Privacy policy

Last updated: 26 August 2026
Effective date: 26 August 2026

1. Who we are

This privacy policy explains how Red Lobster Gallery collects, uses and shares your personal information when you visit our website at https://redlobstergallery.co.uk/, buy from us, sign up to our emails, or contact us.

Red Lobster Gallery is a trading name of APH Marketing Ltd. For the purposes of UK data protection law, APH Marketing Ltd is the “controller” of your personal information. That means we decide how and why it is used, and we are responsible for looking after it.

  • Registered company name: APH Marketing Ltd
  • Company registration number: 05880267
  • Registered office and trading address: 25 Station Road, Sheringham, Norfolk, NR26 8RF, United Kingdom
  • ICO registration number: ZA691606
  • Email: Hello@redlobstergallery.co.uk
  • Telephone: 01263 825590

We are registered with the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection.

2. About this policy

We appreciate your decision to shop with us and to trust us with your personal information. In this document we set out our privacy practices in the clearest terms we can, and we encourage you to read it carefully. This policy is a transparency notice, not a contract — you do not need to agree to it in order to use our website. If there is anything in it you would like explained, please contact us using the details in section 21.

3. What information do we collect about you?

We collect information so that we can sell you our products, get them to you, and keep in touch with you if you want us to. The information we collect falls into three groups.

a. Information you give us

  • Name
  • Address — both billing address and delivery address
  • Email address
  • Telephone number
  • Date of birth — optional. We only hold this if you choose to give it to us, so that we can send you a birthday offer.
  • Order details and purchase history
  • The content of any enquiry, message or review you send us
  • Your marketing preferences

b. Information we collect automatically

  • IP address
  • Device type, browser type, operating system and screen settings
  • Pages and products viewed, the website that referred you, and how long you spent on our site
  • Cookie and similar identifiers — see section 5

c. Information we receive from our service providers

Our ecommerce platform, our payment providers and our delivery partners pass us information about your order — for example, whether a payment succeeded, or whether a parcel has been delivered.

Payment information. We do not collect or store your full card number, expiry date or security code. When you pay, those details are collected directly by our payment providers. See section 10.

Special category data. We do not collect special category data — information about your health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetics, biometrics, sex life or sexual orientation.

4. How do we collect this information?

  • Information you give us — when you place an order, create an account, sign up to our emails, enter a competition or giveaway, or contact us by email, telephone or through our website.
  • Information we automatically collect from you — through cookies and similar technologies when you browse our website.
  • Information we receive from our service providers — our ecommerce platform (Shopify), our payment providers and our delivery partners, in each case in connection with an order you have placed.

We do not buy personal information from data brokers, data aggregators, list sellers, online directories or data marketplaces.

5. Cookies and similar technologies

Cookies are small packets of information that are placed on your device, so that we can retrieve information about you, such as your login information, your choices on our website and other information.

We only set non-essential cookies — including analytics and advertising cookies — where you have given consent through our cookie banner. You can change or withdraw your consent at any time through the banner or the cookie settings link on our website. Withdrawing consent is as easy as giving it.

For more information about cookies and similar technologies, please see our cookie policy.

6. Do not track requests

Some web browsers include a “Do Not Track” (DNT) feature that signals to the websites you visit that you do not want your online activity tracked. Because no uniform technology standard for recognising and implementing DNT signals has been finalised, our website does not currently respond to DNT browser signals. If you do not want non-essential cookies or tracking technologies used, manage your preferences through the cookie banner described in section 5.

7. Why we use your information, and our lawful basis for doing so

UK data protection law requires us to have a lawful basis for everything we do with your personal information, and to tell you what it is. The table below sets that out.

What we use your information for Information used Our lawful basis
Processing and fulfilling your order, taking payment and arranging delivery Name, email address, telephone number, billing and delivery address, order details Performance of a contract
Creating and managing your customer account Name, email address, address, order history Performance of a contract
Contacting you about an order, and dealing with returns, refunds and after-sales queries Name, contact details, order details Performance of a contract
Responding to a general enquiry that is not about an order Name, contact details, the content of your message Legitimate interests — our interest in answering people who get in touch with us
Keeping records of orders, payments and VAT Name, billing and delivery address, order and payment records Legal obligation — HMRC record-keeping requirements and our duties under the Companies Act 2006
Sending you marketing emails, including new arrivals, promotions and birthday offers Name, email address, date of birth (only if you choose to give it), purchase history Consent — or, where you have bought from us before and we are telling you about similar products, the “soft opt-in” permitted by regulation 22 of PECR
Personalising our marketing, including grouping our email list by what you have bought or viewed Email address, purchase history, browsing history on our site Consent
Understanding how our website is used so that we can improve it Cookie data, IP address, pages and products viewed, referring website Consent — given through our cookie banner
Advertising and retargeting on Google and Meta (Facebook and Instagram) Cookie and advertising identifiers, pages and products viewed Consent — given through our cookie banner
Preventing, detecting and investigating fraudulent transactions Order details, IP address, payment outcome Legitimate interests — our interest in protecting our business and our customers from fraud
Dealing with a sale, merger, restructure or other transfer of our business All of the above, so far as relevant Legitimate interests — our interest in being able to sell, restructure or transfer the business
Establishing, exercising or defending legal claims Any information relevant to the claim Legitimate interests — our interest in protecting our legal position

Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights and freedoms, and concluded that it is not. You can ask us for more detail about that assessment, and you have the right to object — see section 14.

8. Marketing communications

  • We send our marketing emails using Klaviyo, Inc.
  • We will only email you marketing if you have signed up to receive it, or if you have bought from us before and we are telling you about similar products — the “soft opt-in” permitted by regulation 22 of the Privacy and Electronic Communications Regulations 2003 (PECR). In either case we tell you at the time that you can opt out.
  • Every marketing email we send contains an unsubscribe link. Unsubscribing is free, takes effect straight away, and you do not have to give a reason.
  • You can also unsubscribe by emailing Hello@redlobstergallery.co.uk.
  • If you do unsubscribe, we keep a minimal record of your email address on a suppression list so that we do not email you again by mistake. That record exists only to protect you from further contact.
  • We do not currently send marketing by SMS or text message. If we introduce this in future, we will ask for your consent separately before doing so.
  • We never sell, rent or trade your email address.

9. Profiling and automated decision-making

Our email platform groups customers into segments and generates predictions — for example, how likely you are to buy again, or which products may interest you. We use this to decide which emails to send you and when. This counts as profiling for marketing purposes.

We do not carry out any automated decision-making that produces legal effects concerning you, or that similarly significantly affects you.

If you choose to pay using Klarna, Klarna may carry out its own checks, including a soft credit search. Klarna does this as an independent controller under its own privacy notice, and we are not involved in those decisions.

You have an absolute right to object to profiling for direct marketing. If you object, we will stop — see section 14.

10. Who we share your information with

We do not sell your personal information. We share it with the organisations below, and only so far as necessary.

Service providers acting on our instructions

These organisations process your information on our behalf, under a written contract that requires them to keep it secure and to use it only for the purposes we specify.

  • Shopify Inc. — our ecommerce platform and website hosting
  • Klaviyo, Inc. — email marketing
  • Google LLC — website analytics (Google Analytics), advertising (Google Ads) and product listings (Google Merchant Center)
  • Meta Platforms Ireland Limited — advertising and measurement through the Meta pixel on our website. For some of this activity Meta and Red Lobster Gallery act as joint controllers.
  • Tony Larner Ltd — our accountants, who receive transaction records so that we can meet our accounting and tax obligations

Payment providers

We accept Apple Pay, Google Pay, Klarna, Maestro, Mastercard, PayPal, Shop Pay and Visa. Payments are handled by Shopify Payments (which uses Stripe), PayPal and Klarna. These providers collect your payment details directly from you and use them as independent controllers under their own privacy notices, which we recommend you read:

Delivery partners

We use Royal Mail, Parcelforce Worldwide, InPost and occasionally Yodel. We give them your name, delivery address and, where relevant, your email address or telephone number, so that they can deliver your order and keep you updated on its progress.

Others

We may also disclose your information where we are required to do so by law or by a regulator, or where it is necessary to establish, exercise or defend legal claims. If our business is sold, merged, restructured or otherwise transferred, your information may be transferred as part of that, and the buyer will be bound by this policy.

11. Transfers of your information outside the UK

Some of our service providers are based outside the UK, or store data outside the UK. Whenever we transfer personal information outside the UK, we make sure one of the safeguards recognised by UK data protection law is in place.

Who Where Safeguard we rely on
Shopify Inc. (our ecommerce platform and website host) Canada, United States and the EEA Shopify stores UK and European store, order and customer data at rest in Europe by default. Where personal information is transferred outside the UK, Shopify relies on the European Commission’s 2021 Standard Contractual Clauses read together with the ICO’s UK International Data Transfer Addendum.
Klaviyo, Inc. (email marketing) United States Klaviyo is certified under the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”), which the UK Government has recognised as providing an adequate level of protection. Klaviyo also has the Standard Contractual Clauses in place as a fallback.
Google LLC (analytics, advertising and Merchant Center) United States Google LLC is certified under the UK Extension to the EU–US Data Privacy Framework, and relies on the Standard Contractual Clauses where the Framework does not apply.
Stripe (payment processing behind Shopify Payments) Ireland and United States Stripe is certified under the Data Privacy Framework, and incorporates the ICO’s UK International Data Transfer Addendum into its data processing agreement.
Meta Platforms Ireland Limited (Meta pixel and advertising) Ireland (EEA) The UK has adequacy regulations covering the EEA, so no additional safeguard is needed for the transfer to Ireland. Meta’s own onward transfers to the United States rely on the EU–US Data Privacy Framework and the Standard Contractual Clauses.
PayPal (PayPal UK Ltd is the controller for UK customers) United Kingdom, with transfers within the PayPal group PayPal relies on its Binding Corporate Rules, which have been approved by the competent supervisory authorities, and on other safeguards recognised by UK law.
Klarna Financial Services UK Limited United Kingdom No transfer outside the UK is needed for the service. Klarna is registered with the ICO in its own right.
Royal Mail, Parcelforce Worldwide, InPost, Yodel and Tony Larner Ltd United Kingdom No transfer outside the UK.

You can ask us for more information about any of these safeguards, or for a copy of the relevant clauses, by emailing Hello@redlobstergallery.co.uk.

12. How long do we keep your information?

We keep your personal information only for as long as we need it. In practice that means:

  • Order and transaction records — including name, billing and delivery address and purchase history — are kept for six years from the end of the accounting period they relate to. We are required to keep these by HMRC record-keeping rules for VAT and Corporation Tax, and by our record-keeping duties as a UK limited company under the Companies Act 2006.
  • Customer account data — kept until you ask us to close or delete your account.
  • Marketing contact data — including your date of birth if you have given it — kept for as long as you remain subscribed. If you unsubscribe, we keep a minimal record of your email address on a suppression list indefinitely so that we do not contact you again.
  • Enquiries received by email or through our website — kept for 24 months, unless a longer period is required or permitted by law.
  • Website analytics and advertising data — kept in line with the expiry periods set out in our Cookie Policy.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it. If that is not immediately possible — for example, because it is held in a backup archive — we will store it securely and isolate it from any further processing until deletion is possible.

13. Do we sell your information?

We do not sell your personal information, and we do not rent or trade it. We share it with the organisations listed in section 10, and only so far as necessary to run our business.

The advertising cookies described in our Cookie Policy do involve sharing information about your visit with Google and Meta so that we can show you relevant adverts. Those cookies are only set if you consent to them through our cookie banner, and you can withdraw that consent at any time.

14. Your rights

Under UK data protection law you have the following rights over your personal information.

  • Access — you can ask for a copy of the personal information we hold about you, and for an explanation of how we use it.
  • Rectification — you can ask us to correct information that is inaccurate, and to complete information that is incomplete.
  • Erasure — you can ask us to delete your personal information. This right is not absolute: we may need to keep some information to meet a legal obligation, such as the order records described in section 12.
  • Restriction — you can ask us to limit how we use your information in certain circumstances, for example while we are checking the accuracy of something you have challenged.
  • Portability — where our use of your information is based on your consent or on a contract with you, and is carried out by automated means, you can ask us to give you that information in a structured, commonly used, machine-readable format, or to send it to another organisation.
  • Objection — you can object to our use of your information where we rely on legitimate interests. You have an absolute right to object to direct marketing, and if you exercise it we will stop.
  • Automated decision-making — you have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you. We do not carry out this kind of processing.
  • Withdrawing consent — where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect anything we lawfully did before you withdrew it.

To exercise any of these rights, email us at Hello@redlobstergallery.co.uk. We will respond within one month. If your request is complex, or if you have made a number of requests, we may extend that by up to two further months, and we will tell you if we do. Exercising your rights is free of charge. We may need to ask you for information to confirm your identity before we act.

15. Complaints

If you are unhappy with how we have handled your personal information, please contact us first at Hello@redlobstergallery.co.uk so that we have a chance to put things right.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator:

16. Do you have to give us your information?

You do not have to give us any personal information to browse our website.

If you want to place an order, you do need to give us your name, contact details and delivery address. Without them we cannot take payment, send you your order, or enter into a contract with you.

Everything else is optional. You do not have to give us your date of birth, sign up to our emails, or accept non-essential cookies, and we will not treat you any differently if you choose not to.

17. Children

We do not knowingly provide our services to children. Our website and our products are intended for adults, and in line with our Terms of Service we do not knowingly sell to, or collect personal information from, anyone under the age of 18.

If you are a parent or legal guardian and believe that your child has provided us with information without your consent, please contact us at Hello@redlobstergallery.co.uk. Upon verification that we have collected such information without parental consent, we will remove it from our records.

18. How we keep your information secure

We take reasonable measures to ensure that the information we collect from you is stored securely and protected. Those measures include:

  • encrypting data in transit using TLS, so that information you send us over the website is protected — you will see the padlock symbol in your browser
  • access controls, so that only the people who need your information in order to do their job can see it
  • multi-factor authentication on our administrative accounts
  • keeping card payments entirely within our PCI DSS compliant payment providers, so that we never handle or store full card numbers

However, no method of internet transmission or digital storage is completely secure, and we cannot guarantee absolute security. While we use appropriate security measures to protect your information, we cannot promise that it will be 100% secure.

19. Links to other websites

On our website, we may provide links to external websites, apps or services. These are not operated by us and are therefore not governed by this privacy policy or our practices. We strongly recommend that you review the privacy policies of those websites or services before engaging with them, to ensure that you do not provide personal information that you do not wish to share.

20. Changes to this privacy policy

We may update this privacy policy from time to time to reflect changes in the law or in our privacy practices. When we do, we will change the “last updated” date at the top of this page. If we make a significant change — for example, if we start using your information for a new purpose — we will tell you by email or by a notice on our website.

The privacy policy will be effective from the date it is posted on this page.

21. Contact us

For any questions or concerns regarding your privacy, or to exercise any of your rights, you may contact us using the following details: