Privacy policy

Last updated: 2 March 2026

This Privacy Policy explains how Luke Umfreville trading as The CBD Hut ("The CBD Hut", "we", "us", or "our") collects, uses, stores, and shares your personal data when you visit or use our website, make a purchase, create an account, contact us, or otherwise interact with us.

We are committed to handling your personal data lawfully, fairly, and transparently in accordance with applicable data protection law, including the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

Our website and online store are powered by Shopify, which helps us provide our products and services to you.

1. Who we are

Data controller: Luke Umfreville trading as The CBD Hut
Trading name: The CBD Hut
Email: hello@thecbdhut.co.uk
Postal address: Lopham Road, Kenninghall, Norwich, ENG, NR16 2DT, United Kingdom

If you have any questions about this Privacy Policy or would like to exercise your data protection rights, please contact us using the details above.

2. The personal data we collect

We may collect and process the following categories of personal data:

  • Identity and contact data – such as your name, billing address, shipping address, email address, and telephone number.
  • Order and transaction data – such as products ordered, order history, payment status, refunds, returns, and delivery details.
  • Payment data – such as limited payment-related information needed to process transactions. Full card details are typically processed securely by our payment providers and are not stored by us in full.
  • Account data – such as your login details, saved preferences, wishlist activity, and account settings if you create an account.
  • Communications data – such as messages you send to us by email, contact forms, live chat, review submissions, or customer support enquiries.
  • Technical and device data – such as IP address, browser type, device type, operating system, referring URLs, and diagnostic information.
  • Usage data – such as pages visited, products viewed, cart activity, clicks, time on site, and general website interaction data.
  • Marketing and preference data – such as whether you have opted in to marketing, your communication preferences, and interactions with marketing emails or adverts.
  • Fraud prevention and risk data – such as information used to help identify suspicious transactions, reduce fraud, and protect our store and customers.

3. How we collect your personal data

We collect personal data in the following ways:

  • Directly from you – when you place an order, create an account, subscribe to emails, contact us, submit a review, request a return, or otherwise provide information to us.
  • Automatically – through cookies and similar technologies when you browse or interact with our website.
  • From Shopify and service providers – including ecommerce, payment, fulfilment, customer support, analytics, and fraud prevention providers who help us operate the store.
  • From advertising and marketing partners – where permitted, for example to understand campaign performance or improve marketing relevance.

4. How we use your personal data

We use your personal data for the following purposes:

  • To provide, operate, and improve our website and store.
  • To process and fulfil your orders, including payment processing, dispatch, delivery, returns, refunds, and customer service.
  • To manage your account and provide account-related features.
  • To communicate with you about your orders, enquiries, or account.
  • To send service emails and transactional notifications.
  • To send marketing communications where you have opted in or where otherwise permitted by law.
  • To personalise your shopping experience, including relevant product recommendations.
  • To monitor and improve website performance, user experience, and store functionality.
  • To detect, prevent, and investigate fraud, misuse, security incidents, and other unlawful activity.
  • To comply with legal and regulatory obligations, including accounting, tax, and consumer law obligations.
  • To establish, exercise, or defend legal claims where necessary.

5. Our lawful bases for processing

Under UK GDPR, we must have a lawful basis for using your personal data. Depending on the circumstances, we rely on one or more of the following:

  • Contract – where processing is necessary to fulfil your order, provide the services you requested, or manage your account.
  • Legitimate interests – where processing is necessary for our legitimate business interests, provided your rights and freedoms do not override those interests. This may include running and improving our store, fraud prevention, customer service, website analytics, and limited direct marketing.
  • Consent – where you have given clear consent, such as for certain cookies or email/SMS marketing where required.
  • Legal obligation – where we need to process your data to comply with a legal or regulatory obligation.

6. Marketing

If you opt in, we may send you marketing communications about our products, offers, and updates by email and, where enabled and consented to, by SMS.

You can unsubscribe from marketing emails at any time by clicking the unsubscribe link in our emails or by contacting us. Opting out of marketing does not affect transactional or service-related communications, such as order confirmations or delivery updates.

7. Cookies and similar technologies

We use cookies and similar technologies to operate our website, remember preferences, measure performance, understand how visitors use the site, and support marketing and advertising activities.

Where required, we will ask for your consent before using non-essential cookies. You can manage your preferences using our cookie banner or cookie preference tools.

8. Sharing your personal data

We may share your personal data with trusted third parties where necessary to operate our business and provide our services, including:

  • Shopify, which hosts and powers our ecommerce platform.
  • Payment providers, to securely process payments and manage payment-related services.
  • Fulfilment, shipping, and delivery providers, so we can dispatch and deliver your orders.
  • Technology and support providers, such as website, hosting, security, customer support, review, analytics, and communications providers.
  • Marketing and advertising partners, where permitted, to measure campaigns and show relevant advertising.
  • Professional advisers, such as accountants, insurers, or legal advisers where reasonably necessary.
  • Authorities, regulators, or law enforcement, where required by law or where necessary to protect our rights, customers, or business.

We do not sell your personal data for money.

9. Shopify and Shopify-powered services

Our store is hosted by Shopify. When you use our website, some of your personal data is processed by Shopify in order to provide the ecommerce platform, checkout, payment integrations, hosting, security, analytics, and related services.

We may also use Shopify privacy and advertising-related features, including customer privacy settings and Shopify features that help us improve store performance, fraud prevention, targeting, and personalisation.

You can learn more about how Shopify handles personal data by reviewing Shopify's privacy information.

10. International transfers

Some of our service providers, including Shopify and certain apps or technology partners, may process personal data outside the United Kingdom.

Where personal data is transferred internationally, we take reasonable steps to ensure appropriate safeguards are in place, such as reliance on adequacy regulations, standard contractual clauses, or other recognised lawful transfer mechanisms where required.

11. Data retention

We keep personal data only for as long as reasonably necessary for the purposes set out in this Privacy Policy, including to fulfil orders, manage accounts, provide customer support, meet legal, tax, accounting, and regulatory obligations, resolve disputes, and enforce our agreements.

Retention periods may vary depending on the type of information and the reason we hold it. When personal data is no longer needed, we will delete it or securely anonymise it where appropriate.

12. Security

We take reasonable technical and organisational measures to help protect your personal data against unauthorised access, loss, misuse, alteration, or disclosure.

However, no website, transmission method, or storage system can be guaranteed to be completely secure, so we cannot promise absolute security.

13. Your rights

Depending on your circumstances and applicable law, you may have the right to:

  • request access to the personal data we hold about you;
  • request correction of inaccurate or incomplete personal data;
  • request deletion of your personal data;
  • request restriction of processing;
  • object to certain processing, including direct marketing;
  • request transfer of certain personal data to you or another provider;
  • withdraw consent where we rely on consent;
  • lodge a complaint with the Information Commissioner's Office ("ICO").

To exercise any of your rights, please contact us at hello@thecbdhut.co.uk. We may need to verify your identity before responding to your request.

14. Complaints

If you have concerns about how we handle your personal data, please contact us first and we will do our best to resolve the issue.

You also have the right to complain to the UK Information Commissioner's Office (ICO) if you believe your personal data has been handled unlawfully.

15. Children's data

Our website and services are not intended for children, and we do not knowingly collect personal data from children.

16. Third-party links

Our website may contain links to third-party websites, apps, or services. We are not responsible for the privacy practices, content, or security of those third parties. We encourage you to review their policies before providing them with your personal data.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect operational, legal, regulatory, or business changes. Any updates will be posted on this page with the revised "Last updated" date.

18. Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact:

Luke Umfreville trading as The CBD Hut
Email: hello@thecbdhut.co.uk
Address: Lopham Road, Kenninghall, Norwich, ENG, NR16 2DT, United Kingdom