketing subscription information may be retained until you unsubscribe or withdraw consent.
We may retain limited suppression information afterwards so that we can respect your request not to receive further marketing.
Reviews
Review information may be retained while a review remains published or while reasonably necessary to maintain the integrity of our review system, subject to applicable data protection rights.
Technical and Security Information
Technical, security and system information is retained for periods appropriate to operational, fraud-prevention and security requirements and the retention settings of the relevant systems.
Special Category Data
Any special category data that is processed will only be retained for as long as necessary for the specific lawful purpose for which it is processed.
13. Data Security
We take appropriate technical and organisational measures designed to protect personal data against:
- unauthorised access;
- loss;
- misuse;
- alteration;
- disclosure; and
- destruction.
Measures may include:
- access controls;
- secure service providers;
- authentication controls;
- data minimisation;
- encrypted transmission where appropriate;
- monitoring;
- security logging;
- appropriate staff or administrator access restrictions; and
- procedures for responding to security incidents.
No internet-based service can guarantee absolute security.
Where a personal data breach occurs, we will assess and manage it in accordance with applicable data protection law.
14. Automated Processing and Product Analysis
TheSafeHive may use structured or algorithmic systems to analyse product, ingredient and verification information.
These systems are designed to produce informational outputs about products and ingredients.
They are not designed to make solely automated decisions about individuals that produce legal or similarly significant effects.
TheSafeHive's product and ingredient information does not constitute:
- medical advice;
- diagnosis;
- treatment advice; or
- personalised health advice.
Certain ecommerce services may use browsing, purchase or interaction information to provide recommendations, analytics or personalisation.
Where cookies or similar technologies require consent for these activities, we will seek consent as required.
15. Your Data Protection Rights
Depending on the circumstances and the applicable lawful basis, UK data protection law may give you the following rights.
Right of Access
You may request confirmation of whether we process your personal data and request a copy of relevant personal data.
Right to Rectification
You may ask us to correct inaccurate personal data or complete information that is incomplete.
Right to Erasure
You may ask us to delete personal data in certain circumstances.
Further information is provided in Section 16.
Right to Restriction
You may ask us to restrict processing in circumstances provided by law.
Right to Data Portability
Where applicable, you may request personal data you provided to us in a structured, commonly used and machine-readable format and may have the right to request transmission to another organisation.
Right to Object
You may object to processing based on our legitimate interests in certain circumstances.
You have the right to object at any time to the processing of your personal data for direct marketing purposes.
If you object to direct marketing, we will stop using your personal data for that purpose.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw your consent at any time.
Withdrawal does not affect processing carried out lawfully before consent was withdrawn.
Rights Relating to Automated Decision-Making
Where applicable, you may have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.
TheSafeHive does not currently use such automated decision-making for customers.
16. Right to Erasure and Deletion of Personal Data
Under Article 17 UK GDPR, you have the right in certain circumstances to request deletion of personal data held about you.
This is sometimes referred to as the right to erasure or the right to be forgotten.
The right to erasure is not absolute.
16.1 When You May Request Deletion
You may request deletion where, for example:
- the information is no longer necessary for the purpose for which it was collected;
- you withdraw consent and there is no other lawful basis for continuing the processing;
- you successfully object to processing based on legitimate interests;
- you object to direct marketing;
- the information has been unlawfully processed; or
- deletion is required to comply with a legal obligation.
16.2 How to Request Deletion
You may request deletion by:
- emailing us using the privacy email address provided in Section 22; or
- using the official contact form available on our website.
You do not need to use specific legal wording or a particular form to submit an erasure request.
16.3 Identity Verification
We may request information reasonably necessary to confirm your identity before acting on a request.
We will only request information that is proportionate to the verification required.
16.4 Response Time
We will respond to a valid data protection request without undue delay and normally within one calendar month.
Where permitted by law, the response period may be extended by up to a further two months where a request is particularly complex or where multiple requests have been submitted.
If an extension is required, we will inform you within the initial one-month period and explain why.
16.5 Shopify Customer Data
TheSafeHive handles customer deletion requests relating to our Shopify store.
Where appropriate, we may use Shopify's privacy and customer-data tools to delete or redact personal information associated with your customer record.
Deletion of a customer profile does not necessarily result in immediate deletion of all records associated with previous transactions.
Certain order, payment, refund, accounting or legal records may need to remain available for statutory or legitimate purposes.
16.6 Information We May Need to Retain
We may continue to retain certain personal data where necessary:
- to comply with tax or accounting requirements;
- to maintain records required by law;
- for fraud prevention and security;
- for the establishment, exercise or defence of legal claims;
- to resolve disputes;
- to demonstrate compliance;
- to maintain limited marketing suppression records; or
- where another legal exemption applies.
Certain transaction, accounting, order and refund records may therefore be retained for up to six years, or longer where legally required.
Where information must be retained, we will limit its use to the purposes for which continued retention is necessary.
16.7 Judge.me Reviews
If your deletion request relates to personal information connected with a Judge.me product review, we will take appropriate steps to address the relevant personal data.
Depending on the circumstances, this may include:
- deleting personal identifiers associated with the review;
- anonymising the review;
- removing the review; or
- instructing Judge.me to process relevant deletion or anonymisation steps.
16.8 Royal Mail and Delivery Data
Where personal data has already been provided to Royal Mail or another delivery provider to fulfil an order, we will take appropriate steps in relation to a valid erasure request where we are legally required and able to do so.
However, delivery providers may independently be required to retain certain information to comply with their own legal, security or operational obligations.
16.9 Other Recipients
Where personal data covered by a valid erasure request has been disclosed to processors or other recipients, we will take appropriate steps to inform relevant recipients of the erasure where required by law, unless this is impossible or involves disproportionate effort.
16.10 Backups
Personal data may remain temporarily within secure backup systems after deletion from active systems where immediate deletion is not technically possible.
Where applicable, such information will be placed beyond normal operational use and will not be used for unrelated purposes before being securely overwritten or deleted according to the relevant retention cycle.
16.11 When We May Refuse a Request
We may refuse all or part of an erasure request where the law permits us to do so.
For example, deletion may not be required where continued processing is necessary:
- to comply with a legal obligation;
- for the establishment, exercise or defence of legal claims; or
- where another statutory exemption applies.
We may also take permitted measures in relation to requests that are manifestly unfounded or excessive.
Where we refuse or partially refuse a request, we will explain our decision where required by law and inform you of your applicable complaint rights.
Requests to exercise data protection rights are normally handled free of charge.
17. Exercising Your Rights
To exercise any of your data protection rights, contact us using the privacy email address in Section 22 or use the official contact form available on our website.
Please provide sufficient information for us to understand your request.
We may need to verify your identity before releasing, correcting, restricting or deleting personal information.
Where permitted by applicable law, you may authorise another person to submit a data protection request on your behalf.
We may require reasonable evidence that the person has authority to act for you and may also ask you to verify your identity directly with us.
We will normally respond within the period required by applicable data protection law.
18. Data Protection Complaints
If you have concerns about the way TheSafeHive has collected, used, stored, disclosed or otherwise processed your personal data, you may submit a data protection complaint to us.
You can do this using the privacy email address provided in Section 22 or through the official contact form on our website.
We will:
- provide a clear route for submitting data protection complaints;
- acknowledge receipt of a data protection complaint within 30 days;
- investigate the complaint appropriately and without undue delay; and
- inform you of the outcome of our investigation.
If you remain dissatisfied, you have the right to complain to the UK's supervisory authority:
Information Commissioner's Office (ICO)
Website:
www.ico.org.uk
You may also have the right to seek a judicial remedy.
19. Children's Privacy
TheSafeHive's online retail service is intended for customers aged 18 or over.
We do not knowingly seek to collect personal data from children for the purpose of providing customer accounts or online purchases.
If we become aware that personal data has been collected from a child in circumstances where it should not have been collected, we will take appropriate steps to delete or otherwise address that information.
If you believe a child has provided personal data to TheSafeHive, please contact us using the privacy contact details in Section 22.
20. Third-Party Websites and Services
Our website may contain links to websites, social media platforms or services operated by third parties.
Those organisations may process personal data independently under their own privacy policies.
TheSafeHive is not responsible for the privacy practices, content or security of third-party websites that we do not control.
We recommend reviewing the relevant privacy information before providing personal information to an external service.
21. Changes to This Privacy Policy
We may update, amend or replace this Privacy Policy from time to time to reflect changes in:
- applicable laws or regulatory guidance;
- our products or services;
- our ecommerce functionality;
- the technologies we use;
- our service providers;
- our data-processing activities;
- our security practices; or
- our business operations.
Whenever we update this Privacy Policy, we will revise the “Last updated” date shown at the beginning of the Policy.
The updated Privacy Policy will apply from the date stated in the revised version.
Where changes are material and applicable law requires additional notice or consent, we will take appropriate steps to provide that notice or obtain the required consent.
We encourage you to review this Privacy Policy periodically so that you remain informed about how TheSafeHive processes and protects personal data.
The most recent version will always be available through our website.
22. Contact & Company Information
This section contains our legal entity and privacy contact information so that these details do not need to be repeated throughout this Privacy Policy.
You can contact us about:
- this Privacy Policy;
- personal data we hold about you;
- access requests;
- correction requests;
- deletion or erasure requests;
- restriction or objection requests;
- marketing preferences;
- cookie or privacy questions;
- data protection complaints; or
- any other privacy-related matter.
Trading name: TheSafeHive
Legal entity: THESAFEHIVE LTD
Company number: 16830170
Registered in: England and Wales
Website:
www.thesafehive.com
Privacy email:
privacy@thesafehive.com
Registered office:
124 City Road
London
England
EC1V 2NX
You may also contact us through the official contact form available on our website.