Privacy Policy

NYL Enterprise Limited (“we”, “us”, “GlowQuest”) operates the online beauty shop at glowquest.co.uk. We are the data controller responsible for the personal data described in this policy.

NYL Enterprise Limited is a company registered in England & Wales, company number 16162744, with its registered office at 19 Colonial Road, Slough, England, SL1 1RU.

For any privacy question, or to exercise any of your rights, contact us at privacy@glowquest.co.uk. For general enquiries, orders and returns, contact enquiries@glowquest.co.uk.

We process personal data in line with the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR) and the Data (Use and Access) Act 2025.

We collect only what we need to run the shop and fulfil your orders:

• Account details: your name and email address, and a password that we store only in a securely hashed form (we never see or store it in plain text).
• Order and delivery details: the products you buy, the price paid, your delivery address, your chosen delivery option, your order history, and your contact email.
• Payment information: card payments are processed by Stripe. Your full card details are entered directly with Stripe and never reach or are stored on our systems. We keep only a payment reference and the payment outcome.
• Basket and wishlist: the items you add, linked either to your account or, if you are not logged in, to a random guest token stored in your browser.
• Messages you send us: the content of any enquiry, complaint or return request, and our correspondence with you about it.
• Usage and device information: basic technical data such as your device type and the pages you view, and — only if you accept analytics cookies — aggregate analytics about how the site is used.

Almost all of the personal data we hold comes directly from you: when you create an account, place an order, contact us, or use the site. Some technical and analytics data is collected automatically by your browser as you use the site (analytics only with your consent). Our payment processor, Stripe, confirms to us whether a payment succeeded or failed. We do not buy personal data or obtain it from data brokers.

We use your personal data for the following purposes, each with its lawful basis under the UK GDPR:

• To take and fulfil your orders — taking payment, arranging delivery, and sending order confirmations and dispatch updates. Lawful basis: performance of our contract with you.
• To manage your account and let you see your order history, basket and wishlist. Lawful basis: performance of our contract, and our legitimate interests in running an account system.
• To answer your enquiries, complaints and returns. Lawful basis: performance of our contract, and our legitimate interests in supporting our customers.
• To keep the site secure and prevent fraud, including our payment processor’s fraud checks on transactions. Lawful basis: our legitimate interests in protecting the business and our customers, and compliance with legal obligations.
• To meet our legal and tax obligations, such as keeping records of sales. Lawful basis: legal obligation.
• To send you marketing emails, where you have asked to receive them, or where you are an existing customer and we are telling you about similar products (see “Marketing” below). Lawful basis: your consent, or our legitimate interests under the existing-customer (“soft opt-in”) rule in PECR.
• To understand and improve how the site is used through analytics, where you have accepted analytics cookies. Lawful basis: your consent.

Where we rely on legitimate interests, those interests are: operating and securing an online shop, preventing fraud and misuse, supporting customers, and telling existing customers about similar products. We have balanced these against your rights, and you can object at any time (see below).

The Glow Finder works entirely in your browser. When you choose a skin priority, the site picks matching products on your device. Your selection is not sent to us, is not stored, and is not linked to you in any way. It is a simple, rule-based suggestion tool, not profiling, and it involves no personal data.

Any other product suggestions on the site are based on general product information (such as category or brand), not on an automated profile of you.

We do not make decisions about you that have a legal or similarly significant effect using solely automated processing. Our payment processor, Stripe, carries out automated fraud and security checks on card payments, which can result in a payment being declined; if that happens you can contact us and pay another way.

We share personal data only with the service providers that make the shop work, and only as far as they need it. These are:

• Stripe — our payment processor, to take and secure your payment.
• Resend — our email provider, to send order confirmations, dispatch notifications and account emails (and marketing emails if you have opted in).
• Google Analytics — our analytics provider, only if you accept analytics cookies.
• Our hosting provider — which hosts the website and database on our behalf in the United Kingdom.
• Product suppliers, fulfilment and dispatch providers — to fulfil your order we may source products from UK-based product suppliers and use fulfilment or dispatch providers to prepare and send your order. Where one of them prepares or dispatches your order, we share the delivery details needed to do so (such as your name, delivery address and, where needed, contact details).
• Delivery couriers — including courier companies (for example Royal Mail, Evri and others we may use from time to time), to deliver your order and handle returns. They receive the delivery details needed to get your parcel to you.
• Professional advisers and authorities — such as our accountants, or law enforcement and regulators, where we are legally required to share data.

We never sell your personal data to anyone, and we never share it for anyone else’s marketing.

Your data is stored in the United Kingdom. Some of our providers, such as Stripe and Google, may process data outside the UK. Where they do, that transfer is protected by appropriate safeguards recognised under UK data protection law — such as a UK adequacy decision, the UK International Data Transfer Agreement, or standard contractual clauses with the UK Addendum.

We keep personal data only for as long as we need it:

• Order and transaction records: kept for six years after the end of the relevant financial year, to meet our tax and accounting obligations.
• Account data: kept while your account is open. If you close your account, we delete or anonymise it, other than records we must keep for the period above.
• Support and complaint correspondence: kept for up to two years after the matter is resolved.
• Marketing preferences: kept until you unsubscribe or object, plus a suppression record so we do not contact you again.
• Analytics data: retained by Google Analytics for the period set in our analytics configuration, and held only in aggregate.

We use a small number of strictly necessary cookies and similar storage to make the site work — for example to remember your bag and keep you signed in. These do not require your consent.

We use analytics cookies (Google Analytics) only after you accept them. Until you accept, no analytics cookies are set and no analytics data is collected, and the site works exactly the same if you decline. We do not currently use any advertising or marketing cookies; if we introduce them in future, they will be off by default and set only with your consent.

You can change your mind at any time. Your cookie choice is as easy to withdraw as it was to give: open Cookie Settings to review or change it, and any analytics that was running stops.

We will only send you marketing emails if you have asked us to, or if you have bought from us and we are telling you about our own similar products (the “soft opt-in” permitted by PECR). Every marketing email has an unsubscribe link, and you can opt out at any time by using it or by emailing privacy@glowquest.co.uk. We will always give you a clear way to say no, and we will honour it.

Under UK data protection law you have the right to:

• be informed about how we use your data (this policy);
• ask for a copy of the personal data we hold about you (access);
• ask us to correct data that is wrong or incomplete (rectification);
• ask us to delete your data in certain circumstances (erasure);
• ask us to restrict how we use your data in certain circumstances;
• ask for your data in a portable, machine-readable format (portability);
• object to processing based on our legitimate interests, and to direct marketing (see below);
• withdraw any consent you have given, such as for analytics, at any time.

To exercise any of these, email privacy@glowquest.co.uk. We will respond within one month. Exercising your rights is free, and the site works the same whether or not you do.

If you are unhappy with how we have handled your personal data, please tell us at privacy@glowquest.co.uk so we can put it right. We will:

• acknowledge your complaint within 30 days of receiving it;
• investigate it properly and keep you informed of progress;
• tell you the outcome, and what we have done, without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, although we would ask you to contact us first so we can try to resolve things. You can reach the ICO at:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Helpline: 0303 123 1113. Website: ico.org.uk.

GlowQuest is intended for adults and we do not knowingly collect personal data from children under 18. If you believe a child has given us their personal data, contact privacy@glowquest.co.uk and we will delete it.

We protect your data with appropriate technical and organisational measures, including encryption in transit (HTTPS), hashed passwords, access controls, and using reputable providers such as Stripe so that sensitive payment data never reaches our systems. No method of transmission or storage is completely secure, but we take the security of your data seriously.

We may update this policy from time to time. When we make a significant change we will update the date at the top of this page, and where appropriate we will let you know.