A link to set a new password will be sent to your email address.
# PRIVACY POLICY
**Last updated: 2 October 2026**
This Privacy Policy explains how **RLP Consult Ltd**, trading through **Ruby Lou**, collects, uses, stores and protects your personal information when you visit our website, contact us, create an account or purchase products from us.
We take your privacy seriously and only collect and use personal information where we have a legitimate reason to do so.
## 1. WHO WE ARE
The data controller responsible for your personal information is:
**RLP Consult Ltd**
Trading as **Ruby Lou**
Medfab House
Clipper Close
Rochester
Kent
ME2 4QR
United Kingdom
**Email:** [info@rubylou.co.uk](mailto:info@rubylou.co.uk)
**Website:** rubylou.co.uk
For the purposes of UK data protection legislation, RLP Consult Ltd is the controller of personal information collected through this website.
Our primary data protection obligations arise under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), as amended, and the Data (Use and Access) Act 2025.
Where other privacy legislation applies to our processing because of where a customer is located or how we offer our services, we will also respect any mandatory rights provided by that legislation.
## 2. WHAT THIS WEBSITE IS USED FOR
Ruby Lou is an online retail website.
This website is **not used to provide consultations, medical advice or healthcare services**, and we do not intentionally collect medical records or health information through this website.
Please do not submit diagnoses, medical histories, medical records or other unnecessary health information through checkout, order notes, contact forms or other areas of this website.
If you communicate with RLP Consult Ltd separately in connection with another service that involves different categories of personal information, separate privacy information may apply to that service.
## 3. INFORMATION WE COLLECT
The information we collect depends upon how you interact with us.
When you place an order or create an account, we may collect:
* your name;
* email address;
* billing address;
* delivery address;
* account information;
* products ordered;
* order value;
* order history;
* payment status;
* refund information;
* correspondence relating to your order; and
* any information you voluntarily provide that is reasonably necessary to fulfil your order.
When you use our website, we may also automatically receive certain technical information, which may include:
* IP address;
* browser type;
* device type;
* operating system;
* referring website;
* pages visited;
* date and time of access;
* website interactions; and
* information collected through cookies or similar technologies.
We aim to collect only information that is reasonably necessary for the relevant purpose.
## 4. HOW WE USE YOUR INFORMATION
We may use your personal information to:
* receive and process orders;
* identify payments;
* deliver products;
* contact you about your order;
* create and administer customer accounts;
* provide customer service;
* process cancellations, returns and refunds;
* maintain transaction and accounting records;
* comply with tax, accounting and other legal requirements;
* prevent or investigate fraud, misuse or security incidents;
* protect our website, customers and business;
* establish, exercise or defend legal claims;
* respond to enquiries;
* improve the operation and security of our website; and
* send marketing communications where permitted by law.
We will not use personal information for a materially incompatible purpose unless we have a lawful basis for doing so.
## 5. OUR LAWFUL BASES FOR PROCESSING
Under UK data protection law, we must have a lawful basis for processing personal information.
Depending upon the circumstances, we may rely on the following:
### Contract
We process information where it is necessary to take steps at your request before entering into a contract or to perform our contract with you.
For example, we need your name, delivery address and order information to fulfil an order you have placed.
### Legal obligation
We may process and retain information where necessary to comply with legal obligations, including accounting, tax and regulatory requirements.
### Legitimate interests
We may process information where it is reasonably necessary for our legitimate business interests and those interests are not overridden by your rights and freedoms.
This may include:
* operating and securing our website;
* preventing fraud;
* maintaining appropriate business records;
* responding to customer enquiries;
* managing disputes;
* protecting our legal rights; and
* improving our services.
### Consent
Where consent is required, we may process information on the basis of your consent.
You can withdraw your consent at any time. Withdrawal does not affect processing that lawfully took place before consent was withdrawn.
## 6. BANK TRANSFER PAYMENTS
At present, payments for orders are made by **bank transfer**.
We do not collect or store your online banking credentials.
When you make a bank transfer, our bank may provide us with information associated with the transaction, such as:
* payer name;
* payment amount;
* payment reference;
* date of payment; and
* other information ordinarily supplied as part of a bank transaction.
We use this information to identify and reconcile your payment, fulfil your order, maintain financial records and deal with refunds or payment queries.
Your bank and our bank process information independently in accordance with their own legal and privacy obligations.
## 7. FUTURE PAYMENT PROVIDERS
We may introduce third-party payment providers in the future to enable payment by debit card, credit card or other payment methods.
Where a third-party payment provider is used, some payment and transaction information may be provided directly to that provider.
We will not ordinarily receive or store your complete card details where these are processed securely by an independent payment provider.
Payment providers may process information for purposes including payment authorisation, fraud prevention, regulatory compliance and dispute resolution.
Where we introduce a payment provider, we will update this Privacy Policy where necessary and provide appropriate information about the provider and its role.
## 8. WOOCOMMERCE AND OUR ONLINE STORE
Our website uses WooCommerce ecommerce technology to operate our online store.
Information required to administer an order may include your name, email address, billing and delivery addresses, IP address, account information, order information and transaction status.
This information is processed where necessary to provide the online shop and fulfil your order.
## 9. DELIVERY
Where products need to be delivered to you, we may provide relevant information to postal, courier, fulfilment or delivery providers.
This will normally include only information reasonably necessary to deliver the parcel, such as:
* your name;
* delivery address; and
* email address where required for delivery notifications.
Delivery providers may also process information under their own legal obligations and privacy policies.
## 10. SERVICE PROVIDERS
We use third-party organisations and technology providers where necessary to operate our business and website.
These may include providers of:
* website hosting;
* ecommerce technology;
* website maintenance;
* email services;
* security and fraud prevention;
* banking;
* accounting;
* postal and courier services;
* IT services; and
* analytics or website measurement services where applicable.
Where an organisation processes personal information on our behalf, we take reasonable steps to ensure appropriate data protection arrangements are in place where required.
Some organisations, such as banks, payment providers, postal operators or professional advisers, may act as independent controllers for some of their processing.
## 11. COOKIES AND SIMILAR TECHNOLOGIES
Our website may use cookies and similar technologies.
These technologies can include cookies, pixels, scripts, local storage and other technologies that store or access information on your device.
Some are necessary for the website to operate properly. For example, they may be required to:
* maintain website security;
* remember the contents of your shopping basket;
* enable checkout;
* maintain login sessions; or
* remember website preferences.
We may also use other technologies for purposes such as website measurement, analytics or functionality.
Where applicable law requires consent for a particular technology, we will request consent before using it.
Where legislation permits a particular technology to be used without consent, we will comply with the applicable transparency and other requirements.
You can manage available choices through our cookie controls where provided.
Further information about the technologies used on this website may be provided through our Cookie Policy or cookie-management tool.
## 12. MARKETING
We may send you information about Ruby Lou products, offers or services where we have an appropriate legal basis to do so.
Where consent is required, we will obtain it.
You can unsubscribe from marketing communications at any time by using the unsubscribe option provided in the communication or by contacting us at **[info@rubylou.co.uk](mailto:info@rubylou.co.uk)**.
Unsubscribing from marketing does not prevent us from sending necessary communications about an existing order, account or transaction.
We do not sell customer email addresses or contact details to unrelated businesses for their independent marketing purposes.
## 13. WHO WE SHARE INFORMATION WITH
We do not sell personal information as part of our ordinary business activities.
We may disclose personal information where reasonably necessary to:
* website and hosting providers;
* ecommerce providers;
* banks and payment providers;
* delivery and postal services;
* email and communication providers;
* accountants, legal advisers and other professional advisers;
* IT and security providers;
* fraud prevention services;
* regulators and government authorities;
* law-enforcement agencies;
* courts or tribunals; or
* another party where necessary to establish, exercise or defend legal rights.
We may also disclose relevant information if our business or part of our business is sold, transferred, reorganised or merged, subject to applicable data protection requirements.
We will not disclose personal information merely because somebody asks us for it. We will consider whether there is an appropriate legal basis before making a disclosure.
## 14. INTERNATIONAL DATA TRANSFERS
Some of the technology or service providers used by our business may process personal information outside the United Kingdom.
Where UK data protection law restricts the transfer of personal information to another country, we will use an appropriate legal transfer mechanism where required.
Depending upon the circumstances, this may include:
* transfer to a country covered by UK adequacy regulations;
* the UK International Data Transfer Agreement;
* the UK Addendum to approved Standard Contractual Clauses; or
* another transfer mechanism permitted by applicable data protection legislation.
Where EU data protection legislation applies, appropriate EU transfer safeguards will be used where required.
## 15. HOW LONG WE KEEP YOUR INFORMATION
We do not keep personal information indefinitely simply because we have collected it.
Different information is retained for different periods depending upon:
* why it was collected;
* whether we still need it;
* legal and regulatory requirements;
* tax and accounting requirements;
* fraud prevention;
* potential disputes; and
* limitation periods for legal claims.
Order, transaction and accounting information may need to be retained after an order has been completed to satisfy our legal, tax and accounting obligations.
Information that is no longer reasonably required will be deleted, anonymised or securely disposed of where appropriate.
## 16. SECURITY
We take reasonable technical and organisational measures designed to protect personal information from:
* unauthorised access;
* accidental loss;
* destruction;
* alteration;
* misuse; and
* unauthorised disclosure.
Access to personal information is restricted where reasonably appropriate.
However, no website, internet transmission or electronic storage system can be guaranteed to be completely secure.
If you create an account, you are responsible for keeping your password and login information confidential.
## 17. YOUR DATA PROTECTION RIGHTS
Depending upon the law applicable to your personal information, you may have rights including the right to:
* ask whether we process your personal information;
* request access to personal information we hold about you;
* request correction of inaccurate or incomplete information;
* request deletion of certain personal information;
* request restriction of certain processing;
* object to certain processing;
* receive certain information in a portable format;
* withdraw consent where processing is based upon consent; and
* raise a complaint about our handling of your information.
These rights are not absolute. In some circumstances we may be legally entitled or required to retain information or continue processing it.
We may need to verify your identity before fulfilling a request.
We will respond to valid privacy requests within the period required by applicable law.
To exercise your privacy rights, email **[info@rubylou.co.uk](mailto:info@rubylou.co.uk)**.
## 18. CUSTOMERS OUTSIDE THE UNITED KINGDOM
Our business is established in the United Kingdom.
People outside the UK may nevertheless visit our website or purchase products where we make delivery available to their location.
Where another country's privacy legislation applies to our processing, nothing in this Privacy Policy is intended to remove mandatory privacy rights that cannot legally be excluded.
Where the EU General Data Protection Regulation applies to particular processing, relevant rights and safeguards under that legislation will apply.
Residents of other jurisdictions may have additional rights where their local privacy legislation applies to our activities.
## 19. CHILDREN
Products sold through this website must be purchased by an adult.
We do not knowingly invite children to create customer accounts, enter into purchase contracts or independently provide personal information through this website.
If you believe a child has provided personal information to us without appropriate authority, please contact us at **[info@rubylou.co.uk](mailto:info@rubylou.co.uk)**.
## 20. HEALTH AND MEDICAL INFORMATION
Ruby Lou's retail website is **not intended to collect health or medical information**.
Please do not include medical histories, diagnoses, medication information, medical records or other health information in:
* checkout fields;
* order notes;
* customer account information;
* product reviews; or
* general website enquiries.
If you contact RLP Consult Ltd separately in relation to another service, different privacy information may apply to information collected through that service.
## 21. AUTOMATED DECISION-MAKING
We do not currently use information collected through this website to make solely automated decisions about customers that produce legal or similarly significant effects.
Third-party providers, particularly banking, payment, security or fraud-prevention providers, may operate their own automated systems. Where they act independently, their own privacy information will apply to that processing.
## 22. THIRD-PARTY WEBSITES
Our website may contain links to websites operated by other organisations.
We do not control independent third-party websites and are not responsible for their privacy practices.
You should review the privacy information provided by those organisations before providing personal information to them.
## 23. DATA PROTECTION COMPLAINTS
If you have a concern about how we have handled your personal information, please contact us first so that we have an opportunity to investigate and respond.
**Email:** [info@rubylou.co.uk](mailto:info@rubylou.co.uk)
If you are not satisfied with our response, you also have the right to raise a complaint with the UK data protection regulator, the **Information Commissioner's Office (ICO)**.
If you live outside the United Kingdom, you may also have the right to complain to an appropriate data protection or privacy authority where applicable.
## 24. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect:
* changes to our website;
* changes to the way we operate;
* new service providers;
* new payment methods;
* changes to applicable legislation; or
* changes to our processing of personal information.
The latest version will be published on this website and the **Last updated** date at the top of this policy will be changed accordingly.
Where a change materially affects the way we process existing personal information and applicable law requires us to provide additional notice or obtain consent, we will do so.
## 25. CONTACT US
For questions about this Privacy Policy, requests concerning your personal information or data protection complaints, please contact:
**RLP Consult Ltd**
Trading as **Ruby Lou**
Medfab House
Clipper Close
Rochester
Kent
ME2 4QR
United Kingdom
**Email:** [info@rubylou.co.uk](mailto:info@rubylou.co.uk)
**Website:** rubylou.co.uk
Please provide enough information for us to understand and respond to your request, but do not send unnecessary sensitive or medical information.
