Privacy Policy
Last updated: 5 September 2026
Who we are
LETOILE LTD is the controller of personal information where we determine why and how that information is used.
LETOILE LTD Company number: 15289880
71–75 Shelton Street Covent Garden London WC2H 9JQ United Kingdom
ICO registration reference: ZB765019
Privacy contact: [email protected]
Information we may process
Depending on how you interact with us, this may include:
- name;
- email address;
- telephone number where provided;
- billing and delivery addresses;
- orders and transaction history;
- products purchased;
- delivery and tracking information;
- returns, refunds, replacements and complaints;
- communications with us;
- photographs or videos supplied for a claim;
- IP address;
- browser and device information;
- session and security information;
- referral information and UTM parameters;
- cookie and consent preferences;
- fraud-prevention and transaction-risk signals;
- product-safety incident information.
Payment providers may process payment credentials directly.
Where this happens, we aim not to store complete payment-card credentials ourselves.
Why we use information
We may use personal information to:
- process and fulfil orders;
- administer payments;
- deliver products;
- provide customer service;
- administer cancellations and refunds;
- investigate damaged, faulty, incorrect or missing goods;
- identify fraud or misuse;
- maintain security;
- investigate product-safety incidents;
- carry out corrective action or recalls;
- comply with accounting, tax, regulatory and legal duties;
- establish, exercise or defend legal claims;
- operate and improve the website;
- measure website performance where permitted;
- conduct marketing where lawful.
Lawful bases
Depending on the purpose, we may rely on:
- performance of a contract;
- legal obligation;
- legitimate interests;
- recognised legitimate interests where the statutory conditions apply;
- consent; or
- another lawful basis available under UK data-protection law.
Where we rely on ordinary legitimate interests, we assess the purpose, necessity and impact on the rights and interests of affected people.
Fulfilment and delivery
We may share information reasonably necessary to fulfil an order with warehouses, fulfilment providers and delivery carriers.
This may include:
- name;
- delivery address;
- contact details;
- order details;
- information needed to deliver or resolve an order.
Service providers
We may use providers for:
- payments;
- fraud prevention;
- hosting;
- cloud infrastructure and document storage;
- email;
- customer support;
- analytics;
- advertising and measurement;
- accounting;
- professional services;
- compliance.
International transfers
We use service providers for infrastructure and email delivery, including Cloudflare and Brevo, and for order fulfilment, including CJ Dropshipping. If you choose a social sign-in option, information may also be processed by the relevant identity provider, such as Google or Facebook.
These providers may process personal information in the United Kingdom and in other countries. Where a transfer outside the United Kingdom requires a safeguard under UK data-protection law, we will rely on an applicable adequacy regulation or an appropriate contractual safeguard, such as the UK International Data Transfer Agreement or UK Addendum, as applicable. You may contact [email protected] for further information about safeguards relevant to your personal information.
Refund and fraud monitoring
We may analyse previous orders, claims, refunds, replacements and associated signals to identify unusual behaviour and protect the business and customers.
We may use automated tools to flag cases for review.
Material decisions concerning discretionary refund concessions or additional verification are subject to human review.
We do not use automated profiling as a mechanism for removing statutory consumer rights.
Product safety
Where a potential safety issue is reported, we may retain and use relevant information to investigate the event, identify affected goods or customers, perform corrective action, issue safety communications or recalls, and cooperate with regulators.
Retention
We keep personal information only for as long as it is reasonably necessary for the relevant purpose.
Certain transaction and accounting records may need to be retained for approximately six years or longer where required by law, tax rules, an investigation or legal proceedings.
Other categories may have shorter or different retention periods.
We will delete or anonymise information when continued identification is no longer justified.
Security
We use reasonable technical and organisational measures designed to protect personal information.
No internet-based system can be guaranteed to be completely secure.
Your rights
Depending on the circumstances, UK data-protection law may give you rights concerning:
- access;
- correction;
- erasure;
- restriction;
- objection;
- portability;
- withdrawal of consent;
- automated decision-making.
Some rights are subject to statutory conditions and exceptions.
Contact:
We may need to verify identity before responding to certain requests.
Complaints
Please contact us first if you have a concern.
You may also have the right to complain to the Information Commissioner's Office.
Changes
This notice may be updated when our operations, technology, service providers or legal obligations change.