PRIVACY POLICY
Last updated 28.01.2026
General
This Data Privacy Policy (“Policy”) describes how: KAZ Europe SARL; Osprey Europe Ltd and HOT UK Ltd together “HOT” (“we”, “us”, or “our”) collects, uses, discloses, stores and protects personal data when you access or use our websites, mobile applications, e-commerce services, products or other services (collectively the “Services”).
We are committed to protecting your privacy and handling your personal data in a transparent and secure manner, in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR) and the Swiss Federal Act of Data Protection (nFADAP / revDSG).
Data Controller
For the purposes of applicable data protection laws, HOT is the Data Controller.
Data Controller:
KAZ Europe SARL: company incorporated in accordance with the laws of Switzerland with the registered address at: Route de la Chaux 4, 1030, Bussigny, Switzerland.
Osprey Europe Ltd: incorporated and registered in England and Wales with the registered address at: Talon House, Aston Way, Poole, Dorset, England, BH12 4FE.
HOT UK Ltd: a company incorporated under the laws of England and Wales with the registered address at: 280 Bishopsgate, London, United Kingdom.
Email: LegalEMEA@helenoftroy.com
As Data Controller, we determine the purposes and means of processing your personal data.
Definitions
“Personal Data” means any information that identifies or can reasonably be linked to an identified or identifiable individual.
“Processing” means any operation performed on Personal Data, including collection, use, record, storage, disclosure, transfer, retention or deletion.
“Data Processor” means a third party that processes Personal Data on behalf of the Data Controller.
How We Collect Personal Data
We collect Personal Data in the following ways:
Directly from you, when you:
- Create an account
- Place an order or subscribe to our Services
- Contact us or communicate with us
- Provide information through forms or settings
Automatically, when you use the Services, through:
- Cookies and similar technologies
- Log files and usage data
- Device browser information
From third parties, where permitted by law, such as:
- Payment, delivery or technical service providers
- Analytics and technical service providers
- Business partners or platforms you use to access our Services
Where Personal Data is collected from third parties, we take reasonable steps to ensure that you are informed in accordance with applicable laws.
Categories of Personal Data
Depending on how you use the Services, we may process the following categories of Personal Data:
- Identification and contact information (e.g. full name, e-mail address, postal address, phone number, billing / shipping address)
- Account and authentication data
- Transaction, billing and payment-related data
- Technical data (IP address, device identifiers, operating systems, browser types, logs)
- Usage and interaction data (e.g. pages viewed, actions taken etc)
- Communication with us (emails, messages, support requests, customer feedback)
- Preferences and consent records
We do not intentionally process special categories of personal data unless explicitly stated and permitted by law.
Purpose and Legal Basis for Processing
We process Personal Data only for the purposes described below:
Service Provision and Contract Performance
- Provision, operation and maintenance of the Services
- User account creation and management
- Order fulfillment and service delivery
- Customer support and communications
Legal and Regulatory Compliance
- Compliance with accounting, tax and record keeping obligations
- Responding to lawful requests from authorities
Legitimate Interests
- Security, fraud prevention and risk management
- System performance monitoring and internal analytics
- Service improvement and operational efficiency
These interests are balanced against user rights.
Consent-Based Processing
Where required by law, we process personal data based on your consent, including for:
- Marketing and proportional communications
- Non-essential cookies and tracking technologies
- Optional analytics, personalization and profiling
- Certain data sharing activities
You may withdraw your consent at any time.
Analytics, Marketing and Targeted Advertising
Analytics
We use analytics tools (such as Google Analytics) to understand user interactions with our Services and improve performance. This may include tracking pages visited, clicks and usage patterns. Personal data processed may include IP address, device type and browser information.
Targeted Advertising and Marketing
We may use personal data to provide personalized marketing measures and advertisements. Data may include preferences, demographic information, and browsing behaviour. Third-party advertising networks may also be used to deliver relevant ads.
Consent and Control
The above-mentioned activities are subject to your explicit consent. You may manage your preferences at any time:
- Via cookie settings
- In your account settings (if applicable)
- By opting-out links in marketing materials
Withdrawal of consent does not affect the lawfulness of prior processing.
Cookies and Tracking Technologies
We use cookies and similar technologies to operate and improve the Services. Essential cookies are required for the proper functioning of the Services and do not require consent. Non-essential cookies (analytics, marketing) are used only after you provide consent. Users can manage or disable cookies through your browser cookie settings. Disabling cookies may affect functionality of the Services.
Data Sharing and Recipients
We may share personal data with:
- Service providers acting as Data Processors on our behalf (e.g. hosting, analytics, payment processing)
- Professional advisors (legal, accounting, auditing)
- Authorities where required by law
- Third parties in connection with a business transfer, merger, acquisition or asset sale
All Data Processors are contractually required to process Personal Data only on our documented instructions and to implement appropriate security measures.
International Data Transfers
Personal Data may be transferred to and processed in countries other than your country of residence. Where required by law, we ensure appropriate safeguards, such as standard contractual clauses or equivalent mechanisms.
Data Retention
We retain Personal Data only for as long as necessary to fulfill the purposes described in this Policy or to comply with legal obligations. When no longer required, personal data is securely deleted or anonymized.
Data Security
We implement appropriate technical and organisational measures to protect Personal Data against unauthorized access, loss, misuse, alteration or disclosure. However, no system can guarantee absolute security.
Your Rights
Depending on your jurisdiction you may have a right to:
- Access your Personal Data
- Correct or update inaccurate data
- Request deletion of your data
- Restrict or object to processing
- Withdraw consent at any time
- Request data portability
- Lodge a complaint with a supervisory authority
To exercise your rights please contact us using the details below.
Children’s Privacy
Our Services are not directed to children. We do not knowingly collect Personal Data from children without appropriate authorization. If we become aware that we have collected such data, we will take appropriate steps to delete it.
Third Party Services
The Services may include links or integrations with third-party services. We are not responsible for the privacy practices or content of those third parties. Users should check relevant policies on such third-party websites before submitting any personal data.
Changes to this Policy
We may update this Policy from time to time. Any changes will be posted on this page with an updated “last updated” date. Continued use of the Services after changes take effect constitutes acceptance of the revised Policy.
Contract Information
If you have questions, concerns, or requests regarding this Data Privacy Policy or our data practices, please contact us at: LegalEMEA@helenoftroy.com