Privacy Policy
EvilGirl.uk — Beauty. Fashion. Attitude.
Last updated: 29 October 2026
At EvilGirl.uk, we respect your privacy and are committed to handling your personal information responsibly.
This Privacy Policy explains what personal information we collect, why and how we use it, who we share it with, how long it is kept and your rights under UK data protection law, including the UK GDPR and the Data Protection Act 2018.
It applies when you visit our website, create an account, place an order, subscribe to our newsletter, ask for product notifications, contact us or otherwise use our online services. Rules concerning electronic marketing and cookies also arise under the Privacy and Electronic Communications Regulations (PECR), as amended.
1. Who We Are
EvilGirl.uk is an independent UK online store operated by Cezary Marciniak, trading as Evil Girl Store Online.
We are responsible for deciding how and why personal information is processed for the operation of our store. In data protection law, this is known as being a data controller.
Business address:
EvilGirl.uk — Store Online53 Cambridge Street
South Elmsall
West Yorkshire
WF9 2AP
United Kingdom
Email: seller@evilgirl.uk
Telephone: 07516 320535
Website: https://evilgirl.uk/
For questions about personal information or to exercise your data protection rights, please contact us using the details above.
2. Personal Information We Collect
Depending on how you interact with EvilGirl.uk, we may collect the following information:
2.1 Identity and Contact Information
- First and last name.
- Billing and delivery addresses.
- Email address.
- Telephone number, where provided.
- Customer account information.
2.2 Order and Transaction Information
- Products ordered and purchase history.
- Order numbers and transaction references.
- Amounts paid and payment status.
- Delivery and tracking information.
- Returns, refunds and customer service records.
2.3 Technical and Website Information
When you use our website, technical information may be collected automatically, including:
- IP address.
- Browser type and device information.
- Operating system and language preferences.
- Pages visited and interactions with our website.
- Cookie identifiers and similar technologies.
- Security and diagnostic information.
2.4 Communications and Preferences
We may process information contained in messages you send to us, customer support requests, product reviews and your marketing preferences.
If you subscribe to promotional communications, we may also keep a record of your subscription preferences and applicable consent or opt-out choices.
2.5 Information Received From Other Sources
Where relevant to a purchase or enquiry, we may receive transaction confirmations and payment status from payment providers; delivery and tracking updates from Royal Mail or other carriers selected for an order; and security, fraud-prevention or technical information from service providers. These records are used for the purposes explained below. Where advertising or analytics services are enabled, we may receive campaign performance information from the relevant provider.
3. How and Why We Use Your Information
We process personal information only for specified purposes and with an appropriate lawful basis under UK data protection law. Where we rely on legitimate interests, these include running a secure, reliable store, preventing fraud, handling customer queries and improving our services, balanced against your rights and expectations.
3.1 Processing and Delivering Orders
We use names, contact and delivery details, order contents and related communications to take orders, fulfil purchases, arrange delivery and manage returns or refunds.
Lawful basis: Performance of our contract with you or steps you request before a contract.
3.2 Payments
We process payment status, references and associated order information to confirm payment, issue refunds and reconcile transactions.
Lawful basis: Performance of a contract and compliance with accounting or other legal obligations, as applicable.
3.3 Customer Accounts
We use registration and account details to provide login, customer preferences, order history and account support.
Lawful basis: Performance of a contract and, where appropriate, our legitimate interests in providing and maintaining account services.
3.4 Customer Support and Contact Forms
We use your name, email address and the contents of your enquiry to respond to questions, resolve issues and deal with complaints. Providing this information does not, by itself, sign you up to marketing emails.
Lawful basis: Performance of a contract where the enquiry relates to an order, or our legitimate interests in responding to requests and helping customers.
3.5 Website and Account Security
We use relevant device, technical and transaction information to maintain the website, protect accounts, diagnose faults, prevent fraud and investigate misuse.
Lawful basis: Legitimate interests in protecting our customers, systems and business, or a legal obligation where applicable.
3.6 Financial and Legal Records
We keep appropriate order, transaction, refund and correspondence records for accounting, tax, legal compliance and the establishment or defence of legal claims.
Lawful basis: Compliance with legal obligations and, where applicable, legitimate interests in resolving disputes.
3.7 Newsletter and Product Notifications
When you actively subscribe, we use your email address to send EvilGirl.uk marketing news, product launches and special offers. Separately, if you request a product availability alert, we may use your email address to send that requested notification.
Lawful basis: Consent for optional marketing subscriptions; steps requested by you or legitimate interests, as appropriate, for requested service notifications. We comply with the additional PECR requirements for marketing communications. In limited circumstances, UK law also permits messages about our own similar products to existing customers if all conditions for the customer “soft opt-in” are met, including opt-out opportunities when details are collected and in every message.
3.8 Analytics, Cookies and Advertising
We use website analytics to understand how our store is used and advertising technologies to measure campaigns. Services configured on the website may include Google Analytics 4 and Meta Pixel. Analytics and Marketing & Advertising cookies are controlled separately through our cookie preference centre.
Lawful basis: Where these technologies involve personal information and require consent, we rely on your consent. Certain limited statistical uses may qualify for a specific PECR exception only where all legal conditions are met, including clear information and an easy way to object. An exception is not assumed merely because a tool is described as analytics.
You may change your cookie preferences at any time as described in section 7. You may also object to processing based on legitimate interests, subject to applicable rules.
4. Payment Information
The payment methods actually available to customers are those displayed during checkout. They may include bank transfer or a payment service provider if that method is enabled on our store. We do not represent a particular payment provider as available unless it is offered at checkout.
Where a third-party payment provider is used, it may process payment information under its own privacy notice and applicable laws. EvilGirl.uk receives the information necessary to manage your order, such as payment confirmation, status, reference numbers and any refund details.
Where bank transfer is offered, we may use information supplied with the transfer to match the payment to your order and maintain financial records. Please refer to the information shown at checkout for the selected method.
5. Delivery and Fulfilment
To fulfil orders, we share necessary delivery information with our delivery service providers, including Royal Mail.
This may include your name, delivery address, contact details and shipment information where required for delivery or tracking.
We use this information to fulfil our contract with you and manage delivery-related enquiries.
6. Marketing Preferences
Our newsletter is optional. Where you sign up, we record your email address and the relevant subscription or consent information. We may send electronic marketing under a permitted existing-customer exception only when its conditions are met.
You can stop marketing emails at any time using the unsubscribe option in the message or by contacting us. We will honour your withdrawal or opt-out and may retain a minimal suppression record to avoid contacting you again in error.
Unsubscribing does not prevent essential emails about an existing order, return, payment, requested product alert or customer service matter. Consent to cookies and consent to marketing emails are separate choices.
7. Cookies and Similar Technologies
We use cookies and similar storage technologies for essential shopping basket, login, security and site functions. Optional categories include Analytics Cookies and Marketing & Advertising Cookies, which you can control separately.
Our website uses a cookie preference centre. On your first visit you can make choices through the cookie notice. After saving preferences, you can return to the preference centre using the Cookie Settings link in the website footer. You can change or withdraw an optional cookie choice there.
Where consent is legally required, merely visiting or continuing to browse our website does not constitute consent. Optional technologies should operate only in accordance with your choices; limited legally exempt uses are subject to their own conditions.
For additional information, see our Cookie Policy. Browser controls may also let you restrict or remove cookies, although blocking essential cookies can prevent shopping baskets and logins from working correctly.
Your cookie choices do not automatically subscribe or unsubscribe you from marketing emails; these preferences are managed separately.
8. Who We Share Personal Information With
We share personal information only where reasonably necessary to fulfil orders, provide requested services, support the website, conduct appropriately authorised analytics or marketing, or comply with the law. Recipients may include:
- Delivery providers: Royal Mail and any other carrier actually used for your order, receiving details necessary for delivery and tracking.
- Payment services: Banks or payment providers selected at checkout, receiving information necessary to complete, confirm or refund payments.
- Hosting and technical services: Organisations helping us host, secure, maintain and troubleshoot the website.
- Email and customer support services: Providers helping us send order-related messages, requested notifications and marketing messages you are entitled to receive.
- Analytics and advertising services: Providers such as Google and Meta, where the corresponding tools are used in accordance with relevant consent choices and law.
- Professional advisers or authorities: Where disclosure is necessary for accounting, legal compliance, disputes or other lawful requirements.
Some service providers process data on our instructions; others, including certain payment, delivery or advertising providers, may act as independent controllers for their own purposes. Their privacy notices may explain those purposes further.
We do not share customer information for unrelated purposes without a lawful basis and any required notice or consent.
9. International Data Transfers
Some technology, payment, analytics or advertising services may involve access to or processing of information outside the United Kingdom. Where UK international transfer rules apply, we use a legally permitted transfer mechanism, such as applicable UK adequacy regulations or appropriate contractual safeguards.
Depending on the service and destination, safeguards may include the UK International Data Transfer Agreement (IDTA) or an appropriate UK Addendum to standard contractual clauses, together with any required assessment and protections.
You may contact us to request further details of the safeguards relevant to a particular transfer, including information on how to obtain a copy where legally required.
10. How Long We Keep Personal Information
We keep information only for as long as reasonably needed for the purposes described in this policy, or to meet legal requirements. The exact period depends on the data and the reason for keeping it:
- Orders, transactions and tax records: We keep relevant financial records for the statutory accounting and tax retention period. For UK self-employed business records, HMRC generally requires retention for at least five years after the 31 January tax return submission deadline for the relevant tax year. Records needed for an ongoing dispute or legal obligation may be kept longer.
- Customer account records: Kept while an account is used and thereafter only as necessary for unfinished orders, legal obligations, security or the handling of legitimate claims.
- Customer enquiries and complaints: Kept for the time needed to respond and resolve the matter, and for any reasonable additional period necessary to establish what happened or deal with a related claim.
- Newsletter records and opt-outs: Subscription information is kept while a subscription is active; minimal opt-out details may be kept afterwards to ensure no further unwanted marketing is sent.
- Cookie preferences and website data: Retained according to the purpose and applicable cookie lifetimes, service configurations and legal requirements. The Cookie Policy and preference centre provide further context for cookie categories.
When the relevant period ends, we delete, anonymise or securely dispose of information, unless we have a continuing lawful reason to retain it. You can contact us about the criteria or periods relevant to your information.
11. Your Data Protection Rights
Depending on the circumstances and lawful basis, UK data protection law gives you rights to:
- Access: Ask whether we hold your personal information and obtain a copy.
- Rectification: Ask us to correct inaccurate or incomplete information.
- Erasure: Request deletion of information where the right applies.
- Restriction: Request limits on certain processing.
- Portability: Receive eligible information in a structured, commonly used, machine-readable format.
- Object: Object to certain processing based on legitimate interests and to direct marketing.
- Withdraw consent: Withdraw consent at any time where consent is the lawful basis. Withdrawal does not affect processing already carried out lawfully.
- Automated decisions: Exercise any applicable rights relating to solely automated decisions with legal or similarly significant effects.
Your Right to Object to Direct Marketing
You can object at any time to the use of your personal information for direct marketing, including related profiling. We will stop processing your information for that purpose.
You may also object to certain processing based on our legitimate interests; we will assess such requests under applicable law. Other rights are not absolute and some information must be retained for legal or financial reasons.
12. How to Exercise Your Rights
To exercise your data protection rights, email seller@evilgirl.uk or write to the business address in section 1. Tell us what you would like us to do and the information concerned.
We may ask for reasonable proof of identity if necessary to protect your information. We usually respond to qualifying requests without undue delay and within one calendar month, subject to lawful extensions and exceptions. We will explain if an exception or extension applies.
To change optional cookies, use the cookie preference centre described in section 7. To stop marketing emails, use the unsubscribe option in the email or contact us.
13. Data Protection Complaints
If you believe we have handled your personal information incorrectly, you can complain to us using seller@evilgirl.uk or the postal address in section 1. Please describe your concern and provide enough details to help us investigate it.
We will acknowledge a data protection complaint within 30 days of receipt, investigate and respond without undue delay, keep you appropriately informed and explain the outcome. Acknowledgement within 30 days does not mean that the investigation must always be completed within that period.
You can also complain to the UK's supervisory authority, the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint/.
You are entitled to approach the ICO; contacting EvilGirl.uk first is encouraged but is not a condition of your right to complain to the regulator.
14. Protecting Your Information
We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
Such measures may include access controls, secure website connections, system updates and appropriate security practices.
No online service can guarantee absolute security. We therefore review our security arrangements as necessary and respond to potential incidents in accordance with applicable law.
15. Information Required to Place an Order
Certain personal information is necessary to process an order, including contact, delivery and payment-related details.
If required information is not provided, we may be unable to accept or fulfil the order.
Providing information for optional services, such as marketing subscriptions, is not a condition of purchasing products.
16. Automated Processing
We use routine automated functions to manage orders, detect potential fraud, maintain website security and, where permitted by your preferences, measure analytics or advertising. Certain advertising technologies may use identifiers or interactions to measure audiences and campaign performance.
We do not use solely automated decision-making by EvilGirl.uk that produces legal or similarly significant effects for customers as part of our ordinary store operations. An external payment provider may carry out its own automated fraud or payment checks under its privacy notice.
If our practices change to involve qualifying solely automated decisions, we will provide the additional information and rights required by law.
17. Changes to This Policy
We may update this Privacy Policy to reflect changes in our operations, technology, service providers or legal requirements.
The latest version will be published on this page with an updated date.
Where required, we will provide additional notice before introducing significant new uses of personal information.
18. Contact Us
If you have any questions about this Privacy Policy or how EvilGirl.uk handles personal information, please contact:
EvilGirl.uk — Store Online
53 Cambridge Street
South Elmsall
West Yorkshire
WF9 2AP
United Kingdom
Email: seller@evilgirl.uk
We value your trust and are committed to treating your personal information with care and respect.
EvilGirl.uk — Beauty. Fashion. Attitude.