Effective Date: [10 February 2026]
1. Introduction and Who We Are
This Privacy Policy explains how Lemon Appeal Ltd (referred to as "we," "us," or "our") collects, uses, processes, and protects your personal data when you visit our website www.lemonappeal.com, use our services, or purchase goods from us.
We are committed to protecting your privacy and complying with all UK data protection laws, including the UK GDPR.
Company Name: Lemon Appeal Ltd
Data Controller: Lemon Appeal Ltd is the Data Controller responsible for your personal data.
Data Protection Contact:
Email Address: dataprivacy@lemonappeal.com
Postal Address: DNS House, 382 Kenton Road, Harrow, London, HA3 8DP
2. The Data We Collect About You
We may collect, use, store, and transfer different kinds of personal data about you, which we have grouped together as follows:
Data Category | Examples of Data Collected |
Identity Data | First name, last name, title, username (if you create an account). |
Contact Data | Billing address, delivery address, email address, and telephone numbers. |
Financial Data | Payment card details (processed securely by Shopify/payment processor—we do not store them fully). |
Transaction Data | Details about payments to and from you and other details of products you have purchased from us. |
Technical Data | Internet Protocol (IP) address, browser type and version, time zone setting, location, operating system, and platform. |
Profile Data | Purchases or orders made by you, your preferences, feedback, and survey responses. |
Marketing and Communications Data | Your preferences in receiving marketing from us and our third parties, and your communication preferences. |
3. How We Collect Your Personal Data
We collect data through the following methods:
Direct Interactions: You provide us with your data when you:
Purchase products on our site.
Create an account on our website.
Subscribe to our newsletter or marketing.
Contact us via email, phone, or live chat.
Enter a competition or respond to a survey.
Automated Technologies or Interactions: As you interact with our website, we may automatically collect Technical Data and Usage Data using cookies, server logs, and other similar technologies. (See our Cookie Policy for more details.)
Third Parties: We receive data from third parties such as:
Shopify (platform provider).
Payment providers (e.g., Stripe, PayPal).
Analytics providers (e.g., Google Analytics).
Publicly available sources.
4. How We Use Your Personal Data (Legal Basis)
We will only use your personal data when the law allows us to. We must have a "lawful basis" for processing your data under UK GDPR.
Purpose of Processing | Type of Data Used | Lawful Basis for Processing |
To process and deliver your order | Identity, Contact, Financial, Transaction | Performance of a Contract with you. |
To manage your account | Identity, Contact, Profile | Performance of a Contract with you. |
To send marketing emails | Identity, Contact, Marketing | Consent (where required) or Legitimate Interests (for existing customers). |
To improve our website and marketing | Technical, Usage, Profile | Legitimate Interests (to study how customers use our products/site and develop our business). |
To comply with legal obligations | Identity, Contact, Financial, Transaction | Legal Obligation (e.g., tax, fraud prevention). |
5. Sharing Your Personal Data
We may share your personal data with the following categories of recipients for the purposes set out above:
Shopify Inc.: Our e-commerce platform provider.
Payment Processors: Companies like Stripe or PayPal who securely process payments.
Delivery and Courier Services: To fulfil and deliver your order (e.g., Royal Mail, DPD).
IT and System Administration Providers: Companies providing support for our website and IT systems.
Marketing Providers: Email marketing platforms (e.g., Mailchimp, Klaviyo) or targeted advertising services (e.g., Google, Meta/Facebook).
Professional Advisers: Lawyers, accountants, and auditors.
Government/Regulators: HM Revenue & Customs, the ICO, and other regulatory bodies, where legally required.
We require all third parties to respect the security of your personal data and treat it in accordance with the law.
6. International Transfers
We are a UK-based business, but some of our external third-party service providers (e.g., Shopify, Google, Mailchimp) may be based outside the UK and European Economic Area (EEA), meaning their processing of your personal data will involve a transfer of data outside the UK/EEA.1
Whenever we transfer your personal data out of the UK/EEA, we ensure a similar degree of protection is afforded to it by using at least one of the following safeguards:2
Transferring data to countries deemed to provide an adequate level of protection (UK Adequacy Regulations).
Using specific contracts approved for use in the UK which give personal data the same protection it has in the UK (known as International Data Transfer Agreements/Addendums).
7. Data Security and Retention
Security: We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed.
Retention: We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Generally, customer order data will be kept for 6 years after the date of your last order for tax and warranty purposes.
8. Your Legal Rights (UK GDPR)
Under UK GDPR, you have the right to:
Request access to your personal data (commonly known as a "data subject access request" or DSAR).
Request correction of the personal data that we hold about you.
Request erasure of your personal data ("Right to be Forgotten").
Object to processing of your personal data where we are relying on a legitimate interest.
Request restriction of processing of your personal data.
Request transfer of your personal data to you or a third party (data portability).
Withdraw consent at any time where we are relying on consent to process your personal data (e.g., for marketing).
To exercise any of these rights, please contact our Data Protection Contact using the details in Section 1.
9. Right to Lodge a Complaint
You have the right to lodge a complaint with the supervisory authority in the UK, the Information Commissioner’s Office (ICO), if you are unhappy with how we have used your data.
ICO Contact Details: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Helpline: 0303 123 1113.
Website: https://www.ico.org.uk
ICO registration reference: ZC056715
10. Changes to the Privacy Policy
We may update this policy from time to time. We will notify you of significant changes when legally required. The latest version of this policy is always available on our website.
