Privacy policy

Privacy Policy

Last updated: 17 August 2026

This Privacy Policy explains how ICICOSMETIC LTD ("we", "us", "our"), trading as ici21, collects, uses, and protects your personal data when you visit ici21.com (the "Site") or place an order with us. It applies to customers and visitors in the United Kingdom. We are committed to protecting your privacy and handling your data in line with the UK GDPR and the UK Data Protection Act 2018 (and the EU GDPR where it applies to visitors in the EU).

Data controller

The data controller responsible for your personal data is ICICOSMETIC LTD, a company registered in England and Wales (Companies House No. 12145692), registered address: Office 6623, 58 Peregrine Road, Hainault, Ilford, Essex, IG6 3SZ, United Kingdom. For any privacy question, contact us at support@ici21.com.

What personal data we collect

  • Identity & contact data: name, email address, telephone number, billing and shipping address.
  • Order data: products ordered, order history, and payment information. Payments are handled by our payment providers; we do not store your full card details.
  • Account data (if you create an account): a hashed password and your saved preferences.
  • Communications: emails you send us and your customer-support history.
  • Technical data: IP address, browser type, device information, pages visited, and referring URL.
  • Marketing preferences: your consent to receive our newsletter.

How we collect your data

We collect data directly from you (when you fill in forms, place an order, or contact us), automatically (through cookies and analytics as you use the Site), and from third parties (such as payment processors confirming a transaction).

Legal basis for processing

Under Article 6 of the UK GDPR, we rely on the following legal bases:

  • Performance of a contract — to process and deliver your order.
  • Legitimate interests — fraud prevention, security, and improving our service.
  • Consent — marketing emails and non-essential cookies.
  • Legal obligation — keeping tax records and meeting anti-money-laundering duties.

How we use your data

  • process, fulfil, and deliver your orders;
  • provide customer support and respond to your enquiries;
  • send transactional messages such as order confirmations and shipping updates;
  • send marketing communications where you have given consent (you can opt out at any time);
  • detect, prevent, and investigate fraud and misuse;
  • comply with our legal and regulatory obligations.

Who we share your data with

We share your data only with parties that help us run our business, and only as needed:

  • Payment processors (e.g. Shopify Payments, Stripe) — to process payments securely.
  • Shipping carriers (e.g. Royal Mail, DPD, Evri, DHL) — to deliver your order.
  • Email service providers — to send transactional emails.
  • Analytics providers (e.g. Google Analytics, where used, with IP anonymisation).
  • Shopify — our e-commerce platform host.
  • Legal authorities — where required by law.

We do not sell your personal data.

International data transfers

Some of our processors (such as Stripe, Google, and Shopify) are based in or transfer data to the United States. Where data leaves the UK or the European Economic Area, the transfer is protected by appropriate safeguards such as Standard Contractual Clauses (SCCs) or an applicable adequacy decision.

How long we keep your data

  • Order records: 7 years, to meet UK tax law.
  • Marketing data: until you withdraw your consent.
  • Account data: until you delete your account.
  • Customer-support records: 3 years.

Your rights

Under the UK GDPR you have the right to: access a copy of your personal data; have inaccurate data corrected (rectification); have your data erased (the "right to be forgotten"); restrict how we process your data; data portability; object to processing, including direct marketing; withdraw consent at any time; and not be subject to solely automated decision-making.

To exercise your rights, email us at support@ici21.com. We respond to all requests within 30 days.

Right to complain

If you have a concern, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) — ico.org.uk. If you are located in the EU, you may also contact your local data protection authority.

Cookies

We use cookies and similar technologies. You have full control over which cookies you accept and can change your preferences at any time via the "Manage Preferences" link in our cookie banner or in the footer. For details, please see our Cookie Policy. EU & UK visitors: we only set marketing and analytics cookies after you give explicit consent; strictly necessary cookies (cart, checkout, security) are always active.

Children's data

Our Site is not directed at children, and we do not knowingly collect personal data from anyone under 16.

Security

We protect your data using SSL/TLS encryption, and our payment providers are PCI-DSS compliant. We follow recognised industry standards to keep your information safe, although no method of transmission over the internet is completely secure.

Changes to this policy

We may update this Privacy Policy from time to time. Any changes take effect when published here, so please check the "Last updated" date at the top.

Contact us

For any question about this policy or your personal data, email support@ici21.com.

Third-party tracking technologies we use

We use cookies, pixels, and similar technologies to measure website performance and traffic, improve our website and your experience, show relevant advertising on other websites, measure advertising effectiveness, and send personalised marketing emails (if you subscribe). EU & UK visitors: marketing and analytics tools are only enabled after you give explicit consent via our cookie banner.

  • Google Analytics 4 (GA4) — Google LLC / Google Ireland Ltd. Website analytics (anonymised IP, browsing behaviour, device, referrer, session, conversions). Legal basis: consent. Transfers: USA under the EU-US Data Privacy Framework. Privacy: policies.google.com/privacy.
  • Google Ads (conversion tracking & remarketing) — Google Ireland Ltd (EU/UK). Measures ad effectiveness and serves remarketing. Legal basis: consent. Transfers: USA under the EU-US DPF. Privacy: business.safety.google.
  • Meta Pixel (Facebook & Instagram) — Meta Platforms Ireland Ltd. Measures ad effectiveness, builds audiences, serves remarketing. Legal basis: consent. Transfers: USA under SCCs. Privacy: facebook.com/privacy/policy.
  • TikTok Pixel — TikTok Information Technologies UK Ltd / TikTok Technology Ltd (Dublin). Measures TikTok ad performance, builds audiences, serves remarketing. Legal basis: consent. Transfers: under SCCs. Privacy: tiktok.com privacy.
  • Shopify (platform & native analytics) — Shopify International Ltd, Dublin, Ireland. Powers the store, processes orders, manages the cart, provides built-in analytics. Legal basis: contract performance. Privacy: shopify.com/legal/privacy.

You can withdraw consent or change your cookie choices at any time via the "Manage Preferences" link in our cookie banner or footer.

United States — your state privacy rights

If you are a resident of California or another U.S. state with a comprehensive privacy law, you have additional rights regarding your personal information, including the right to know, access, correct, and delete personal information; to opt out of the "sale" or "sharing" of personal information; to limit the use of sensitive personal information; and to non-discrimination for exercising these rights. We do not sell your personal information for money. To submit a request, email support@ici21.com. We respond within 45 days as required by the CCPA.

We honor the Global Privacy Control (GPC) browser signal as a valid opt-out of sale/sharing for the browser on which it is enabled. Under the CCPA/CPRA, "sharing" includes disclosing personal information to advertising partners (such as Google, Meta, and TikTok) for cross-context behavioural advertising; you can opt out at any time by enabling GPC or by using the "Manage Preferences" link in our footer.

Children's privacy (COPPA): we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact support@ici21.com and we will delete it.

ICI21 is operated by ICICOSMETIC LTD · Company No. 12145692 · Registered office: Office 6623, 58 Peregrine Road, Hainault, Ilford, Essex, IG6 3SZ, United Kingdom · support@ici21.com