Calton Brown Ltd, Company No. 17230415, trading as Calton Brown London. Registered office: 75 Shelton Street, Covent Garden, London WC2H 9JQ. Effective 1 October 2026.
This policy explains how we collect and use personal information when you visit caltonbrown.com, place an order, create an account, contact us, subscribe to marketing, or submit a review. It is written to be read. If a point is unclear, ask us.
At a glance
| Who is responsible | Calton Brown Ltd |
| What we use your data for | Taking and delivering orders, payments, returns, support, fraud prevention, advertising, and marketing where you have agreed |
| Advertising | We use the Meta Pixel and Google tags. We ask for consent first in the UK, EU and wherever the law requires it, and you can switch personalised adverts off at any time |
| We do not | Sell your personal information for money, or store your full card number |
| Your rights | Access, correction, deletion, objection, restriction, portability, and withdrawing consent |
| Privacy requests | info@caltonbrown.com, subject line “Privacy request” |
1. Who we are
1.1 Calton Brown Ltd is the controller of the personal information described in this policy. We are registered in England and Wales, Company No. 17230415, at 75 Shelton Street, Covent Garden, London WC2H 9JQ.
1.2 We process personal information in line with the UK GDPR and the Data Protection Act 2018. Where we sell to customers in the European Union we also respect the EU GDPR, and for customers in South Africa we respect the Protection of Personal Information Act (POPIA).
1.3 To contact us about your information, email info@caltonbrown.com with the subject line “Privacy request”.
2. What we collect and where it comes from
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, email address, telephone number, billing and delivery address | You, when you order, register, subscribe or contact us |
| Order and transaction | Items ordered, amounts, discount codes, delivery choices, returns and refunds, last four digits and type of card | You, and our payment provider |
| Payment details | Card and wallet details | You, direct to the payment provider. We do not see or store your full card number |
| Customs information | Recipient tax or identification number where a country requires it | You, when the carrier or customs asks for it |
| Communications | Emails and messages to us, complaints, photographs you send us with a claim | You |
| Marketing preferences | Subscriptions, opt outs, email engagement such as opens and clicks | You, and our email platform |
| Reviews and content | Review text, rating, any photographs you submit | You |
| Device and usage | IP address, browser, device type, pages viewed, products viewed, referral source, cookie and similar data, including data collected by the Meta Pixel and Google tags | Your device, through cookies and similar technologies |
| Fraud and security | Risk signals about an order, address and payment matching, IP location | Our commerce platform and payment provider |
We do not knowingly collect special category data, such as health information or beliefs, and we ask you not to send it to us.
3. How and why we use it
| Purpose | Lawful basis |
|---|---|
| Process your order, take payment, arrange delivery and handle duties and customs | Contract |
| Handle returns, refunds, faults and customer service | Contract, and legitimate interests in resolving issues |
| Send order and delivery messages | Contract |
| Prevent fraud, abuse and chargeback misuse, and secure the website | Legitimate interests in protecting our business and customers, and legal obligation |
| Keep accounting, tax and legal records | Legal obligation |
| Establish, exercise or defend legal claims and respond to disputes | Legitimate interests, and legal obligation |
| Send marketing emails | Consent, or where the law permits, our legitimate interest in marketing similar products to existing customers, with an easy opt out in every message |
| Analytics and improving the website | Consent where the law requires it, otherwise legitimate interests |
| Advertising and measuring advertising, including through the Meta Pixel and Google tags | Consent where the law requires it, including in the UK and EU. Elsewhere, our legitimate interests in promoting our products, with an easy way to opt out |
| Collect and display reviews | Legitimate interests in publishing honest customer feedback |
Where we rely on legitimate interests, we have weighed them against your rights and expectations. You may object at any time.
4. Marketing and advertising
4.1 We send marketing emails only where you have asked for them or where the law permits us to write to an existing customer about similar products. A purchase is not consent to everything.
4.2 Every marketing email contains an unsubscribe link. You can also email info@caltonbrown.com. We keep a suppression record so that we do not email you again.
4.3 Personalised advertising. We advertise on Meta platforms (Facebook and Instagram) and on Google services, using the Meta Pixel and Google tags on our website. In the UK, the EU and other places where the law requires it, we ask for your consent first. Elsewhere these tools may run, and you can opt out. Meta and Google act as independent controllers of the information they receive and use it under their own privacy notices.
4.4 Switching it off. You can turn off personalised advertising at any time through the controls on our website, your browser, your device settings, and your Meta and Google account ad settings. Our Cookie Policy sets out the steps, and our Your Privacy Choices page lets you opt out of sharing for advertising.
5. Who we share information with
We share information only as needed. Some of these act on our instructions as processors, and some are independent controllers with their own privacy notices.
| Who | Why |
|---|---|
| Shopify and Shopify Payments | Run our store, checkout, payments and fraud analysis |
| Fulfilment partner (HyperSKU) | Pick, pack and prepare your order, and handle returns |
| Carriers (DHL Express and other carriers we select) | Deliver your order and handle customs |
| Returns portal provider (Postco) | Manage return requests |
| Email provider (Klaviyo) | Send order and marketing emails |
| Review provider (Judge.me) | Collect and publish reviews |
| Advertising and analytics providers (Meta, Google) | Measure and deliver advertising and understand website use. We ask for your consent first where the law requires it |
| Creator and affiliate platform (GRIN) | Administer creator codes. We share order information needed to credit a code, and not your contact details |
| Email hosting and spam filtering providers | Run our mailboxes |
| Accountants, lawyers, insurers and auditors | Professional advice and compliance |
| Banks, card schemes and payment disputes bodies | Handle payments, refunds and chargebacks |
| Authorities, regulators and the police | Where the law requires, or to prevent crime |
We do not sell your personal information for money. Some US state laws treat sharing for targeted advertising as a “sale” or “sharing”, and our Your Privacy Choices page lets you opt out. If we sell or restructure the business, information may pass to the new owner, who must respect this policy.
6. International transfers
6.1 We and our providers operate internationally. Your information may be handled in the United Kingdom, the European Economic Area, the United States, Canada and South Africa, and in the country where your order is delivered. Some of our team and service providers are in South Africa.
6.2 Where UK or EU law restricts transfers, we use a lawful safeguard, such as an adequacy decision, the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or a certification scheme such as the UK extension to the EU US Data Privacy Framework. You can ask us for details by writing to info@caltonbrown.com.
7. Cookies and similar technologies
We use strictly necessary technologies for the basket, checkout and security. We use analytics, preference and advertising technologies where the law permits or you have consented. See our Cookie Policy.
8. How long we keep information
| Information | How long |
|---|---|
| Order, payment and tax records | 6 years from the order, to meet tax and accounting law and to deal with claims |
| Customer service messages and return records | 3 years from the last contact |
| Fraud and chargeback records | Up to 6 years |
| Marketing subscription and consent records | While you are subscribed, then a suppression record so that we honour your opt out |
| Account details | Until you ask us to close the account, subject to the records above |
| Reviews | Until you ask us to remove them or we remove them under our Terms |
| Analytics and advertising data | As set by the cookie or provider, generally no more than 14 months |
When the period ends, we delete or anonymise the information. If a legal claim is open, we keep what is needed until it ends.
9. Your rights
9.1 Depending on where you live, you may have the right to:
- be told whether we hold your information, and receive a copy;
- have inaccurate information corrected;
- ask us to delete your information, where there is no overriding reason to keep it;
- ask us to restrict how we use it;
- object to uses based on legitimate interests, and object to direct marketing and personalised advertising at any time;
- receive information you gave us in a portable format;
- withdraw consent where we rely on it, without affecting what was done before.
9.2 How to ask. Email info@caltonbrown.com with the subject line “Privacy request” and tell us what you want. We may ask you to confirm your identity. We reply within one month, and may extend this by up to two further months for a complex request, telling you why. There is no charge, unless a request is clearly unfounded or excessive. Our Data Privacy & Requests page explains the process in more detail.
10. Automated checks and fraud screening
Our commerce platform and payment provider may run automated fraud analysis that flags an order for review. We do not make a decision that has legal or similarly significant effect on you based solely on automated processing. A flagged order is reviewed by a person before we cancel it, and you may ask us to reconsider.
11. Security
We use technical and organisational measures designed to protect personal information, including encrypted connections, access controls and trusted providers. Payment details are handled by the payment provider and are not stored by us. No service is completely secure, and we ask you to protect your own account and devices.
12. Children
Our website is not directed at children. We ask that orders are placed by adults aged 18 or over, or by a parent or guardian. We do not knowingly collect personal information from children for marketing. If you believe a child has given us information, tell us and we will delete it.
13. Reviews and public content
If you publish a review, your review and display name may be visible to anyone on our website and may be shown through our review provider. Please do not include personal details you do not want shared.
14. Complaints
Please tell us first, so that we can put things right. You also have the right to complain to a supervisory authority: in the United Kingdom, the Information Commissioner’s Office (ico.org.uk); in the European Union, the data protection authority in your country; in South Africa, the Information Regulator (inforegulator.org.za).
15. Changes to this policy
We may update this policy as our processing, technology or legal duties change. The current version is on this page with its effective date. If a change is significant, we will tell you in a way that is suitable for the change.
16. Contact
Privacy requests and questions: info@caltonbrown.com (subject line “Privacy request”). Post: Calton Brown Ltd, 75 Shelton Street, Covent Garden, London WC2H 9JQ.