Privacy Policy
How we handle your personal data, in plain English. Last updated: 20 October 2026.
In short: we collect what we need to take, pack and deliver an order, we keep it for as long as tax law requires, we never sell it, and you can ask to see or delete it at any time by emailing hello@lenauk.co.uk.
1. Who is responsible for your data
LENA (LONDON) LIMITED (company no. 08361983, registered office Flat 6 Nassau House, 122 Shaftesbury Avenue, London W1D 5ER, United Kingdom, is the data controller for this website. For any question about this policy or your data, email hello@lenauk.co.uk.
2. What we collect
- Order details — name, delivery address, email address, phone number (if you give one), the items you ordered and the amount paid.
- Payment information — handled by our payment provider. We receive the result of the payment, the last four digits of the card and the card brand. We never see or store your full card number or security code.
- Correspondence — the content of emails you send us about an order, a return or a question.
- Technical data — the pages you visit on this site, your approximate location derived from your IP address, browser type and the site that referred you. This is used in aggregate to keep the site working and to see which pages are useful.
We do not ask for, and do not want, any special category data (for example health information). Please do not send it to us.
3. Why we use it, and our lawful basis
- To process and deliver your order — necessary to perform our contract with you.
- To handle returns, refunds and warranty claims — necessary to perform our contract and to comply with consumer law.
- To keep accounting and tax records — a legal obligation (UK tax law requires six years).
- To prevent fraud and card abuse — our legitimate interest in protecting our business and our customers; payment providers also screen transactions for this purpose.
- To answer your emails — our legitimate interest in supporting customers, or your consent where a reply requires it.
- To improve the site — our legitimate interest in understanding aggregate traffic.
We do not send marketing emails unless you ask us to, and every marketing email contains a one-click unsubscribe link.
4. Who we share it with
Only the companies that are necessary to complete your order, and only the data they need:
- Our payment provider — to take the payment and handle refunds.
- Delivery carriers — name, address and phone number, so the parcel can be delivered and tracked.
- Our hosting and email providers — to run the site and send order and dispatch emails.
- Professional advisers and authorities — where we are legally required to disclose, or to establish or defend a legal claim.
We never sell your personal data, and we do not share it with advertising networks.
5. Where your data is stored
Order data is stored on servers in the European Union and the United Kingdom. Some of our providers are based in the United States; where data leaves the UK or EEA we rely on an adequacy decision or the UK International Data Transfer Addendum / standard contractual clauses, together with the provider's security commitments.
6. How long we keep it
- Order and payment records — six years from the end of the tax year, as required by UK tax law.
- Returns and complaints — six years, so we can answer a later query about the same order.
- General enquiries that did not lead to an order — up to 24 months, then deleted.
- Marketing consent — until you unsubscribe, plus a short record of the unsubscribe itself.
7. Your rights
Under the UK GDPR and the Data Protection Act 2018 you can ask us to:
- confirm what data we hold about you and give you a copy (access);
- correct anything that is wrong (rectification);
- delete data we no longer need (erasure);
- restrict or object to certain processing;
- provide your data in a portable format;
- withdraw any consent you previously gave, at any time.
Email hello@lenauk.co.uk and we will respond within one month. We may ask you to confirm your identity first, and we may keep records we are legally required to hold (for example tax records) even after an erasure request.
8. Cookies
This site uses only what it needs to work: a session cookie that remembers your basket and your age confirmation for the length of your visit. We do not use advertising cookies and we do not run third-party tracking pixels. You can block or delete cookies in your browser settings; the site will still let you browse, but the basket may not be remembered.
9. Security
The site is served over HTTPS. Access to order data is restricted to the people who need it to pack, ship or support an order. Payment card data never touches our servers — it goes directly to the payment provider, which is PCI-DSS compliant.
10. Complaints
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
11. Changes to this policy
If we change how we use personal data we will update this page and change the date at the top. Material changes affecting existing orders will be emailed to the address on the order.
Company details
LENA is a trading name of LENA (LONDON) LIMITED, a company registered in England & Wales under company number 08361983. Registered office: Flat 6 Nassau House, 122 Shaftesbury Avenue, London W1D 5ER, United Kingdom. VAT no. GB 233726121.