Skip to content

Privacy policy

Website privacy notice

Last updated: 24 September 2026

1. Introduction

This privacy notice explains how we collect and use your personal data when you use our website www.holylama.co.uk, buy from us or contact us.

By giving us your data, you confirm that you are at least 13 years old.

Holy Lama Naturals Ltd is the controller of your personal data (referred to as 'we', 'us' or 'our' in this notice).

Our details: Holy Lama Naturals Ltd, company number 07372873, registered office 11 Sycamore Avenue, Hatfield, Hertfordshire, AL10 8LZ. Correspondence address: P O Box 482, Hatfield, AL10 1GG. Email: contact@holylama.co.uk. Phone: 07352330999.

It is important that the information we hold about you is accurate and up to date. Please let us know if your details change by emailing contact@holylama.co.uk.

2. What data we collect, why, and our lawful basis

Personal data means any information that can identify you. It does not include anonymised data. We may use the following:

  • Communication Data: anything you send us through our website contact form, email, text, social media messages or posts. We use this to reply to you, to keep records and to establish, pursue or defend legal claims. Our lawful basis is our legitimate interests in doing these things.
  • Customer Data: details of your purchases, such as your name, title, billing and delivery address, email address, phone number and order details. Card payments are handled by our payment providers, and we do not see or store your full card number. We use this data to supply your order and to keep records of it. Our lawful basis is the performance of our contract with you, or taking steps at your request before entering into it.
  • User Data: how you use our website, and anything you post on it, such as reviews. We use this to run and secure our website, to keep back ups and to show relevant content. Our lawful basis is our legitimate interests in running our website and business properly.
  • Technical Data: your IP address, login data, browser and device details, time zone, and how you use our website, such as pages viewed and how long you stay. Where this is collected through analytics or advertising cookies, we only do so with your consent, which you can withdraw at any time. We use it to understand how our website is used, to improve it, and to measure and show our advertising. Where we use this data to keep the website secure, our lawful basis is our legitimate interests.
  • Marketing Data: your preferences for receiving marketing from us and your communication preferences. We use this to run promotions such as competitions and prize draws, and to understand how well our marketing works. Our lawful basis is our legitimate interests in developing our products and growing our business, or your consent where the law requires it.

We use Customer, User, Technical and Marketing Data to show you relevant content and adverts, including adverts on Facebook, Instagram and Google, and to measure how well they work. Where this relies on cookies or similar technology, we only do it with your consent.

Sensitive data. We do not collect sensitive data about you, such as details of your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health, or genetic and biometric data. We do not collect information about criminal convictions.

If we need personal data to fulfil your order and you do not provide it, we may not be able to complete the order. If so, we will tell you at the time.

We only use your personal data for the purpose we collected it for, or a compatible purpose. If we need to use it for an unrelated purpose, we will tell you and explain the legal basis.

Automated decisions. We do not make decisions about you by automated means that have legal or similarly significant effects. If you consent to advertising cookies, Meta and Google may use information about your visits to our website to build a profile of your interests, so that they can show you relevant adverts.

3. How we collect your personal data

We collect data you give us directly, for example when you place an order, fill in a form or email us. We may also collect data automatically when you use our website, through cookies and similar technologies. See our Cookie Policy for details.

We may receive data from third parties such as analytics providers (for example Google), advertising networks (for example Meta), search information providers, and providers of technical, payment and delivery services. We may also receive data from publicly available sources, such as Companies House.

4. Marketing messages

We send marketing emails and texts through Klaviyo. We will only send them if you have agreed to receive them, or if you have bought from us or asked us about our products and did not opt out when you gave us your details. You can opt out at any time. Business customers may receive marketing emails from us without having opted in, and can also opt out at any time.

You can stop marketing messages at any time by using the unsubscribe link in any message, replying STOP to a text, or emailing contact@holylama.co.uk. Unsubscribing from marketing does not stop messages about your orders.

We will never share your personal data with another company for its own marketing without your express consent.

5. Who we share your data with

We share personal data only as needed with:

  • Shopify, which runs our online shop and checkout;
  • payment providers, including PayPal, to take payment;
  • our fulfilment partners and couriers, such as Royal Mail, to deliver your order;
  • Klaviyo, to send emails and texts you have agreed to receive;
  • review services, such as Trustpilot, to invite you to review your purchase and to publish reviews;
  • Google, Meta and Hotjar, for analytics and advertising where you have agreed to cookies;
  • our professional advisers, including accountants, lawyers, insurers and banks;
  • government bodies, such as HMRC, where the law requires it;
  • a buyer or successor if we sell, transfer or merge part of our business.

We never sell your personal data. We require everyone we share data with to keep it secure, and we only allow service providers to use it for the purposes we set and in line with our instructions.

6. Sending your data outside the UK

Some of the services we use are based outside the UK, mainly in the United States and the European Economic Area. When your data is sent abroad, we make sure it is protected by one of these: the country has been approved by the UK Government as providing adequate protection (this includes the European Economic Area); the US company is certified under the UK Extension to the EU US Data Privacy Framework (the UK US data bridge); or we use contract terms approved for UK transfers, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

7. Keeping your data secure

We have measures in place to prevent your personal data from being lost, used, changed or disclosed without permission. Only people and partners who need your data for business reasons can access it, and they must keep it confidential.

We have procedures to deal with any suspected personal data breach, and we will tell you and the Information Commissioner's Office if the law requires us to.

8. How long we keep your data

We keep personal data only as long as we need it for the purposes we collected it for, including to meet legal, accounting or reporting requirements. To decide how long, we consider the amount, nature and sensitivity of the data, the risk of harm from unauthorised use, why we hold it, and legal requirements.

For tax purposes, the law requires us to keep basic information about customers (including contact, identity, financial and transaction data) for six years after they stop being customers.

We may anonymise your data for research or statistical purposes, in which case we may use it indefinitely without telling you.

9. Your rights

Under UK data protection law, you have the right to ask for a copy of your personal data, to have it corrected or deleted, to restrict or object to how we use it, to have it transferred to you or another organisation, and, where we rely on your consent, to withdraw that consent at any time. You can find out more about your rights on the ICO website at https://ico.org.uk/for-the-public/.

To use any of these rights, please email contact@holylama.co.uk. There is usually no fee, but we may charge a reasonable fee, or refuse, if a request is clearly unfounded, repetitive or excessive. We may need to ask for information to confirm your identity before we respond, to protect your data.

We aim to respond within one month. If your request is complex, or you have made several requests, it may take longer, and we will tell you if so.

10. Complaints about how we use your data

If you are unhappy with how we have used your personal data, please tell us first so we can put it right. Email contact@holylama.co.uk with the word 'Privacy' in the subject line, or write to us at P O Box 482, Hatfield, AL10 1GG. We will acknowledge your complaint within 30 days, look into it, keep you updated, and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection, at https://ico.org.uk/make-a-complaint/.

11. Links to other websites

Our website may include links to other websites, plug ins and apps. Clicking on them may allow third parties to collect or share data about you. We do not control these websites and are not responsible for their privacy notices. When you leave our website, please read the privacy notice of every website you visit.

12. Cookies

You can set your browser to refuse all or some cookies, or to alert you when websites set or access them. If you disable cookies, some parts of our website may not work properly. For more about the cookies we use and how to change your choices, see our Cookie Policy.