Privacy policy

This privacy notice explains how The Color collects and uses your personal information when you shop at thecolor.uk, sign up to our emails, take out a subscription, take part in our loyalty programme, leave a review or ask to book a salon appointment. It also explains your rights and how to contact us.

Last updated: 11 October 2026

Who we are

The Color is the trading name of THE COLOR (BRIDLINGTON) LIMITED, a company registered in England and Wales (company number 05612741), with its registered office at 55 Flamborough Road, Bridlington, YO15 2JH. We are the "controller" of your personal information. This means we decide how and why it is used.

We haven't appointed a data protection officer. If you have any questions about your information, please contact us using the details above.

The information we collect

Information you give us

  • When you place an order: your name, email address, phone number, delivery and billing addresses, what you order, and any notes you add. Your card details go straight to our payment providers. We never see or store your full card number.
  • If you create an account: the email address you sign in with, your saved addresses and your order history.
  • If you take out a subscription: the products you've chosen, how often you'd like them delivered, your delivery address, the payment method you've saved for future deliveries, and any skips, changes or cancellations you make.
  • When you sign up for emails: your email address, the fact that you've agreed to hear from us, and where you signed up (for example, the pop-up, the website footer or checkout). If you use our pop-up, we also ask for your name and, if you choose to give it, your mobile number.
  • If you take part in our loyalty programme, The Color Circle: your points balance and history, your tier, the reward codes you choose, your birthday (day and month only) if you add it, and your personal referral link.
  • When you leave a review or ask a question about a product: the name you choose to show, your rating, your review or question and any photos you add, plus your email address so the review can be verified or your question answered.
  • When you contact us: what you tell us by email, phone, WhatsApp or our contact form.
  • When you ask us to tell you when an item is back in stock: your email address and the item you're interested in.
  • When you ask to book a salon appointment through our website: your name, phone number, email address, the service you'd like, your preferred stylist, date and time, and any message you add.

Information collected automatically

When you visit our website, we collect some information about your device and how you use the site. This includes your IP address, browser and device type, the pages you look at, what you add to your basket and how you reached us, for example from an advert. Much of this is collected through cookies and similar technologies. We only use analytics and marketing cookies if you agree (see "Cookies and similar technologies" below).

Information from other organisations

  • Our payment providers tell us whether a payment has succeeded and share the results of their fraud checks.
  • Delivery companies tell us where your parcel is and whether it has been delivered.
  • If a friend introduces you through their Color Circle referral link, we learn who introduced you.
  • Advertising platforms give us reports on how our adverts are performing. These reports are normally aggregated and don't identify you.

You don't have to give us any information. But we need your name, contact details and delivery address to take and deliver an order, so we can't take your order without them. Everything else, such as signing up for emails, joining The Color Circle or leaving a review, is up to you.

How we use your information, and our lawful basis

Data protection law says we must have a lawful basis for each way we use your information. Here is what we do and why. "Legitimate interests" means a genuine business reason that you'd reasonably expect, and that doesn't override your rights.

Taking, delivering and supporting your order

We use your contact, delivery and order details to take payment, send your order or get it ready for Click & Collect, keep you updated, and handle cancellations, returns, refunds and complaints.

  • Lawful basis: to perform our contract with you. We also keep order and payment records because tax and company law require it (legal obligation).

Your customer account

If you create an account, we use your details to run it, including showing your order history and saved addresses.

  • Lawful basis: to perform our contract with you.

Subscriptions

If you take out a subscription, we use your details to send each delivery on time and take payment using the payment method you saved. We also email you about your subscription, for example if a payment doesn't go through or something about it changes. You can skip or cancel at any time from your account. We run subscriptions using the Shopify Subscriptions app. Your saved payment details are held by Shopify and our payment providers, not by us.

  • Lawful basis: to perform our contract with you.

Marketing emails

If you sign up, we'll send you emails about our products, news and hair care advice. We send these using Shopify Messaging and Klaviyo. To decide which emails to send you, we use what you've bought from us and how you use our emails, for example which ones you open and which links you click. If you've accepted cookies, we also use how you use our website. For example, we may remind you when a product you bought is likely to be running low. If you don't open our emails for a long time, we may stop sending them.

Giving us your mobile number when you sign up is optional. We ask for it in case we start sending text messages in future, and we keep it with your sign-up details. We don't send marketing text messages now, and we won't send you any unless you've separately agreed to receive them. If you'd like us to delete your number, just ask.

If you've bought from us, we may also email you about similar products, unless you told us not to when you ordered. Every email tells you how to opt out.

Klaviyo also receives order details from our shop for customers who haven't signed up to our emails. This keeps our customer records in one place and helps us make sure we only send marketing to people who are allowed to receive it.

  • Lawful basis: your consent. For past customers who didn't opt out, our legitimate interests in telling you about similar products (the "soft opt-in"). For keeping order details in Klaviyo for customers who haven't signed up, our legitimate interests in keeping accurate customer records. You can unsubscribe at any time using the unsubscribe link or instructions in every email, or by contacting us.

The Color Circle (our loyalty programme)

The Color Circle is our loyalty programme. Its terms, published on our website, explain how it works. If you've ordered from us online, you're automatically a member, and you can leave at any time by emailing us. If you take part, we use your information to:

  • work out your points from the amount you pay for products with us, and add or remove points when orders are sent, collected, returned or cancelled;
  • work out your tier (Circle, Gold or Inner Circle) from the number of orders you've placed with us online in the last 12 months, including orders from before The Color Circle opened, and give you that tier's perks, such as a higher points rate or free delivery;
  • check whether an order is a Subscribe & save order or includes a Subscribe & save item, because those orders don't earn points;
  • give you the reward codes you choose and keep track of which ones you've used;
  • add birthday points once a year, if you've added your birthday (day and month only);
  • run your personal referral link. When a friend uses it, we check that they're new to us and that the introduction is genuine, for example by comparing IP addresses, devices and delivery addresses. We then add your points once their first order has been sent, and we let you know;
  • send you emails about your Color Circle account, such as a reward code you've chosen, your birthday points or reaching a new tier. Reminders before your points or codes expire go only to members who've signed up to our marketing emails.

If you've also signed up to our marketing emails, our emails may show your points balance, your tier and your referral link, and may tell you about double points weeks. We may send you an email around your birthday. We run The Color Circle using Rivo, which shares your points balance, tier, birthday, referral link and membership status with Klaviyo for this.

  • Lawful basis: to perform our contract with you under the programme terms. For making past customers members automatically and counting their earlier orders towards their tier, our legitimate interests in rewarding the people who shop with us. For checking introductions and preventing misuse, our legitimate interests in running the programme fairly. For showing your points and tier in marketing emails, your consent to receive them.

Reviews and product questions

We use Judge.me to collect and show reviews and to answer questions about our products. After you buy, Judge.me may email you on our behalf to ask for a review. If you leave one, it is shown on our website with the name you choose, and marked as "verified" if you bought the product from us. Published product reviews are also shared with Google so they can appear in Google Shopping. If you ask a question about a product, Judge.me emails you when it has been answered.

  • Lawful basis: our legitimate interests in hearing from customers and helping other shoppers make informed choices. You can stop review requests using the link in the email, and you can ask us to remove your review at any time.

Advertising and measuring our website

With your consent, we use cookies and similar tools from Google, Microsoft and TikTok. They help us understand how people use our website, measure whether our adverts work, and show our adverts to people who may be interested in them. This includes:

  • Google Ads enhanced conversions: if you've accepted marketing cookies and you place an order, we may send Google a scrambled (hashed) version of your email address, phone number and address. This helps Google tell us more accurately which adverts led to a sale.
  • Google Customer Match: if you've signed up to our marketing emails, we may share a hashed version of your email address with Google. This lets us show you relevant adverts on Google, or avoid showing you adverts you don't need. We only do this where Google allows our account to use Customer Match.
  • Google Customer Reviews: if you've accepted cookies and you choose to opt in after checkout, Google may email you a short survey about your order.
  • Lawful basis: your consent. You can withdraw it at any time (see "Cookies and similar technologies" below). Unsubscribing from our emails also removes you from the lists we share with Google for Customer Match.

Keeping our shop safe

We and our providers use information such as your IP address and order details to prevent fraud, keep payments secure and stop spam through our website forms.

  • Lawful basis: our legitimate interests in protecting our customers and our business.

Back-in-stock requests

If you ask us to tell you when an item is back in stock, we use your email address to do that. We record your request in Klaviyo, our email provider, and a copy comes to our inbox. If you also tick the box to get Mel's hair tips and news, that's a separate sign-up to our marketing emails, and we'll ask you to confirm it.

  • Lawful basis: our legitimate interests in answering your request. We won't add you to our marketing emails unless you sign up separately.

Salon appointments

When you ask to book an appointment through our website, your request is sent to us by email through Shopify. We use your details to arrange your appointment and contact you about it. We then record your appointment in our salon booking records.

  • Lawful basis: to take steps at your request before a contract, and to perform our contract with you.

Legal requirements and running our business

We may use your information to meet our legal obligations, deal with legal claims, and, if we ever sell or reorganise our business, pass it to the new owner so they can keep serving you.

  • Lawful basis: legal obligation, or our legitimate interests in protecting and running our business.

Automated decisions

We don't make decisions about you that have legal or similarly significant effects using only automated means. Some everyday decisions are automatic, such as working out your points or checking whether an introduction qualifies. You can ask us to look again at any of these. If you choose to pay with Klarna, Klarna may make automated decisions about whether to offer you its payment options, as explained in Klarna's own privacy notice.

Who we share your information with

We only share what each organisation needs to do its job. We never sell or rent your personal information.

  • Shopify hosts our online shop, runs our checkout, stores order and customer records, runs subscriptions (Shopify Subscriptions) and sends our order emails and some marketing emails (Shopify Messaging). If you use Shop Pay, Shopify is also responsible for your Shop Pay account under its own privacy policy.
  • Payment providers: Shopify Payments processes card, Apple Pay and Google Pay payments. If you choose PayPal or Klarna, they process your payment and use your information under their own privacy notices (PayPal, Klarna). Where our website shows a PayPal button, it loads from PayPal's servers, so PayPal receives your IP address and browser details even if you don't use it.
  • Delivery companies receive your name, delivery address and contact details so they can deliver your parcel and send you tracking updates.
  • Klaviyo holds our email list, sends our marketing emails and records how our emails and, if you accept cookies, our website are used. It receives customer and order details from Shopify, and Color Circle details from Rivo. It also records back-in-stock requests made on our website and sends the email when the item is back. If you've signed up to our emails, it may also pass a hashed version of your email address to Google for Customer Match.
  • Rivo runs The Color Circle: your points, tier, reward codes, birthday, referral link and introductions, and the emails about your Color Circle account. If you accept cookies, it also measures how its parts of our website are used.
  • Judge.me sends review requests, verifies and publishes reviews and answers to product questions on our website, and shares published product reviews with Google.
  • Google provides Google Ads, Google Merchant Center, Google Customer Reviews and the Google tag, which we use for advertising and measurement, including enhanced conversions and Customer Match as described above. Google also provides the fonts on our website and the map on our contact and salon pages. Your browser connects to Google's servers to load them, so Google receives your IP address and browser details, whatever you choose about cookies. See how Google uses information from sites that use its services.
  • Microsoft provides Microsoft Advertising. Its tag measures visits from adverts on Bing and other Microsoft services, and helps show our adverts, only if you accept marketing cookies.
  • TikTok provides the TikTok pixel, which measures visits from TikTok adverts, only if you accept marketing cookies.
  • Zoho hosts our business email, so messages you send us, and booking and back-in-stock requests sent through our website, are stored in Zoho Mail.
  • Professional advisers, such as our accountants, lawyers and insurers, when we need their help.
  • Police, HMRC, regulators and courts, where the law requires it or to protect our rights or someone's safety.

Transfers outside the UK

Some of our providers store or access information outside the UK, for example in the European Economic Area, Canada or the United States. Klaviyo and Rivo store information in the United States, and Shopify, Google, Microsoft and TikTok may also process it there or elsewhere. When this happens, the information is protected in one of the ways UK law allows. Either the UK government has approved the country or the company as giving similar protection to the UK, or we use contracts approved by the UK's data protection regulator. Contact us if you'd like more details.

Cookies and similar technologies

Cookies are small files that a website stores on your device. We also use similar browser storage. When you first visit, our banner asks whether you accept analytics and marketing cookies. You can accept or reject them with one click, and we only use them if you click Accept. Strictly necessary cookies are always used, because the shop can't work without them.

The lists below say who sets each cookie or similar tool and what it does. Where the provider tells us, they also give its name and how long it lasts.

Strictly necessary (always on)

  • _shopify_essential (Shopify, 1 year): keeps your basket and checkout working and the site secure.
  • localization (Shopify, 1 year) and cart_currency (Shopify, 14 days): remember your country and currency.
  • _shop_app_essential (Shopify / Shop Pay, 1 year): supports Shop Pay at checkout.
  • tc_cookie_consent (The Color, 1 year): remembers your cookie choice.
  • tc_geo_country and tc_geo_dismissed (The Color, 1 day): remember your country so that we can show our "UK delivery only" notice to overseas visitors.

Shopify may set other strictly necessary cookies for the basket and checkout. See Shopify's cookie list.

Functional (set by our website; always on unless stated)

  • tc_subscribed (The Color, 1 year): set when you sign up through our pop-up, so that we don't show it to you again.
  • tc_signup_seen and tc_holiday_notice_seen (The Color, browser storage): remember that you've seen our pop-up, so that it doesn't keep appearing. They last for your current visit only, or until you clear them if you accept cookies.
  • tc_su_submitted (The Color, for your current visit only): shows you a confirmation after you sign up.
  • tc_back_to and tc_back_restore (The Color, for your current visit only): take you back to the same place in a product list when you return from a product page.
  • tc_recently_viewed (The Color, browser storage, until you clear it, only if you accept cookies): remembers the products you've looked at, so that we can show them again under "Recently viewed".

Analytics (only if you accept)

  • _shopify_analytics (Shopify, 1 year): helps us understand how people use our shop.
  • _ga and _ga_JK4ZBCDE4K (Google, up to 13 months): measurement by the Google tag we use with Google Merchant Center.
  • Judge.me's review tools (Judge.me): measure how our review sections are used.
  • baMet_ cookies and browser storage, for example baMet_visit (Rivo, cookies up to 14 days, browser storage until you clear it): measure how The Color Circle's parts of our website are used.
  • ba_cart_token (Rivo, 2 days), plus baMet_latest_cart, baMsg_ and ba_conversion_data browser storage (until you clear it): link your basket and orders to The Color Circle.

Marketing (only if you accept)

  • _shopify_marketing (Shopify, 1 year): measures which marketing brought you to our shop.
  • _gcl_au (Google Ads, 90 days): measures whether our Google adverts lead to sales.
  • MUID (Microsoft, about 13 months) and MR (Microsoft, 7 days): measure visits and sales from Microsoft Advertising.
  • _ttp (TikTok, about 13 months): measures visits from TikTok adverts.
  • __kla_id and __kle_id (Klaviyo, up to 2 years): recognise you on our website if you've signed up to our emails, so that our emails can reflect the products you've looked at or left in your basket.

Changing your mind

You can change your choice at any time. Use the "Cookie settings" link at the bottom of every page to reopen the banner and accept or reject cookies. You can also delete our cookies in your browser settings. The banner will then appear again on your next visit. Withdrawing consent doesn't affect anything that happened before you withdrew it.

You can also manage how Google and Microsoft personalise adverts in your Google ad settings and Microsoft ad settings.

How long we keep your information

  • Orders, invoices and refunds: 6 years from the end of the financial year in which the order was placed, because tax and company law require it. This includes orders created by a subscription.
  • Customer accounts: until you ask us to close your account, or 3 years after your last order or login if that is sooner.
  • Subscriptions: while your subscription is active. After it ends, we keep the orders it created as order records (see above).
  • Marketing emails: until you unsubscribe. After that, we keep your email address on a "do not contact" list so that we don't email you again by mistake.
  • The Color Circle: while you take part, and for up to 12 months after you leave or the programme closes, so that we can deal with any questions about your points or codes.
  • Customer service messages: 2 years after we last hear from you, or 6 years if they relate to a claim or complaint.
  • Back-in-stock requests: up to 12 months after you ask, in Klaviyo and in our inbox, and then we delete them. If you've also signed up to our emails or bought from us, we keep your details for those reasons, as explained above.
  • Reviews: for as long as the review is published. You can ask us to remove yours at any time.
  • Salon booking requests and appointments: booking requests that don't lead to an appointment for 12 months; appointment records for as long as you remain a salon client, and for 6 years after your last appointment.
  • Cookies: for the periods shown in the cookie lists above.

Your rights

You have the right to:

  • ask for a copy of the personal information we hold about you;
  • ask us to correct information that is wrong or incomplete;
  • ask us to delete your information;
  • ask us to restrict how we use your information;
  • object to us using your information on the basis of our legitimate interests, and object at any time to direct marketing, including the use of your information to decide which emails to send you;
  • ask for information you gave us to be sent to you or another organisation in a portable format;
  • withdraw your consent at any time, where we rely on consent.

Some of these rights only apply in certain situations. For example, we have to keep order records for tax purposes even if you ask us to delete them. To use any of your rights, email info@thecolor.uk. There's normally no charge, and we won't treat you differently for using your rights. We may ask you to confirm your identity, and we'll reply within one month. If your request is complex, we may need up to two more months, and we'll tell you if so.

Complaints

If you're unhappy with how we've handled your information, please contact us first so that we can try to put it right. We'll acknowledge your complaint within 30 days and let you know the outcome without undue delay. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

Children

Our shop is for adults aged 18 or over. If you think a child has given us their details, please contact us and we'll delete them.

Keeping your information secure

We use trusted providers, secure encrypted connections and access controls to protect your information. No website is completely secure, so please don't send us card details or other sensitive information by email.

Other websites and services

Our website links to other websites and services, such as our Facebook, Instagram and TikTok pages. If you message us on WhatsApp, WhatsApp handles your messages under its own privacy notice. The owners of these sites and services are responsible for how they use your information, so please read their privacy notices.

Changes to this notice

We'll update this notice when our practices change, and we'll change the "Last updated" date at the top. If we make a significant change, we'll tell you clearly, for example on our website or by email.