Privacy policy

Last updated: 27 July 2026

This Privacy Policy explains how Babyboxshop.com ("we", "us", "our") collects, uses, shares and protects your personal information when you visit or shop with us at babyboxshop.com, when you contact us, or when you buy our products through Amazon or TikTok Shop. It also explains your rights under UK data protection law, including the UK GDPR and the Data Protection Act 2018.

We are based in the United Kingdom and this policy is written with UK and EU customers in mind. If you have any questions about this policy or how we handle your data, you can contact us at hello@babyboxshop.com.

1. Scope of this policy

This policy covers personal data collected through babyboxshop.com, including browsing, account creation, checkout, customer service enquiries, reviews and newsletter sign-ups.

When you buy our products through Amazon or TikTok Shop, those marketplaces collect and process your data as independent data controllers under their own privacy policies. We only receive the order and delivery information those platforms share with us as a seller, and we handle that information in line with this policy.

2. Information we collect

Information you give us

Depending on how you interact with us, we may collect: your name, email address, delivery and billing address, phone number, order history, personalisation details you provide for gift items (for example, a baby's name or date of birth), account login details, and any information you include in messages, reviews or survey responses.

We do not collect or store your full payment card number. Card payments are entered directly into our payment provider's secure checkout (for example Shopify Payments, Shop Pay, PayPal, or Klarna), which is independently responsible for PCI-DSS compliant handling of that data.

Information collected automatically

When you visit our site we automatically collect technical information such as your IP address, device and browser type, operating system, referring pages, and how you interact with our site (pages viewed, links clicked, time spent).

Cookies and similar technologies

We use cookies and similar technologies for the following purposes:

  • Strictly necessary cookies — required for core site functions such as the shopping cart, checkout, and account login. These do not require consent.
  • Analytics cookies — help us understand site usage (for example, via Google Analytics, run through Google Tag Manager) so we can improve the site.
  • Advertising and personalisation cookies — used, where active, to measure and improve advertising on platforms such as Google, Meta (Facebook/Instagram), Pinterest or TikTok.

Non-essential cookies (analytics and advertising) are only set with your consent, which you can give or withdraw at any time using the cookie preference banner on our site. [Note: our current site configuration needs a technical check to confirm non-essential cookies are blocked until consent is given, and that the cookie banner displays correctly for UK/EU visitors — see summary notes.]

3. How we use your information and our legal basis

We use your personal information for the following purposes, and we rely on the legal bases below to do so under UK GDPR:

  • To fulfil and deliver your order, process payments, and provide customer service (necessary to perform our contract with you).
  • To send you transactional emails such as order confirmations, shipping updates, and responses to enquiries (contract / legitimate interest).
  • To send marketing emails or SMS about products, offers and news, where you have opted in, or where you are an existing customer and have not opted out (consent, or legitimate interest under the "soft opt-in" rule in UK PECR for existing customers). You can unsubscribe at any time using the link in any marketing email or by contacting hello@babyboxshop.com.
  • To understand and improve our website, products and customer experience, including through aggregated analytics (legitimate interest).
  • To detect and prevent fraud, and to protect the security of our site and customers (legitimate interest / legal obligation).
  • To comply with our legal and regulatory obligations, for example tax, accounting and consumer protection law (legal obligation).

4. Sharing your information

We do not sell your personal information. We share it only where necessary, with:

  • Shopify — our e-commerce platform provider, which hosts our site and processes orders on our behalf.
  • Payment providers — such as Shopify Payments, PayPal, or Klarna, to process your payment securely.
  • Delivery couriers — such as but not limited to Royal Mail, Evri, or DPD, to deliver your order.
  • Email/SMS marketing platform — used to send newsletters and marketing communications you've opted into.
  • Analytics and advertising providers — such as Google, and where active, Meta and TikTok, to measure site performance and advertising, subject to your cookie consent choices.
  • Amazon and TikTok Shop — where you purchase through those marketplaces, as they act as independent controllers of your order data on their platforms.
  • Professional advisers, insurers, or authorities — where necessary to obtain advice, comply with the law, or respond to a legal request (for example, a court order).
  • A buyer or successor business — if we sell or reorganise our business, in which case we'll notify you of any change in how your data is handled.

Where third parties process data on our behalf, we have agreements in place requiring them to protect your information and use it only for the purposes we specify.

5. International data transfers

Some of the providers listed above (for example, Google) may process data outside the UK and European Economic Area, including in the United States. Where this happens, we rely on appropriate safeguards recognised under UK GDPR, such as the UK's International Data Transfer Addendum or the EU Standard Contractual Clauses, or the receiving country having been assessed as providing adequate protection.

6. How long we keep your information

We keep personal data only for as long as necessary for the purposes described in this policy:

  • Order and transaction records: retained for 6 years to meet UK tax and accounting obligations.
  • Account information: retained while your account is active, and for a reasonable period afterwards in case you wish to reactivate it.
  • Marketing data: retained until you unsubscribe or withdraw consent, or after a period of sustained inactivity.
  • Customer service correspondence: retained for as long as needed to resolve your query and for a reasonable period afterwards for quality and dispute-resolution purposes.

When information is no longer needed, we delete or anonymise it securely.

7. How we protect your information

We use technical and organisational measures to protect your personal data, including encrypted (SSL/TLS) connections between your browser and our site, restricted access to personal data within our business, and PCI-DSS compliant payment processing through our payment providers. No method of transmission or storage is completely secure, but we work to protect your information to industry standards and will notify you and, where required, the ICO, if we become aware of a data breach affecting your information.

8. Children's privacy

Our products are designed for babies and new parents, but our website itself is intended for use by adults making purchases on behalf of themselves or others. We do not knowingly collect personal information directly from children, and any personalisation details you provide about a child (such as a name or date of birth) are provided by you, the adult purchaser, for the purpose of fulfilling your order.

9. Your rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate or incomplete data.
  • Request erasure of your data, where applicable.
  • Restrict or object to our processing of your data.
  • Request a portable copy of data you've provided to us.
  • Withdraw consent at any time, where we rely on consent (for example, marketing emails or non-essential cookies), without affecting processing carried out before withdrawal.

To exercise any of these rights, contact us at hello@babyboxshop.com. We may need to verify your identity before responding, and we will respond within one month as required by law.

If you're unhappy with how we've handled your personal data, you have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk or by calling 0303 123 1113.

10. Links to other websites

Our site may link to other websites, including Amazon and TikTok Shop, whose privacy practices are governed by their own policies. We encourage you to review the privacy policy of any site you visit through a link from ours.

11. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. We'll post the revised policy here with an updated "last updated" date. We encourage you to review this page periodically.

12. Contact us

If you have questions about this policy or how we handle your personal data, contact us at hello@babyboxshop.com.