Privacy Policy
Last updated: 11 September 2026
This policy follows your personal information through its whole life with us: how it's collected, what it's used for, who else sees it, where it's stored, when it's deleted, and how you control it at every step. Amory & Co LTD is the controller, and we process personal information under the UK General Data Protection Regulation, the Data Protection Act 2018 and, for cookies and marketing messages, the Privacy and Electronic Communications Regulations (PECR).
We don't sell your personal information, and we don't pass it to other businesses for their marketing.
Who is responsible
| Store | Amory & Co, at amorycolondon.com |
| Company | Amory & Co LTD |
| Business address | Montfichet Road, London E20 1EJ, United Kingdom |
| support@amorycolondon.com | |
| Phone | +44 20 8221 7300 |
| Customer service hours | Monday to Friday, 9:00 am–9:00 pm UK time |
Questions and requests about your data go to the email above with "Privacy" in the subject line.
1. Collected
When you order: name, email address, phone number, billing and delivery address, the items and sizes you bought, and what happens afterwards: delivery, returns, refunds. When you pay: your card number goes into the payment provider's secure form, never to us; we receive a confirmation, the card type and the last four digits. When you ask for sizing help: the measurements and the size you tell us, used only to answer and deleted with the support thread. If you open an account: email, encrypted password, saved addresses and order history; accounts are optional. When you contact us: what you write, your email address, and any photographs you attach. When you browse: IP address, browser and device type, the page or search that brought you here, the pages and products you view, what goes in your basket, and whether you open our emails or click our adverts, most of which is set only with your consent (section 6). From other companies: the payment provider's fraud-check outcome, the courier's delivery status, and Shopify's technical logs.
We don't collect special category data (health, ethnicity, religion, sexual orientation and the like) and ask you not to include it in messages to us.
2. Used
| Purpose | Lawful basis |
|---|---|
| Processing, dispatching and delivering your order; returns and refunds | Performance of a contract |
| Answering your questions and complaints; running your account | Performance of a contract |
| Detecting and preventing fraud and misuse | Legitimate interests: protecting customers and the business |
| Keeping the site secure, fixing faults, understanding how it's used | Legitimate interests, and consent where cookies are involved |
| Sending marketing emails and texts | Consent, or the PECR "soft opt-in" for existing customers |
| Measuring and targeting advertising | Consent |
| Keeping accounting records; responding to lawful requests | Legal obligation |
Where we rely on legitimate interests, we've weighed our interest against your rights and concluded the processing is proportionate; you can object at any time (section 6). Where we rely on consent, you can withdraw it whenever you like. We don't make decisions about you based solely on automated processing with legal or similarly significant effects; if the payment provider's fraud screening declines a transaction, a member of our team will review it if you contact us.
Marketing. Order messages are sent because we need them to complete your purchase. Marketing messages are sent only if you've opted in, or if you've bought from us and we email you about similar products under the PECR soft opt-in, with the chance to refuse when you order and in every message. Entering your email at checkout doesn't sign you up on its own. Unsubscribe with the link in any marketing email, by replying STOP to a text, or by emailing us; it takes effect immediately. Buying from us is never conditional on agreeing to marketing.
3. Shared
Only with the organisations that help us run the shop, and only what each needs, under data processing agreements where they act on our behalf: Shopify (platform and Shopify Payments; for services across many shops, such as Shop Pay and fraud protection, Shopify is itself a controller), other payment providers you choose at checkout, such as PayPal, Apple Pay or Google Pay, couriers and fulfilment partners (name, address, phone, email), email and messaging providers, analytics and advertising partners such as Google and Meta when your cookie consent allows it, accountants, solicitors and IT providers, and HMRC, regulators, the police and courts where the law requires. If the business is sold, merged or restructured, customer records transfer with it and the new owner takes on the obligations in this policy.
4. Stored
All traffic to and from the shop is encrypted (TLS). Card details never reach our systems, because payment is handled by PCI DSS-compliant providers. Access to customer information is limited to the people who need it and protected by two-factor authentication.
Some providers process personal information outside the United Kingdom: Shopify and our advertising and analytics partners in the United States and Canada, and our fulfilment partners in the countries where orders are dispatched from. Where a transfer is a restricted transfer under UK data protection law, we rely on UK adequacy regulations where they exist, and otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with additional safeguards where needed.
If a breach is likely to pose a risk to your rights, we'll report it to the Information Commissioner's Office within 72 hours, and where the risk is high, we'll tell you directly without undue delay.
5. Deleted
| Information | Kept for |
|---|---|
| Orders, invoices and payment confirmations | 6 years from the end of the financial year, for HMRC |
| Return and complaint records | Until closed, then for as long as a claim could be brought (up to 6 years) |
| Sizing questions | The duration of the conversation, then deleted with the support thread |
| Account | Until you close it, or after 3 years without a login |
| Marketing subscription | Until you unsubscribe; we keep the unsubscribe itself so we don't email you by mistake |
| Support correspondence | 2 years after the last message |
| Analytics and advertising data | Up to 26 months, less where the tool allows |
| Fraud and security logs | 12 months |
While a dispute or legal claim is open, the relevant records stay. After the retention period, information is deleted, anonymised or securely destroyed.
6. Controlled by you
Cookies. Strictly necessary cookies (basket, checkout, login, security, your cookie choice) are always on; functional, analytics and advertising cookies are set only after you've consented through the cookie banner, as PECR requires. Change or withdraw consent at any time through the "Cookie preferences" link in the footer or in your browser. Blocking strictly necessary cookies stops checkout from working.
Advertising. With your consent, we use information about your visits to measure our adverts and show you relevant ones on platforms such as Google, Facebook and Instagram, and, where you've agreed, a hashed version of your email address matched by the platform. Withdraw consent through the cookie banner, or opt out of interest-based advertising across many platforms at youronlinechoices.com.
Your rights. Under UK data protection law you can ask us to give you access to your personal information and a copy of it, correct it, erase it where we're not required to keep it, restrict how we process it, provide it in a portable format, stop processing based on legitimate interests (and always stop direct marketing) if you object, and stop relying on your consent. Some rights carry conditions and exemptions; we'll explain if one applies. Email support@amorycolondon.com; we may ask you to confirm your identity through details of a recent order. We respond within one month, or up to three months for complex requests with notice within the first month. There's no charge, and using these rights won't change how we treat you.
Complaints. Raise it with us first; we acknowledge complaints within five working days and aim to resolve them within a month. You also have the right to complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, 0303 123 1113, ico.org.uk.
Children, links and changes
The shop is intended for adults; we don't knowingly collect personal information from children under 13 and remove it if we learn we have. Links on our site lead to sites we don't control; their privacy notices apply there. We update this policy when our practices, our providers or the law change; the current version is always on this page with the date at the top, and where a change materially affects how we handle your information, we'll tell you before it takes effect.
Contact
Amory & Co LTD Montfichet Road, London E20 1EJ, United Kingdom support@amorycolondon.com · +44 20 8221 7300 Monday to Friday, 9:00 am–9:00 pm UK time · Replies within one working day