Privacy Policy

Last updated: [DATE]

1. Introduction

This Privacy Policy describes how Echo Loom ("Echo Loom", "we", "us", or "our") collects, uses, discloses and protects your personal information when you visit our website, make a purchase, or otherwise interact with us. Echo Loom is a fashion brand operating in England.

By using our services, you agree to the collection and use of information in accordance with this Privacy Policy.

2. Who we are

Echo Loom is a fashion company based in England. For the purposes of applicable data protection laws in the United Kingdom, we are the data controller of your personal information.

3. Information we collect

We may collect and process the following categories of personal information:

3.1 Information you provide to us

• Contact details: name, billing and shipping address, email address, phone number
• Account information: username, password, and preferences (if you create an account)
• Order information: products purchased, payment method (limited details), transaction history
• Communications: messages you send to us (email, contact forms, social media messages), customer service interactions, reviews and feedback

3.2 Information collected automatically When you visit or use our website, we may automatically collect:

• Device and technical data: IP address, browser type and version, device type, operating system, time zone setting, and basic device identifiers
• Usage data: pages visited, time and date of visit, time spent on pages, clickstream data, referring website, and interactions with our website, emails, and adverts
• Cookies and similar technologies: information collected via cookies, pixels and similar technologies (see Section 9: Cookies and similar technologies)

3.3 Information from third parties We may receive information about you from:

• Payment providers and banks, to confirm payment and prevent fraud
• Delivery and logistics providers, regarding shipment and delivery updates
• Analytics and advertising partners, about your engagement with our website and marketing
• Social media platforms, if you interact with our profiles or sign in via social accounts (where available)

4. Legal bases for processing (UK GDPR)

We process your personal information only where we have a lawful basis under UK data protection law, including:

• Contract: to perform our contract with you or take steps at your request before entering into a contract (e.g. processing orders, delivering products)
• Legitimate interests: to pursue our legitimate business interests (e.g. website security, fraud prevention, improving and promoting our services) where your rights do not override those interests
• Consent: where you have given clear consent (e.g. for certain marketing communications, cookies not strictly necessary for the website)
• Legal obligation: to comply with legal and regulatory requirements (e.g. tax, accounting, reporting obligations)

5. How we use your information

We may use your personal information for the following purposes:

• To provide and manage our services: processing orders, payments, and deliveries; creating and managing your account
• To communicate with you: sending order confirmations, shipping updates, responding to enquiries, providing customer support
• To personalise your experience: remembering your preferences, tailoring content and product recommendations
• For marketing and promotions: sending newsletters, offers and updates about Echo Loom, when permitted by law and, where required, with your consent
• For analytics and improvement: understanding how our website and services are used, improving design, functionality, and product offerings
• For security and fraud prevention: protecting our website, preventing, detecting and investigating fraud or misuse
• For legal and compliance: keeping appropriate records, meeting legal, regulatory and tax obligations, and exercising or defending legal claims

6. How we share your information

We do not sell your personal information. We may share your information with:

6.1 Service providers Trusted third parties who help us operate our business, such as:

• Payment processors and financial institutions
• IT and hosting providers
• Website and e‑commerce platform providers
• Delivery, logistics and warehousing partners
• Customer support tools and communication platforms
• Marketing, advertising and analytics partners

These providers only process your information on our instructions and are subject to confidentiality and data protection obligations.

6.2 Business transfers If Echo Loom, or substantially all of its assets, is acquired, merged, restructured or transferred, your information may be transferred as part of that transaction, subject to applicable data protection laws.

6.3 Legal requirements We may disclose your information where required to do so by law, regulation, court order, or governmental authority, or where we believe disclosure is necessary to:

• Comply with legal obligations
• Protect the rights, property or safety of Echo Loom, our customers, or others
• Detect, prevent or address fraud, security or technical issues

7. International transfers

We are based in England, but some of our service providers may be located or process data outside the United Kingdom or the European Economic Area (EEA). Where your personal information is transferred outside the UK/EEA, we will ensure an adequate level of protection by using appropriate safeguards, such as:

• Transfers to countries with an adequacy decision by the UK government or European Commission
• Standard contractual clauses approved by the UK or EU authorities
• Other legally recognised safeguards

You may contact us for more information about the safeguards in place for a particular transfer.

8. Data retention

We keep your personal information only for as long as necessary for the purposes set out in this Privacy Policy, including to:

• Provide our services and fulfil our contract with you
• Meet legal, accounting and reporting requirements
• Resolve disputes and enforce our agreements

The specific retention period depends on the type of information and the context of processing. For example:

• Order and transaction records are typically kept for at least 6 years for tax and accounting purposes
• Marketing information is kept until you withdraw your consent or object to processing, or after a period of inactivity, in line with our internal policies

When we no longer need your information, we will securely delete or anonymise it.

9. Cookies and similar technologies

We use cookies and similar technologies to:

• Make our website function properly
• Remember your preferences
• Analyse website traffic and performance
• Support marketing and advertising activities

Types of cookies include:

• Strictly necessary cookies: essential for site operation (e.g. shopping cart, secure login)
• Performance and analytics cookies: help us understand how visitors use our website
• Functional cookies: remember choices you make (e.g. language, region)
• Advertising and targeting cookies: help deliver relevant adverts and measure their effectiveness

Where required by law, we will ask for your consent before placing non‑essential cookies. You can manage cookies through your browser settings or our cookie banner (where available), though disabling some cookies may affect website functionality.

10. Your rights (UK and applicable law)

Depending on your location and subject to legal conditions, you may have the following rights regarding your personal information:

• Access: to obtain confirmation of whether we process your data and to request a copy
• Rectification: to have inaccurate or incomplete data corrected
• Erasure: to request deletion of your data in certain circumstances
• Restriction: to request that we restrict the processing of your data in certain circumstances
• Data portability: to receive your data in a structured, commonly used and machine‑readable format and to transmit it to another controller where technically feasible
• Objection: to object to processing based on our legitimate interests or for direct marketing
• Withdraw consent: where processing is based on consent, you may withdraw it at any time (this will not affect processing carried out before withdrawal)

To exercise any of these rights, please contact us using the details in Section 13. We may need to verify your identity before responding to your request and may be entitled to refuse or limit your request where permitted by law.

11. Marketing communications

We may send you marketing communications about Echo Loom products, collections and offers if:

• You have requested information from us or purchased from us, and you have not opted out of receiving marketing; or
• You have given us your explicit consent.

You can opt out at any time by:

• Clicking the "unsubscribe" link in our marketing emails; or
• Contacting us using the details in Section 13.

Even if you opt out of marketing, we may still send you non‑marketing messages relating to your orders, account or our ongoing business relationship.

12. Security

We use appropriate technical and organisational measures designed to protect your personal information against unauthorised access, accidental loss, destruction or damage. These may include:

• Encryption and secure transmission protocols (such as HTTPS)
• Access controls and authentication
• Regular security reviews and monitoring

However, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security.

13. Contact us

If you have any questions about this Privacy Policy or how we handle your personal information, or if you wish to exercise your data protection rights, please contact us at:

Echo Loom Email: [CONTACT EMAIL] Postal address: [POSTAL ADDRESS], England

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements or for other operational reasons. The updated version will be indicated by a revised "Last updated" date at the top of this page and will take effect when posted.

We encourage you to review this Privacy Policy periodically to stay informed about how we process your personal information.