Privacy Policy

Last updated: 1 October 2026

At Laced by Cora, we respect your privacy and are committed to handling your personal information responsibly and transparently.

This Privacy Policy explains how Laced by Cora collects, uses, stores and shares personal information when you visit our website, create an account, place an order, contact us or otherwise interact with our services.

1. Who we are

Laced by Cora is an online hair and beauty brand based in Nottingham, United Kingdom.

For questions about this Privacy Policy or how your personal information is handled, please contact us through the contact form on our website.

2. Information we collect

Depending on how you use our website, we may collect information including:

• your name and contact details; • billing and delivery addresses; • account and login information; • order, transaction and delivery information; • products saved to your wishlist or added to your bag; • communications you send to us; • marketing preferences; and • technical information relating to your use of our website, such as device, browser and website activity information where applicable.

3. Payment information

Payments are processed using our payment service provider, Stripe. Laced by Cora does not need to store your complete payment card details in order to process your purchase.

Stripe processes payment information in accordance with its own privacy practices.

4. How we use your information

We may use your personal information to:

• create and manage your customer account; • process, fulfil and deliver your orders; • process payments, refunds and order-related requests; • provide order and delivery updates; • respond to questions and provide customer support; • prevent fraud, misuse and security incidents; • maintain and improve our website and services; • comply with legal, tax and accounting obligations; and • send marketing communications where we are permitted to do so.

5. Our lawful bases

Depending on why we use your information, we may rely on:

Contract: where processing is necessary to provide products or services you have requested, including processing and delivering an order.

Legal obligation: where we need to retain or use information to comply with applicable law.

Legitimate interests: where necessary for legitimate business purposes, such as maintaining the security of our website, preventing fraud and improving our services, provided those interests are not overridden by your rights.

Consent: where you have given us permission for a particular use of your information, such as certain marketing activities. Where processing relies on consent, you may withdraw it.

6. Marketing

If you choose to receive marketing communications from Laced by Cora, we may use the contact information you provide to send you news, product updates and offers.

You can unsubscribe from marketing communications at any time using the unsubscribe option provided in our messages or by contacting us.

7. Who we share information with

We may share personal information where necessary with trusted service providers that help us operate our business, including:

• payment processors; • delivery and fulfilment providers; • website hosting and technology providers; • email and communications providers; and • professional advisers or authorities where required by law.

We only share information where there is a legitimate reason to do so and only to the extent reasonably necessary for the relevant purpose.

8. International transfers

Some of the service providers we use may process personal information outside the United Kingdom. Where personal information is transferred internationally, we take appropriate steps to ensure that the transfer is handled in accordance with applicable data protection law.

9. How long we keep your information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including fulfilling orders, maintaining appropriate business and transaction records, resolving disputes and meeting legal, tax or accounting requirements.

Retention periods may therefore differ depending on the type of information and why we hold it.

10. Cookies and similar technologies

Our website may use cookies and similar technologies to operate essential website functions, maintain sessions, remember your bag and preferences, improve website performance and, where applicable, support analytics or marketing.

Where consent is legally required for non-essential cookies or similar technologies, we will request it before using them.

11. Your data protection rights

Depending on the circumstances, UK data protection law may give you rights relating to your personal information, including the right to request access, correction or deletion of your information, restrict certain processing, object to certain uses of your information, and request data portability.

Where we rely on consent, you may withdraw that consent at any time.

You also have the right to object to the use of your personal information for direct marketing at any time.

If you wish to exercise a data protection right, please contact us through our website.

You also have the right to raise a concern with the UK Information Commissioner’s Office (ICO) if you are unhappy with how your personal information has been handled.

12. Keeping your information secure

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse or disclosure.

13. Changes to this policy

We may update this Privacy Policy when our services, business practices or legal obligations change. The latest version will always be made available on this page, together with its most recent update date.

14. Contact us

If you have questions about this Privacy Policy or the personal information we hold about you, please contact Laced by Cora through our website contact page.