Privacy policy
Last updated: 8 October 2026
HERZA is operated by Sarah Kilkenny, trading as HERZA ("HERZA", "we", "us" or "our").
This Privacy Policy explains how we collect, use, store and protect your personal information when you visit our website, place an order, sign up to our mailing list, or contact us.
We are committed to handling your information responsibly and only collecting and using information that we need to operate HERZA and provide our services.
1. Who is responsible for your information?
For the purposes of UK data protection law, Sarah Kilkenny, trading as HERZA, is the data controller responsible for your personal information.
If you have any questions about how we use your information, or wish to exercise any of your data protection rights, please contact us:
HERZA
Email: hello@herza.co.uk
We are based in the United Kingdom.
2. What information do we collect?
Depending on how you interact with HERZA, we may collect:
Information you provide to us
This may include:
- Your name
- Email address
- Billing address
- Delivery address
- Telephone number, where provided
- Order and transaction details
- Products you purchase
- Information you provide when contacting us
- Information you provide when signing up to receive marketing emails
Information collected automatically
When you visit our website, certain information may be collected automatically by Shopify and technologies used to operate the website. This may include:
- IP address
- Browser and device information
- Pages viewed and interactions with the website
- General information about how you use the website
- Cookies and similar technologies
The information collected depends on the Shopify features and privacy settings active on our store.
3. How do we collect your information?
We may collect information:
- Directly from you when you place an order
- When you create or use a customer account, if you choose to do so
- When you subscribe to our marketing emails
- When you contact us
- Automatically when you browse or use our website
- From Shopify and other service providers that help us operate our store
We do not buy personal information from third parties.
4. How do we use your information?
We use your personal information where necessary to:
Process and fulfil your orders
We use your information to:
- Process payments
- Confirm and manage orders
- Prepare and dispatch your purchases
- Arrange delivery
- Communicate with you about your order
- Handle returns, refunds and customer service enquiries
The lawful basis for this processing is generally necessary for the performance of a contract with you.
Communicate with you
We may use your information to respond to enquiries, provide customer support and communicate with you about your orders.
The lawful basis is generally performance of a contract where the communication relates to an order, or legitimate interests where appropriate for general customer service.
Send marketing communications
If you choose to subscribe to HERZA marketing communications, we may use your email address to send you information about new products, launches, offers and other HERZA news.
Where consent is required, we rely on your consent to send these communications.
You can unsubscribe at any time using the unsubscribe link included in our marketing emails.
UK rules require consent for many forms of electronic direct marketing, so we will only send marketing communications in circumstances where we have an appropriate lawful basis to do so.
Operate and improve our website
We may use information about how visitors interact with our website to operate, maintain and improve the store and its functionality.
Where appropriate, we rely on legitimate interests for this processing.
Protect our business
We may process information where necessary to:
- Detect and prevent fraud
- Protect the security of our website and systems
- Prevent misuse of our services
- Resolve disputes
- Establish, exercise or defend legal claims
- Comply with legal and regulatory obligations
The lawful basis will depend on the particular circumstances and may include legitimate interests or legal obligation.
5. Shopify
Our online store is powered by Shopify.
Shopify processes personal information on our behalf and provides the technology we use to operate our website, shopping cart, checkout, customer accounts, payments, order management and other ecommerce functions.
Information you provide through our store may therefore be processed by Shopify.
Shopify may also process information about your interactions with our store in accordance with its own privacy policies and the services it provides to merchants.
You can find more information about how Shopify handles personal information in Shopify's privacy documentation.
Shopify also provides privacy and cookie controls that can be configured by merchants. We review these settings to ensure they are appropriate for our store.
6. Payment information
Payments made through our store are processed through Shopify and/or the payment providers made available through Shopify.
We do not store your full payment card details ourselves.
Payment providers may process information necessary to authorise and complete your payment, prevent fraud and comply with legal requirements.
7. Delivery
We currently use Royal Mail to deliver orders within the UK.
Where necessary to fulfil your order, we provide Royal Mail with information such as your name and delivery address.
This processing is necessary to fulfil our contract with you.
8. Email and marketing services
We use email services to communicate with customers and subscribers.
During the HERZA launch period, we may use MailerLite to manage our mailing list and send marketing communications.
We may subsequently move our email marketing activity to Shopify's own email marketing tools.
Where you subscribe to marketing communications, we will only use your information for those communications where we have an appropriate lawful basis to do so.
You can unsubscribe from marketing emails at any time using the unsubscribe link provided in the email.
9. Business email
We use Zoho to provide our HERZA business email service.
If you contact us by email, your message and the information you provide may be processed through Zoho's systems.
We use this information to respond to enquiries, provide customer support and manage our business communications.
10. Cookies and similar technologies
Our website uses cookies and similar technologies.
Some cookies are necessary for the website to function, including features such as shopping baskets, checkout, security and other essential Shopify functionality.
Other cookies or similar technologies may be used for purposes such as analytics, personalisation or marketing, depending on the services and settings active on our store.
Where consent is required for non-essential cookies or similar technologies, we will ask for your consent before using them.
UK cookie rules generally require websites to explain what cookies are used for and obtain consent for cookies that are not strictly necessary.
You can manage your cookie preferences through the cookie controls provided on our website.
11. Google Analytics and advertising
At launch, HERZA does not use Google Analytics or advertising pixels such as the Meta Pixel for advertising purposes.
If we introduce additional analytics, advertising or tracking technologies in the future, we will review our privacy and cookie arrangements and update this Privacy Policy where necessary.
12. Who do we share your information with?
We only share personal information where necessary to operate HERZA, provide our services, fulfil your orders, comply with the law or otherwise where we have an appropriate lawful basis.
Depending on how you interact with us, this may include:
- Shopify — ecommerce platform, website, checkout, orders and related services
- Payment providers — to process payments
- Royal Mail — to deliver your orders
- Zoho — business email
- MailerLite — email marketing during the launch period
- Other service providers where reasonably necessary to operate our business
We do not sell your personal information.
The ICO recommends that privacy notices identify who personal information is shared with, including organisations processing information on the business's behalf.
13. How long do we keep your information?
We keep personal information only for as long as reasonably necessary for the purposes for which it was collected.
For example:
- Order and transaction information may be retained for as long as necessary to fulfil the order, handle returns or disputes, and meet accounting, tax and legal obligations.
- Customer service communications may be retained for as long as reasonably necessary to deal with the enquiry and maintain appropriate business records.
- Marketing information is retained while you remain subscribed to our marketing communications, unless we need to retain limited information to record that you have opted out.
- Other information may be retained for different periods depending on its purpose and our legal obligations.
Where we no longer need personal information, we will securely delete it or otherwise dispose of it appropriately.
The ICO expects organisations to explain either specific retention periods or the criteria used to determine how long information is retained.
14. Your data protection rights
Under UK data protection law, you may have rights in relation to your personal information, including:
- The right to access the personal information we hold about you.
- The right to correct inaccurate or incomplete information.
- The right to request deletion of your information in certain circumstances.
- The right to restrict processing in certain circumstances.
- The right to object to certain types of processing, including direct marketing.
- The right to data portability in certain circumstances.
- The right to withdraw consent where we rely on consent as our lawful basis.
These rights are subject to certain conditions and exceptions under data protection law.
If you wish to exercise a right, contact us at:
We may need to verify your identity before responding to certain requests.
We will respond to valid requests within the time required by applicable data protection law.
15. Marketing preferences
You can unsubscribe from HERZA marketing emails at any time by clicking the unsubscribe link included in the email.
Unsubscribing from marketing communications will not prevent us from sending you important service communications relating to an order you have placed, such as order confirmations, delivery updates or information about your purchase.
16. International transfers
Some of the companies we use to operate HERZA may process personal information outside the United Kingdom.
Where personal information is transferred outside the UK, we will take appropriate steps to ensure that the transfer is made in accordance with applicable UK data protection law and that appropriate safeguards are in place where required.
17. Security
We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse or disclosure.
However, no method of transmitting or storing information online can be guaranteed to be completely secure.
18. Children's information
HERZA is not intended for children to make purchases independently.
We do not knowingly collect personal information from children for marketing purposes.
If you believe that a child has provided us with personal information and you would like us to review or delete it, please contact us at hello@herza.co.uk.
19. Complaints
If you have concerns about how we have handled your personal information, please contact us first:
You also have the right to complain to the UK's data protection regulator:
Information Commissioner's Office (ICO)
You can find information about making a complaint on the ICO's website.
The ICO specifically recommends that privacy notices explain how people can complain about the use of their personal information.
20. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our business, the services we use, our data processing activities or applicable legal requirements.
When we make changes, we will update the "Last updated" date at the top of this page.
We recommend checking this page occasionally to stay informed about how we handle personal information.
21. Contact us
If you have any questions about this Privacy Policy, your personal information, or your data protection rights, please contact:
HERZA
Sarah Kilkenny, trading as HERZA
Email: hello@herza.co.uk
United Kingdom