1. Introduction and contact details

1.1 Who we are

This Privacy Statement describes how Smell.Fit Fragrance, a sole trader trading as Smell.Fit Fragrance (“we”, “us”, or “our”), processes the personal data of our customers and website visitors. We are committed to protecting your privacy and to our obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Website: www.smellfit.co.uk / www.smell.fit

1.2 Data controller

We are the Data Controller responsible for determining the purposes and means of processing your personal data.

1.3 Contact details

For any privacy question or to exercise your rights, contact our privacy channel: gdpr@smell.fit.

1.4 Supervisory authority

You have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator. We would appreciate the chance to resolve your concern first.

2. The data we collect

We keep data collection to what we genuinely need to run the shop:

• Identity Data: name, account username and (optionally) date of birth. Date of birth is used only to award birthday loyalty points and nothing else.
• Contact Data: billing address, delivery address, email address and telephone number, for fulfilling and communicating about your order.
• Transaction Data: your orders, payments, order history, refunds, and any loyalty points, account credit or gift cards on your account.
• Financial Data: card payments are handled and tokenised by our payment provider (WooPayments, powered by Stripe). We never see or store your full card details.
• Technical Data: IP address, browser type and device information, collected automatically in routine server logs for security and troubleshooting. We do not run analytics or tracking software.
• Account & Rewards Data: your username, encrypted password, loyalty points and history, account credit, gift cards, and free-spin activity, held so the account and rewards features work.

We do not collect advertising, behavioural-tracking or cross-site profiling data, because we do not use those tools.

Children’s data

Our website is not intended for anyone under 16. We do not knowingly collect data from children, and will delete it promptly if we discover we have.

3. Why we process your data (lawful bases)

• Fulfilling your order (Identity, Contact, Transaction, Financial): performance of a contract.
• Managing your account and rewards (Identity, Contact, Account & Rewards): performance of a contract and our legitimate interest in running the loyalty scheme you signed up to.
• Service and account emails (Identity, Contact): performance of a contract and legitimate interests, to send order confirmations, dispatch notices, gift-card emails and account/points updates.
• Optional free-spin reminder emails (Identity, Contact): consent, which you switch on yourself in your account and can switch off at any time.
• Security and troubleshooting (Technical): legitimate interests, to keep the site secure and working.
• Legal and tax compliance (Transaction, Identity): legal obligation.

We do not carry out personalised advertising or profiling.

4. Who we share data with

We share the minimum necessary with a small number of service providers who act as our processors:

A. Payments

• WooPayments (Automattic / Stripe): processes your card payment securely, including wallet options such as Apple Pay or Google Pay where offered at checkout.

B. Shipping and delivery

• Royal Mail and Evri receive your name and delivery address to deliver your parcel.

C. Email delivery

• Our email delivery (SMTP) provider handles secure sending of transactional and account emails on our behalf. It is not used for advertising.

We do not use analytics, advertising or social-media processors (no Google Analytics, Google Ads, Meta/Facebook, TikTok, and no ad pixels or trackers). We do not sell or rent your data to anyone.

D. International transfers

Our payment provider (Stripe) may process data outside the UK/EEA. Where data goes to a country without UK “adequacy” status, it is protected by approved safeguards such as UK International Data Transfer Agreements (IDTAs) or Addendums to the Standard Contractual Clauses (SCCs).

E. Loyalty rewards and date of birth

Our loyalty scheme stores your points, account credit, gift cards and spin activity so the features work. If you choose to provide your date of birth, it is stored solely to automate your birthday points bonus. We never use your date of birth for marketing, profiling or analytics. Once set, your date of birth can only be changed by contacting us, which protects the birthday bonus from misuse.

5. Data security and retention

5.1 Security

We use appropriate measures to protect your data from loss, misuse or unauthorised access, and limit access to those who genuinely need it.

5.2 Retention

We keep your data only as long as needed. Transactional and financial records are kept for a minimum of six (6) years after the relevant tax year, to meet UK legal and tax duties. Account data is kept while your account is active; ask us to close it and we will delete what we are not legally required to keep.

6. Your UK GDPR rights

You have the right to:

• Access your personal data.
• Correct inaccurate data.
• Erase your data (the right to be forgotten).
• Object to or restrict processing.
• Data portability (receive or transfer your data).
• Withdraw consent at any time where we rely on it (for example, turning off free-spin reminder emails or changing your cookie choice).

To exercise any of these, email gdpr@smell.fit. We aim to respond within one month. For cookies specifically, see our Cookie Policy.