Privacy Notice

1. Who we are

The legal business identified in our store settings, trading as AW1CREAM or AW1 Cream, is the controller of the personal information described in this notice.

• Trading name: AW1CREAM
• Address: Harvey House, Havenwood, Wembley, HA9 9AS, United Kingdom
• Email: aw1@aw1cream.com
• Telephone / WhatsApp: +44 (0) 7566 868 440

2. Information we collect

Depending on how you use the website, we may collect:

Identity and contact information

• name;
• email address;
• telephone number;
• WhatsApp number where voluntarily provided;
• billing address;
• delivery address.

Account information

• user identifier;
• email-verification status;
• authentication and security events;
• account preferences;
• saved addresses;
• password-change timestamps.

We do not have access to your readable password.

Order and transaction information

• products ordered;
• quantities and variants;
• prices, discounts, currency and delivery charges;
• order status;
• payment status;
• refund status;
• invoice and credit-note records;
• delivery and tracking information.

AW1 Cream does not store complete payment-card details. Stripe or another displayed payment provider processes payment information.

Communications and support information

• contact-form submissions;
• emails and messages;
• order-support history;
• complaint and return information;
• delivery enquiries;
• account-support information.

Please do not send unnecessary medical or highly sensitive information through general support forms.

Reviews and submitted content

• review text;
• rating;
• product association;
• photographs or videos where supplied;
• publication permission;
• order-verification status.

Consent and preference information

• marketing choices;
• WhatsApp service-update choice;
• WhatsApp marketing choice;
• cookie preferences;
• date, wording version and source of consent or withdrawal.

Device, usage and security information

• IP address;
• browser and device information;
• session and security identifiers;
• necessary cookie data;
• fraud-prevention signals;
• server and audit logs;
• analytics data where the relevant consent is given.

3. How we collect information

We collect information directly from you; when you create or use an account; when you place or manage an order; when you contact us; when you submit a review; through necessary website technologies; through consented analytics or marketing technologies; and from payment, delivery, fraud-prevention or service providers where necessary to provide the service.

4. Why we use information and lawful bases

To provide products and fulfil orders

This includes processing an order, taking or reconciling payment, arranging delivery, managing backorders, providing order updates, and handling cancellations, returns and refunds.

Lawful basis: performance of a contract or steps requested before entering a contract.

To operate customer accounts

This includes registration, email verification, password reset, account security, order history and saved preferences.

Lawful basis: contract and legitimate interests in providing and securing the service.

To provide customer support

Answering enquiries, resolving complaints, handling returns, assisting with delivery or account issues.

Lawful basis: contract, legitimate interests and legal obligations where applicable.

To comply with law

Tax and accounting records, consumer-law obligations, product-safety records, responding to lawful requests, fraud and crime prevention, and legal claims.

Lawful basis: legal obligation and legitimate interests.

To secure the website and prevent misuse

Access control, authentication, fraud detection, audit logging, rate limiting and investigating suspicious activity.

Lawful basis: legitimate interests in protecting customers, the business and the service, and legal obligation where applicable.

To measure and improve the website

Non-essential analytics operate only after the relevant consent where required.

Lawful basis: consent for consent-gated analytics; legitimate interests only where a technology is legally exempt and appropriately assessed.

To send marketing

Email or WhatsApp marketing is sent only where you have consented, or the limited existing-customer soft opt-in lawfully applies. Every marketing message provides a clear opt-out.

Lawful basis: consent or legitimate interests where the lawful soft opt-in requirements are met. Marketing is not required to place an order.

To publish reviews or customer media

We publish customer content only where the appropriate permission and moderation requirements are satisfied.

Lawful basis: consent and legitimate interests, depending on the content and publication arrangement.

5. WhatsApp

WhatsApp service messages and WhatsApp marketing are separate choices. If you choose WhatsApp communication, information may also be processed by WhatsApp or Meta under their own terms and privacy information. Declining WhatsApp marketing does not prevent you from placing an order. Operational order messages are not marketing consent.

6. Marketing choices

Marketing options are separate, clear, unticked by default, and recorded with date, source and wording version. You may unsubscribe through the link in an email, by replying or using the stated WhatsApp opt-out method, through account preferences, or by contacting us. Withdrawing consent does not affect processing that was lawful before withdrawal. We may retain a minimal suppression record so that we continue to respect an opt-out.

7. Who we share information with

We may share only the information necessary with:

• Stripe and authorised payment providers;
• Lovable and Supabase as the configured hosting, database and authentication providers;
• email and notification providers;
• Royal Mail, UPS and configured delivery providers;
• fraud-prevention and security providers;
• consented analytics providers;
• accountants, insurers, legal advisers and other professional advisers;
• regulators, courts, law enforcement or public authorities where required;
• service providers operating under contract and our instructions;
• a purchaser or successor in connection with a lawful business restructuring, subject to appropriate safeguards.

We do not sell personal information.

8. International processing

Some service providers may process personal information outside the United Kingdom. Where a restricted international transfer occurs, we use an applicable legal mechanism and safeguards, which may include adequacy regulations, an approved international data transfer agreement, an approved addendum to standard contractual clauses, or another lawful safeguard or exception. Contact us for more information about applicable safeguards.

9. Retention

We retain personal information only for as long as reasonably necessary for the purpose collected, legal and accounting requirements, fraud prevention, product-safety obligations, complaint and legal-claim periods, and customer-requested account services.

Our internal retention schedule distinguishes orders, payments, refunds, invoices and accounting records; customer accounts; support and complaint records; returns and product-safety reports; marketing consent and suppression records; reviews and publication permissions; abandoned carts; security and audit logs; and cookie-consent records. Closing an account does not require deletion of records that must or may lawfully be retained.

10. Security

We use measures designed to protect personal information, including encrypted connections, access controls, role-based permissions, secure authentication, audit logging, rate limiting, restricted administrative access, reputable service providers and incident-response procedures. No internet or storage system can be guaranteed completely secure.

11. Your rights

Depending on the circumstances and lawful basis, you may have the right to request access to your personal information; request correction of inaccurate information; request erasure; request restriction; object to processing; request data portability; withdraw consent; and object to direct marketing at any time.

Some rights are subject to legal conditions and exemptions. We may need to verify your identity before responding. You will not normally be charged for exercising a right.

12. Right to object to marketing

13. Automated processing

Payment, fraud-prevention or security providers may use automated signals to assess transactions or suspicious activity. AW1 Cream does not currently make solely automated decisions with legal or similarly significant effects.

14. Children

The website and checkout are directed to adults. A product that may be used by a child does not mean that a child should create an account, submit personal information or place an order.

15. Complaints

Contact us first so that we can try to resolve a privacy concern. You may also complain to the UK Information Commissioner’s Office — the current contact details are on the ICO website.

16. Changes to this notice

We may update this notice to reflect changes in the website, service providers, legal requirements or processing activities. The current version and effective date are shown on this page. Where a material change requires notification or renewed consent, we will follow the appropriate process.

17. Contact

Privacy enquiries and rights requests:

• Email: aw1@aw1cream.com
• Address: Harvey House, Havenwood, Wembley, HA9 9AS, United Kingdom
• Telephone / WhatsApp: +44 (0) 7566 868 440

Include the type of request you wish to make (access, correction, deletion, restriction, objection, portability, withdraw consent, complaint, or other) and any information that will help us verify your identity. We will not confirm whether a particular email address has an account.