Privacy Policy
Last updated: September 2026 • UK GDPR & DPA 2018
1. Introduction & Data Controller
Lather & Lore is a trading name of AHM Labs Ltd (Company Registration No. 16682410, registered in England and Wales), with registered office at 46 The Crescent, Swinton, Mexborough, S64 8ET, United Kingdom ("we", "our", "us").
AHM Labs Ltd is the Data Controller responsible for your personal data collected through this storefront in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This Privacy Policy informs you about how we collect, handle, and protect your personal data when you visit our website and purchase our botanical formulations, and explains your statutory privacy rights.
2. Data We Collect
- Identity & Contact Data: Full name, billing address, delivery address, email address, and telephone number.
- Transaction Data: Details about payments to and from you, order numbers, and products purchased. (We do not store full payment card numbers; all payments are processed securely by PCI-DSS certified payment gateways).
- Technical Data: Internet protocol (IP) address, browser type, operating system, and session tokens used to maintain your shopping cart.
3. How We Use Your Data & Lawful Basis
We only process personal data where permitted under UK law:
- Performance of a Contract: To process and dispatch your orders, manage payments, and provide Royal Mail shipment tracking updates.
- Legal Obligations: Maintaining financial accounts and VAT compliance for HMRC.
- Legitimate Interests: Preventing fraudulent transactions and improving our storefront performance.
4. Disclosures & Service Providers
We may share relevant personal data with trusted third parties strictly to fulfill your order:
- Delivery Couriers: Royal Mail and courier partners to transport parcels to your designated address.
- Payment Gateways: Encrypted payment providers for transaction authorization.
- E-Commerce Infrastructure: Cloud hosting and Vendure backend services ensuring secure transaction integrity.
5. Your Legal Rights
Under UK data protection law, you have statutory rights including:
- The right to request access to your personal data.
- The right to request correction of inaccurate data.
- The right to request erasure of your data ("right to be forgotten").
- The right to withdraw consent or object to processing.
To exercise any of these rights, please email us at [email protected].