Privacy policy
1. Who we are
Orfila Bee Ltd ("Orfila Bee", "we", "us") is responsible for your personal data. We are registered in England and Wales, company number 12984249, at 79 Tib St, Manchester M4 1LS.
This policy explains what personal data we collect when you visit orfilabee.com, shop with us or sign up to our emails, and how we use it.
For any privacy question or request, email orders@orfilabee.com or write to us at the address above, marked "Privacy".
2. The personal data we collect
| Type | Examples | Where it comes from |
|---|---|---|
| Contact and order details | Name, email, phone, delivery and billing address, order history | You, when you order or create an account |
| Payment details | Card details | Entered directly with our payment providers. We never see or store full card numbers |
| Marketing preferences | Whether you've signed up to emails or texts, and the emails you open or click | You, and our email platform |
| Browsing and device data | IP address, device and browser type, pages viewed, items added to your bag | Cookies and similar technologies on our site |
| Returns and customer service | Return reasons, messages you send us | You, when you contact us or return an item |
| Reviews | Your review, star rating and any photos | You, when you leave a review |
3. How we use your data and why
UK data protection law requires a lawful basis for each use of your data.
| What we do | Lawful basis |
|---|---|
| Process, deliver and update you on your order | Contract |
| Take payments and issue refunds | Contract |
| Handle returns and customer service | Contract and legitimate interests |
| Send marketing emails and texts | Consent |
| Send reminders about items left in your bag or checkout, if you've signed up to marketing | Consent |
| Ask you to review your purchase | Legitimate interests |
| Improve our website, products and sizing (e.g. using return reasons) | Legitimate interests |
| Show you relevant ads on social media, if you accept advertising cookies | Consent |
| Prevent fraud and meet legal and tax obligations | Legal obligation |
Where we rely on legitimate interests, we have weighed our interests against your rights. You can object at any time (see section 9).
4. Marketing emails and texts
We only send marketing emails or texts if you have signed up to receive them. This includes new arrivals, offers, and reminders about items you've left in your bag.
- Unsubscribe any time using the link at the bottom of every email, or reply STOP to any text.
- Texts: if you sign up for texts, we send no more than 2 marketing texts a month.
- Order updates (confirmations, dispatch and delivery) are not marketing. You'll receive these even if you unsubscribe.
We use the emails you open and click, and the items you browse, to make our emails more relevant to you.
5. Who we share your data with
We never sell your personal data. We share it only with trusted service providers who help us run our business, and only as much as they need.
| Provider | What they do for us |
|---|---|
| Shopify | Runs our online shop, checkout and order records |
| Payment providers | Process card and other payments securely |
| Couriers and our warehouse | Pack and deliver your order |
| Klaviyo | Sends our emails and texts |
| Judge.me | Collects and displays product reviews |
| Trustpilot | Sends invitations to review our service |
| ReturnZap | Manages returns and exchanges |
| Meta (Facebook, Instagram) and Google | Advertising and website analytics, if you accept those cookies |
We may also share data with professional advisers (such as accountants and lawyers), fraud prevention agencies, or the police and regulators where the law requires it. If our business is sold, your data may transfer to the new owner under this policy.
6. International transfers
Some of our providers, such as Shopify and Klaviyo, store or process data outside the UK, including in the US and the EU.
When data leaves the UK, we make sure it stays protected by using one of these safeguards:
- a country the UK government has confirmed has adequate data protection (including the EU)
- the UK–US Data Bridge, for US companies certified under it
- the UK's International Data Transfer Agreement or approved standard contractual clauses
7. Cookies and tracking
Cookies are small files stored on your device. We use:
- Essential cookies, which make the site work (e.g. your bag and checkout). These are always on.
- Analytics cookies, which help us understand how the site is used.
- Marketing cookies and pixels (e.g. Meta, Google, Klaviyo), which help us show relevant ads and emails.
We only use analytics and marketing cookies if you agree to them in our cookie banner. You can change your choice at any time through the cookie settings link on our site, or by clearing cookies in your browser.
8. How long we keep your data
| Data | How long |
|---|---|
| Orders, payments and returns | 6 years after the order, to meet tax and accounting rules |
| Customer account | Until you close it, then as for orders |
| Marketing list | Until you unsubscribe, or after 2 years without opening or clicking our emails |
| Customer service messages | 2 years after the conversation ends |
| Reviews | For as long as they are published |
After these periods, we delete or anonymise your data.
9. Your rights
Under UK data protection law, you have the right to:
- access a copy of the personal data we hold about you
- correct data that is wrong or incomplete
- delete your data, where we don't need to keep it
- restrict how we use your data
- object to us using your data, including for marketing
- move your data to another provider
- withdraw consent at any time, where we rely on it
To use any of these rights, email orders@orfilabee.com. We may ask you to confirm your identity. We'll reply within one month, or tell you if we need longer for a complex request. There's normally no charge.
Complaints: if you're unhappy with how we've handled your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
10. Security, children and changes
Security: we use secure, reputable providers, encrypted connections (HTTPS) on our site and checkout, and limit access to your data to the people who need it. If a data breach affects your rights, we'll tell you and the ICO where the law requires it.
Children: our site is not intended for anyone under 16, and we don't knowingly collect their data.
Changes to this policy: we may update this policy from time to time. The latest version will always be on this page.
Last updated: October 2026