Last updated: 17 July 2026
This Privacy Policy explains how Zota Cosmetics Ltd (“Zota”, “we”, “us” or “our”) collects, uses, shares and protects personal information when you visit www.zotacosmetics.com, purchase our products, contact us, subscribe to marketing, leave a review or otherwise interact with us.

1. WHO WE ARE

Zota Cosmetics Ltd is the controller responsible for the personal information described in this policy.
• Company number: 16822308
• Registered office: 3rd Floor, 86–90 Paul Street, London, EC2A 4NE
• Email: info@zotacosmetics.com
• Telephone: 07304 294923
Zota Cosmetics Ltd is registered in England and Wales and is not currently VAT registered.

2. PERSONAL INFORMATION WE COLLECT

Depending on how you interact with us, we may collect:
• Identity and contact information, such as your name, billing and delivery addresses, email address and telephone number.
• Order and transaction information, such as products purchased, order value, delivery method, refunds and correspondence about an order.
• Payment-related information. Payments are processed by providers such as Shopify Payments and PayPal. We do not ordinarily receive or store your complete payment-card number.
• Account and preference information, including login details, saved preferences, newsletter choices and communication preferences.
• Technical and usage information, such as IP address, browser, device identifiers, cookie identifiers, pages viewed, referral source and interactions with our website and adverts.
• Customer-service information, including emails, telephone enquiries and Shopify Inbox messages.
• Reviews and other content you choose to submit, including information submitted through Judge.me.
• Marketing and advertising information, including whether you opened or interacted with an email or advert and audiences inferred by our advertising providers.

3. HOW WE COLLECT INFORMATION

We collect personal information directly from you, automatically through cookies and similar technologies, and from service providers such as Shopify, payment providers, Royal Mail, analytics providers, advertising platforms and review services.

4. HOW AND WHY WE USE PERSONAL INFORMATION

To process and fulfil orders. We use contact, order and payment-related information to take payment, confirm orders, arrange delivery, manage returns and provide customer support. Our lawful basis is performance of our contract with you and, where relevant, compliance with legal obligations.
To operate, secure and improve our business. We use technical, usage and customer-service information to maintain the website, prevent fraud, troubleshoot problems, understand performance and improve our products and services. Our lawful basis is our legitimate interests in running a secure and effective retail business, except where consent is required for cookies or similar technologies.
To communicate with you. We send service messages about orders, deliveries, returns, security and changes that affect you. Our lawful basis is performance of a contract, compliance with law or our legitimate interests, depending on the message.
To send marketing. Where permitted, we use contact and engagement information to send news, product launches and offers. We rely on consent where required and may rely on the UK “soft opt-in” for marketing similar products to existing customers where the legal conditions are met. You can unsubscribe at any time using the link in an email or by contacting us.
To measure and personalise advertising. With your consent where required, Google Analytics, Google Ads, Meta/Facebook Pixel and TikTok Pixel may help us measure website activity, create audiences and show more relevant advertising. You can change your choices through our cookie controls.
To comply with law and protect rights. We may use information for accounting, tax, regulatory, product-safety, fraud-prevention, dispute-resolution and legal-claim purposes. Our lawful basis is legal obligation or legitimate interests in protecting our rights and those of others.

5. WHEN WE SHARE PERSONAL INFORMATION

We may share only the information reasonably required with:
• Shopify, which hosts our online store and supports checkout, store administration, Shopify Payments, Shopify Inbox and Shopify Email.
• PayPal and other payment or fraud-prevention providers selected at checkout.
• Royal Mail and service providers involved in packing, dispatch, delivery and returns.
• Judge.me, which provides product-review services.
• Google, including Google Analytics and Google Ads.
• Meta Platforms, including the Facebook/Instagram advertising pixel.
• TikTok, including the TikTok advertising pixel.
• Professional advisers, insurers, auditors, banks, regulators, law-enforcement bodies and courts where reasonably necessary.
• A purchaser, investor or adviser in connection with a genuine sale, restructuring or financing of all or part of our business, subject to appropriate confidentiality arrangements.
Some providers act as our processors and others act as independent controllers. Their own privacy notices may also apply, particularly when they process payments, provide social-media services or determine advertising activities.

6. INTERNATIONAL TRANSFERS

Some service providers may process personal information outside the United Kingdom. Where UK data-protection law requires safeguards, we use an applicable lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses. Contact us if you would like further information about the safeguards relevant to your information.

7. HOW LONG WE KEEP INFORMATION

We keep personal information only for as long as reasonably necessary for the purpose collected, including legal, accounting and dispute requirements. In general:
• Order, payment, tax and refund records are normally retained for up to six years after the relevant financial year or transaction, and longer if a dispute or legal requirement applies.
• Customer-service correspondence is normally retained for up to two years after the enquiry closes, unless it relates to an order, complaint, product-safety issue or legal claim requiring longer retention.
• Marketing information is retained until you unsubscribe, withdraw consent or after a reasonable period of inactivity, after which we may retain limited suppression information to respect your choice.
• Review content may remain published until removed under our review procedures or the Judge.me service, subject to legal and platform requirements.
• Cookie and advertising identifiers are retained for the periods shown through our cookie controls or the relevant provider, subject to your choices.

8. YOUR DATA-PROTECTION RIGHTS

Depending on the circumstances, you may have rights to be informed, access your personal information, correct inaccurate information, request erasure, restrict processing, object to processing, receive portable information and withdraw consent. You have an absolute right to object to direct marketing. These rights are not always absolute and legal exceptions may apply.
To exercise a right, email info@zotacosmetics.com. We may need to verify your identity. You also have the right to complain to the UK Information Commissioner’s Office at www.ico.org.uk, although we would appreciate the opportunity to address your concern first.

9. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies as explained in our Cookie Policy. Strictly necessary technologies support functions such as checkout and security. Where required, analytics, personalisation and advertising technologies are used only after you provide consent. You can change or withdraw consent through the “Cookie settings” link on our website.

10. SECURITY

We use proportionate administrative, technical and organisational safeguards designed to protect personal information. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security.

11. CHILDREN

Our website is not directed to children under 13 and we do not knowingly collect their personal information. Customers under 18 should use the website only with the involvement of a parent or guardian.

12. AUTOMATED PROCESSING

Advertising platforms and fraud-prevention providers may use automated tools or profiling. Zota does not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Payment providers may make their own fraud or payment decisions under their privacy notices.

13. CHANGES TO THIS POLICY

We may update this policy to reflect changes in law, technology or our services. The current version will be posted on this page with a revised “Last updated” date. Where appropriate, we will provide additional notice.

14. CONTACT US

For privacy questions or rights requests, email us at info@zotacosmetics.com.