Privacy Notice
1. Introduction
At Iconic London we are committed to protecting your personal data and respecting your privacy. We believe that being transparent about how, when, and why we handle your personal data is the best way to do this.
This Privacy Notice sets out the basis on which we will collect, process and safeguard any personal data about you when you use our website (the “Website”), it also sets out your rights in relation to your personal data and how to contact us if you have any concerns about how we are using your personal data.
This Privacy Notice specifically applies to you if you are based in either the UK or EEA, for further information about our US privacy practices, please refer to our US Privacy Policy.
The website is not intended for use by children under 18, and we do not knowingly collect or process data regarding children.
By using our websites, signing up to our newsletter or loyalty programme, or taking part in our promotions and social media activities, you acknowledge that you have read and understood this Privacy Notice.
2. Who are we?
This Website is operated by Iconic London (Holdings) Limited, registered in England and Wales under company number 05014226, with a registered address at Iconic London C/o Browne Jacobson LLP, 15th Floor, 6 Bevis Marks, London EC3A 7BA.
Any references in this Privacy Notice to “Iconic London”, “us”, “we”, or “our” refer to the relevant data controller as detailed below. Any references to “you”, or “your” refer to the data subject.
Data Controller
Iconic London, is the data controller of your personal data. This means that we are responsible for deciding how and why we hold and use personal data about you. As well as ensuring that appropriate measures are taken to protect your data.
Our services may involve or be provided in conjunction with services offered by third party organisations who act as independent data controllers in respect of your personal data (e.g. third-party platform providers or marketplaces). Where this is the case, those third-party organisations will be responsible for processing your personal data and such processing will be governed by their own privacy notices rather than this one. If you have any questions about how a third-party controller processes your personal data, you should contact that organisation directly using the contact details set out in their privacy notice.
Contact Details
If you have any questions about this Privacy Notice or how we handle your personal, please contact us via email at dataprivacy@IconicLondonInc.co.uk.
Data Protection Officer
If you would like to contact our Data Protection Officer, please contact us via email by emailing us at dataprivacy@IconicLondonInc.co.uk, marked, “For the attention of the DPO”.
3. Personal Data We Collect from You Directly
Depending on how you interact with us, we may collect various types of personal data about you directly when you:
- use the Website
- create or update your user account,
- join our loyalty programme,
- buy products or gift cards from our online shop,
- enquire about our products via our Website,
- contact customer services or send other communications to us via the Gorgias AI Agent.
- register for our newsletter and/ or SMS updates,
- engage with our marketing and advertising, including interactions with third-party platforms
- engage with our social media pages, subject to your own settings
4. Personal Data We Collect from you Indirectly
We may also collect personal data about you automatically using cookies and similar tracking technologies when you browse our Website or utilise certain functions on our Website such as logging into your user account or purchasing products via our online shop. Please refer to our [Cookie Notice] for full details.
5. Bases for Processing Your Data
At Iconic London, we use your personal data for a range of purposes, including to provide information you have requested, to enter into and perform contracts with you, to operate and improve our website, and to send you information relating to products you have ordered.
We may collect and use your personal for one of the following bases:
Your consent: you have consented to the processing of your personal data. Consent may be withdrawn at any time by contacting dataprivacy@IconicLondonInc.co.uk.
Our legitimate interests: we may also process your personal data to provide you with information about our products, services, and any offers that you may be interested in.
Our contract with you: if you have made an enquiry about our products, or bought a product, then it is necessary to process your personal data for the performance of our contract with you.
Our legal obligation: in certain circumstances in order to comply with a legal obligation or request from the relevant UK authorities, then we will process data to fulfil this obligation.
The table below summarises the categories of personal data we process, the purposes for which we use it, and the legal bases we rely on. You can contact us for more information about this at dataprivacy@IconicLondonInc.co.uk.
| Data Category | Type of Data We May Use | Legal Basis and Why We Use Your Data |
|---|---|---|
| Personal Data & Identifiers | ||
| Identity & Contact Details | Name, email address, postal address, telephone number | Consent: Where you have chosen to receive marketing communications or participate in optional services. |
| Legitimate Interests: To manage customer accounts, prevent fraud, maintain account security and provide customer support. | ||
| Contract: To create and manage your account, process orders and provide the products and services you have requested. | ||
| Optional Additional Demographic Information | Age, gender, other optional demographic information that is not considered ‘sensitive’ | Consent: Where you choose to provide optional information to support personalisation, loyalty programme features or marketing activities. |
| Legitimate Interests: To better understand customer preferences, improve products and services, and provide a more relevant customer experience. | ||
| Order and Delivery | Name, address, order details, recipient message | Consent: Where you choose to include optional information such as gift messages or delivery instructions. |
| Contract: To process orders, arrange delivery, manage payments and provide the products you have purchased. | ||
| Makeup and Beauty Type & Skin Information | Skin tone, hair/eye colour, preferences, health information such as allergies, sensitivities, reactions | Consent: Where you choose to provide information to receive personalised recommendations, virtual consultations or tailored content. |
| Legitimate Interests: To improve our products, services and customer experience by understanding customer preferences and needs. | ||
| Legal Obligation: To investigate and manage product safety concerns, adverse reactions, complaints and other regulatory requirements. | ||
| Financial and Transactional Data | ||
| Financial Details | Purchases, payment method, billing details, order history, refunds, returns, discounts | Legitimate Interests: To conduct financial reporting, business analysis, fraud prevention, auditing, and to improve our products, services and business operations. |
| Contract: To process payments, administer refunds and returns, fulfil customer orders, and provide the products and services you have purchased. | ||
| Legal Obligation: To comply with applicable legal, tax, accounting, financial reporting and regulatory requirements. | ||
| Transactional Details | Purchases, product sales and returns, lifetime orders, discounts used | Legitimate Interests: To analyse sales performance, customer purchasing trends, product demand and other key business metrics, enabling us to improve our products, services and commercial operations. |
| Contextual Data | ||
| Technical and Usage | IP address, device IDs, cookie IDs, browser and operating system, browser logs, user and session data, language, referrer, usage | Consent: Where you have provided consent for the use of cookies, similar technologies or other optional tracking tools used to personalise your experience or analyse website usage. |
| Legitimate Interests: To maintain the security, functionality and performance of our websites and services, prevent fraud and unauthorised activity, understand how our services are used, and improve the customer experience. | ||
| Legal Obligation: To comply with legal requirements, regulatory obligations, court orders or lawful requests from public authorities, regulators or law enforcement agencies. | ||
| Location | Approximate location via IP address | Consent: Where you have consented to the use of location-related technologies, such as certain cookies or similar technologies. |
| Legitimate Interests: To identify the appropriate regional store or website, prevent fraudulent activity, improve website functionality and understand customer usage patterns. | ||
| Customer Services | Emails, web chat, SMS/WhatsApp, records of correspondence | Contract: To respond to enquiries relating to your orders, account or the products and services you have requested. |
| Contract: To respond to enquiries relating to your orders, account or the products and services you have requested. | ||
| Marketing and Advertising | ||
| Marketing & Communications | Contact details, communication preferences, purchase and browsing activity and history, loyalty programme tier | Consent: Where you have consented to receive marketing communications, personalised offers, recommendations, event invitations or other promotional content. Consent may be withdrawn at any time. |
| Legitimate Interests: To promote our products and services to existing customers, improve the relevance of our communications, understand customer preferences and measure the effectiveness of our marketing activities where permitted by applicable law. | ||
| Contract: To provide loyalty programme benefits, rewards, account-related communications and other services that form part of the products or services you have requested. | ||
| Survey and Feedback | Survey responses, product reviews and ratings | Consent: Where you choose to participate in surveys, submit product reviews, ratings or other feedback. |
| Legitimate Interests: To understand customer satisfaction, improve our products and services, identify areas for improvement, and enhance the customer experience. | ||
| Advertising & Cross-Device Tracking | Email address, device IDs, hashed identifiers, browsing history | Consent: Where you have consented to the use of advertising cookies, tracking technologies or similar tools that enable personalised advertising, audience measurement, attribution and cross-device recognition. |
| Social Media | ||
| Social media and Public Profile | Handles, profile information, public posts and interactions with our brand accounts. | Legitimate Interests: To engage with customers and members of the public through social media platforms, respond to enquiries and complaints, understand customer sentiment, protect our brand and improve our products, services and customer experience. |
| Consent: Where you choose to interact with us through social media campaigns, competitions, promotions or other activities that require your consent, or where consent is otherwise required by law. | ||
| User-Generated Content | Reviews, photos, videos, comments | Consent: Where you provide reviews, photographs, videos, testimonials, comments or other content for publication, marketing activities or promotional purposes. Consent may be withdrawn where applicable. |
| Legitimate Interests: To publish and manage customer reviews and other user-generated content, improve our products and services, understand customer experiences, and enhance the authenticity and relevance of our websites, social media channels and marketing materials. | ||
| Behavioural and AI Tools and Technologies | ||
| Behavioural | Behavioural user profiles, wish lists, product searches | Legitimate Interests: To understand customer preferences, interests and purchasing behaviours, personalise customer experiences, improve our products and services, support new product development, measure business performance and deliver relevant marketing communications where permitted by applicable law. |
| AI Tools | Messages or prompts, including text and images submitted to AI tools, outputs, records of AI conversations | Consent: Where you choose to interact with AI-powered features or where consent is required by law, including where personal data is used for personalised marketing, recommendations or analytics based on your consent preferences |
| Legitimate Interests: To operate, maintain and improve AI-powered services, support customer service activities, provide product recommendations, personalise customer experiences, analyse customer enquiries, improve the accuracy and effectiveness of our products and services, and monitor the quality and performance of AI-assisted interactions. | ||
| AI Analytics and Profiling | Order history from customer accounts, marketing interactions, | Legitimate Interests: To improve our understanding of our customers by analysing customer behaviour, preferences and purchasing patterns, and creating customer segments, optimise marketing campaigns by personalising content and product recommendations, develop and improve products and services, and measure and evaluate the effectiveness of marketing and commercial activities. |
6. Special Category and Sensitive Personal Data
We may collect and use certain types of data that is classified as special category or sensitive personal data by data protection laws. This is strictly limited to instances where we have obtained your explicit consent, or where we must comply with legal obligations, such as product safety reporting.
7. Use of AI and Automated Decision Making
We may offer AI-enabled features, specifically an AI agent chatbot on our website, to help you interact with our services more efficiently. The chatbot can help you by answering questions, providing information about products, and acting as a first line response for customer service and care queries.
When you use the chatbot, we may process the information you choose to provide in your messages and prompts, together with related interaction data, such as date, time, device, and session identifiers, in order to provide access to the feature, improve our services and maintain security.
At any time when using the chatbot, you may request to speak with a human agent instead by typing this request into the chat box. A human agent will respond at their next availability during normal business hours.
We may use AI powered technologies and analytics tools to analyse customer activity, purchasing behaviour and preferences, create customer segments, personalise communications and recommendations, and improve the effectiveness of our marketing activities.
Iconic London does not use AI to make solely automated decisions about you that produce legal or similarly significant effects.
8. Sharing Your Personal Data with Third Parties
We do not share your personal data with third parties for their own direct marketing purposes.
We do share information with third parties who carry out tasks on our behalf, including the following:
- Iconic London group companies: we are part of the Nitumen Group of Companies owned by Blue Gem II LP, we may transfer your personal data within our group for the purposes described in this Privacy Notice, such as to support administrative functions, internal reporting and to ensure a consistent service across our global operations.
- Service providers: we engage third parties to process personal data on our behalf in order to operate our online store, fulfil and deliver goods, carry out analytics, send email and SMS marketing, host software and systems. These providers are contractually required to process personal data on our instruction, to ensure appropriate safety measures are in place, and maintain confidentiality and security of data.
- Fraud prevention providers, security partners and law enforcement authorities: we may also share personal data such as transaction and order information in order to detect, prevent, or investigate fraud or criminal activity.
- With regulators, law enforcement and public authorities: we may disclose personal data where required to do so by law, regulation or valid request from a recognised authority.
- Mergers and acquisitions: in connection with such transactions, including any related due diligence, we may share aggregated sales data, or provide limited access to systems containing your data, subject to appropriate confidentiality obligations, safeguards and access controls.
- With our auditors and professional advisers: we may share aggregated, anonymised, or where necessary limited personal data, subject to appropriate safeguards and confidentiality obligations.
9. International Transfers of Your Personal Data
To support our global operations, some of our service providers are located outside of the UK and EEA, which means that your data may be transferred to, and processed in, countries other than the country in which you are located.
When your personal data is transferred outside the UK or EEA, it will only be transferred to countries that have been identified as providing adequate protection for UK or EEA data (Adequate Territory) or, alternatively, to a country which is not considered an Adequate Territory, using an appropriate compliance mechanism as is required by applicable law.
When your data is transferred to a company operating in a country which is not an Adequate Territory, we will ensure the processing company has appropriate compliant transfer mechanisms in place to protect your personal data.
10. Security and Retention of Personal Data
We will keep your personal data for as long as necessary for the purposes described within this Privacy Notice, including to provide services and comply with legal or regulatory requirements.
If you are a customer of our business, we will retain any information you provide for as long as is necessary to fulfil our contractual commitments to you, and thereafter as required for record keeping purposes, usually six years after the end of the financial year in which the transaction took place.
If you have signed up for direct marketing, or joined our loyalty programme, or otherwise indicated that you wish to receive our direct marketing, we will keep data used for marketing to you until you unsubscribe.
Whilst we retain your personal data, we take appropriate technical and organisational security measures to protect it from unauthorised access, misuse, loss or accidental disclosure. We review and update our security measures on an ongoing basis to ensure the continued protection of your personal data.
11. Your Rights
We will process all personal data in line with your rights, in each case to the extent required by and in accordance with applicable law only, including in accordance with any applicable time limits, required fees, or charges.
You have the following rights in relation to your personal data, subject to any exceptions and limitations as laid out in applicable law:
- Right to be informed: we must provide you with clear, transparent and easy to understand information about how we use your personal data.
- Right of access: you may request that we confirm whether we are storing or processing your personal data. In the case where we are, you have the right to request that we provide you with a record, and a copy, of your personal data and other information to which you are entitled.
- Right to rectification: we will correct any inaccurate personal data and complete any incomplete personal data that we hold about you, at your request.
- Right to erasure: we will erase your personal data, at your request, without any undue delay, unless we are compelled not to by a legal requirement.
- Right to restrict processing: you may request that we restrict the processing of your personal data for a specific purpose, for a certain period of time.
- Right to data portability: we will provide you, or a third party on your behalf, with a copy of any personal data that we hold about you which you have provided to us, in a structured, commonly used and machine readable format.
- Right to object: you have the right to object to your personal data being processed by us in certain circumstances, as well as the absolute right to stop your personal data being used for direct marketing
- Right to withdraw consent: you may withdraw any consent you have given to us at any time where we process your personal data on the basis of consent (and not on another legal basis).
- Right to complain: you have the right to make a complaint with the relevant supervisory authority in your country of residence, or the country of the data controller.
To exercise any of these rights, please contact us by email at dataprivacy@iconiclondoninc.co.uk. We will require proof of your identity and full details of your request in order to process it.
12. Complaints
If you have any complaints regarding this Privacy Notice that you feel have not been resolved by talking to us, you have the right to make a complaint to the relevant data protection supervisory authority of the country in which you are located.
If you are based in the UK, you can contact the UK Information Commissioner at telephone number 0303 123 1113 or https://ico.org.uk/.
If you are based in the EEA, you can find details of the relevant supervisory authority here https://www.edpb.europa.eu/about-edpb/our-members_en
Our complaints form can be found here: Contact Us.
13. Cookies
Our website uses cookies and other tracking technologies which are placed and stored on your computer hard drive or in the browser memory, when you visit our Website. Certain cookies are necessary and essential for the operation and normal use of our website, whilst others are not necessary but will enhance your user experience whilst visiting the website.
We use technical information gathered in this way for site management and security purposes and for:
- improving our website and ensuring that content is presented effectively,
- managing our website and ensuring that it is safe and secure,
- administering our website and for internal operations, troubleshooting, data analysis, testing, research, statistical and survey purposes.
You can find out more about what cookies we use and how to switch them off by referring to our Cookies Notice.
14. Updates and Changes to Our Privacy Policy
We reserve the right to modify this Privacy Notice from time to time as required to reflect changes to the business or where relevant law is updated. You should check back frequently to see any updates or changes to our Privacy Notice. This version was last updated on 14/09/2026.