Date: 11 November 2026. Version: 3.0.
Who we are
BSKLY Limited, trading as BSKLY, operates bskly.com and is responsible for your personal information as its controller. We are a private limited company registered in England and Wales, company number 17047836.
Our registered office, business contact address and complaints address is 67 Westow Street, London SE19 3RW.
Contact us about your information, your rights or a privacy complaint at support@bskly.com. You can also write to our address above.
This notice explains how we use personal information under the UK General Data Protection Regulation and the Data Protection Act 2018. It covers customers, account holders, subscribers and people who contact or visit us.
Information we collect
We collect information you give us when you order, create an account, subscribe, request a stock alert or contact us. Payment providers send us information about the status of your payment. With your permission, our website also collects information about your visits.
| Activity | Information |
|---|---|
| Orders, delivery and returns | Your name, billing and delivery addresses, email, items, sizes, payment status and information you provide about a return or problem with an order. |
| Customer accounts | Your account, sign-in and order details. |
| Newsletter and checkout sign-up | Your email and a record of the consent wording, time, form source, IP address and browser user agent. |
| Back in stock requests | Your email, the product and size requested, the time of the request and your consent to that alert. |
| Contact form | Your name, email, optional order number, enquiry type, message and the consent line submitted with the form. Enquiries are stored on the website and emailed to support@bskly.com. |
| Optional website analytics | Browser identifiers and information about pages, products and shopping activity, including purchases and refunds. The Google Analytics client identifier is stored with an order only when Analytics consent was granted at checkout. |
| Optional marketing tracking | Information about products viewed and baskets or checkouts left incomplete, associated with a subscriber where the relevant permissions are in place. Omnisend records email opens and link clicks to measure and improve our marketing emails. |
| Optional personalisation | Recently viewed pieces and a count of pages viewed, stored in your browser. |
| Website functions and consent | Your cookie choices and the time recorded, bag and sign-in information, and the pieces you choose to save. With Marketing consent, we also store information to control the sign-up prompt. |
| Spam protection on our forms | A hashed IP address and short-lived rate-limit counters. |
| Server access and mail logs | IP address, browser, pages requested, time and email delivery status, as relevant to the log, for security and troubleshooting. |
Payment card details are handled by the payment providers. BSKLY does not store your full payment card details.
We need the required checkout information to process and deliver an order. If you do not provide it, we cannot fulfil that order. You can buy as a guest. Creating an account and subscribing to marketing are optional. We need an email to send a stock alert or answer an enquiry by email.
Why we use information and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Take payment, fulfil orders, arrange delivery, administer contractual returns and send order or delivery emails | Contract, including steps you ask us to take before entering a contract. |
| Provide an account, bag or Saved list you request | Contract. This processing provides the service you request. |
| Answer questions about a purchase you are considering or an existing order | Contract, including steps you ask us to take before entering a contract. |
| Answer other enquiries and manage customer service correspondence | Legitimate interests. Our interest is responding to people who contact the business and resolving their enquiries. |
| Keep the records required for tax and accounting | Legal obligation. We must comply with applicable tax and accounting record requirements. |
| Meet statutory consumer obligations, respond to data rights requests and investigate privacy complaints | Legal obligation under consumer and data protection law. |
| Send newsletters and automated marketing emails | Consent given through the newsletter form or optional checkout sign-up. |
| Measure email opens and link clicks through Omnisend to improve our marketing emails | Consent to email marketing and its disclosed tracking. |
| Send a requested back in stock alert | Consent to that alert. This does not subscribe you to the newsletter. |
| Measure website use, purchases and refunds through Google Analytics | Consent through the website choices described below. Storing an identifier with an order for refund reporting requires Analytics consent at checkout. |
| Use browsing and shopping activity to select marketing reminders and control the sign-up prompt | Consent to Marketing tracking, together with email marketing consent before sending marketing emails. |
| Remember recently viewed pieces and page count | Consent to Personalisation. |
| Keep newsletter consent records and act on withdrawals or objections | Legal obligation to demonstrate consent and respect your choices. |
| Remember website consent choices and protect the website against abuse, including repeated consent submissions | Legitimate interests in respecting your choices and maintaining a secure, usable website. |
| Use server access and mail logs for security and troubleshooting | Legitimate interests in protecting our website and email services and identifying and resolving technical problems. |
| Establish, exercise or defend legal claims | Legitimate interests in resolving disputes and protecting legal rights. We limit the records to what the particular matter requires. |
Where we rely on legitimate interests, we consider whether the use is necessary and whether your rights outweigh our interests. You can object as explained below.
The contact form consent line does not subscribe you to marketing. We use the contract or legitimate interests basis described above to deal with the enquiry. We use a legal obligation basis where the enquiry concerns a statutory right.
Marketing and website choices
The newsletter consent box is unticked by default. Checkout has a separate, optional sign-up box. Marketing emails may include a welcome message, basket and checkout reminders, a viewed-product reminder, back in stock messages and new collection announcements. These are sent to subscribers who have consented. A separate product-specific stock request authorises the requested alert only.
Accepting cookies does not subscribe you to marketing. Subscribing to email does not authorise optional website tracking. Reminders based on tracked browsing or basket activity need both permissions. You can unsubscribe using the link in every marketing email or by contacting support@bskly.com. You can cancel a stock alert at the same address. Necessary order and service emails continue where needed to fulfil your purchase or meet a legal obligation.
Omnisend records email opens and link clicks to measure and improve our marketing emails. We keep marketing profiles and activity while you remain subscribed. After you unsubscribe, we keep your email address and unsubscribe date on a suppression list so that we do not send you further marketing emails.
The cookie banner offers “Essential only” and “Accept all” with equal prominence, and “Manage choices”. The settings panel has Analytics, Marketing and Personalisation switches, all off by default. Select “Save choices” to apply your selections or “Accept all” to enable all three. Use “Cookie settings” in the footer to change them at any time.
Analytics covers Google Analytics through Google Tag Manager. Marketing covers Omnisend’s on-site tracking and sign-up prompt storage. Personalisation covers recently viewed pieces and page count. Google Tag Manager and Google Analytics load when either Analytics or Marketing is granted. To prevent both Google services from loading, switch off both Analytics and Marketing. With “Essential only”, ordinary browsing outside checkout makes no requests to third-party hosts. Secure payment services connect to payment providers during checkout, including when you choose PayPal. These necessary payment connections do not enable optional tracking. Fonts are self-hosted.
When you switch off any category, the page reloads once. Switching off Analytics deletes the _ga and _ga_HVGJNL96SV cookies. Switching off Marketing deletes Omnisend cookies whose names begin with omnisend and the browser entries bskly_joined and bskly_offer_seen. Omnisend’s page-views cookie lasts until the session ends. Switching off Personalisation deletes bskly_recently_viewed and bskly_page_views.
These browser controls do not delete information already sent to Google or Omnisend. Contact support@bskly.com to request deletion or to withdraw consent to refund reporting for an earlier order. Include enough information to identify the order. Withdrawal does not affect the lawfulness of earlier processing.
The Analytics client identifier is stored with an order only if Analytics was granted at checkout. We use that stored identifier only to report a later refund to Google Analytics and delete it automatically 120 days after the order. Marketing consent alone does not authorise storing it with an order. Google Analytics user and event data retention is set to 14 months. Google Signals is off. Email addresses and order keys are removed from page addresses before they are sent to Analytics. Browser identifiers and shopping activity are still personal information where they can identify or be linked to you.
Meta and TikTok advertising pixels are not currently in use. Future advertising tags would fall within Marketing. Before introducing them, we will update the notices and obtain the consent required for the new purposes and recipients.
The reminders described above use automated rules to select messages from shopping activity. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. When you pay, our payment providers may run their own automated fraud checks, which can result in a payment being declined; they do this as independent controllers, and their privacy notices explain how.
Who receives information
We share the information needed for the following services. A processor handles information on our instructions. An independent controller determines its own purposes and means of processing.
| Category and recipient | Purpose and role |
|---|---|
| Website maintenance: Vivid Intelligence Ltd trading as Vivid Beginnings, company 13434339 | Builds and maintains the WordPress and WooCommerce website as our processor. |
| Email marketing and stock alerts: Omnisend UAB, Lithuania | Handles subscriber information, permitted marketing activity and requested stock alerts. Its data processing agreement identifies Omnisend as a processor of customer personal data. |
| Service email and business mailbox: IONOS | Provides the support@bskly.com mailbox and order and other service emails as our processor, including mailbox copies of contact enquiries. |
| Analytics and tag delivery: Google | Provides Google Analytics 4 and Google Tag Manager. Google’s Ads Data Processing Terms identify Google as a processor for customer personal data in the covered Analytics service. |
| Payments: WooPayments (powered by Stripe) and PayPal | Process payments, payment status and refunds. The published supplier roles are explained below. |
| Delivery: Royal Mail and DPD | Receive the delivery details needed to deliver an order. |
| HM Revenue and Customs and other competent authorities | Receive information where disclosure is required by law. |
Stripe, which powers WooPayments, describes both processor and controller activities in its data processing agreement. Its controller activities include fraud prevention, legal compliance and service improvement. PayPal’s UK user agreement treats PayPal and the merchant as independent controllers for the customer information they each process under that agreement. PayPal UK Ltd provides the service to UK account holders. These providers explain their own processing in their privacy notices.
Hosting and backups
Our website is hosted by Vivid Intelligence Ltd trading as Vivid Beginnings, company 13434339, acting as our processor. The server is in the United Kingdom. Nightly encrypted backups are stored with Backblaze in its EU Central region in the Netherlands. Backups are retained for up to 2 years on a rolling schedule of 7 daily, 4 weekly, 12 monthly and 2 yearly copies. Transfers to the Netherlands are covered by UK adequacy regulations for the European Economic Area.
Server access and mail logs are kept for up to 30 days for security and troubleshooting. These logs are not included in backups.
International transfers
Google, Omnisend and payment providers use international operations and suppliers. Information may be processed outside the UK, including in the United States. Their published transfer arrangements are summarised below.
UK adequacy regulations recognise the European Economic Area, including Lithuania and the Netherlands. For other transfers, contractual safeguards can include the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum. The UK Extension to the EU-US Data Privacy Framework can cover transfers to participating US recipients within its scope.
| Service | Published transfer arrangements |
|---|---|
| Its processing terms allow processing where Google or its subprocessors have facilities. They provide for recognised transfer frameworks and Standard Contractual Clauses, including the UK Addendum for UK transfers where applicable. | |
| Omnisend | Its processing agreement includes overseas affiliates and subprocessors, including in the United States, and incorporates Standard Contractual Clauses and the UK Addendum for relevant transfers. |
| Stripe through WooPayments | Stripe’s terms describe transfers to Stripe, LLC in the United States and other international affiliates and subprocessors. Its transfer addendum provides for the Data Privacy Framework where applicable, with Standard Contractual Clauses and the UK Addendum as alternative mechanisms. |
| PayPal | Its privacy statement describes international processing and UK transfer safeguards using adequacy decisions or appropriate contracts, including the UK International Data Transfer Agreement or UK Addendum. |
| IONOS service email and business mailbox | Processes information in the UK and the European Economic Area. Transfers to the European Economic Area are covered by UK adequacy regulations. |
Hosting and backup arrangements are set out above. You can ask support@bskly.com for information about a transfer and a copy of the relevant safeguards, with necessary confidential information removed.
How long we keep information
| Record | Retention |
|---|---|
| Order records needed for tax and company records | 6 years from the end of the financial year in which the order was placed. |
| Customer accounts | Until you ask us to delete the account, subject to separately retained order records. |
| Contact enquiries on the website | 24 months from receipt, then automatically deleted. |
| Business mailbox copies of enquiries and correspondence | Up to 24 months from receipt, matching the website enquiry period. Records needed for a complaint, rights request or claim follow the separate period below. |
| Back in stock requests | 12 months from the request, then automatically deleted. You can withdraw the request sooner. |
| Newsletter consent records on the website | Active records are kept while you remain subscribed. Records of withdrawn newsletter consent are deleted by the daily deletion process. The separate suppression list below remains. |
| Omnisend marketing profiles and activity | While you remain subscribed. After an unsubscribe, we retain only the suppression information described below unless another lawful retention purpose applies. |
| Marketing suppression list | Your email address and unsubscribe date are kept for as long as needed to honour your unsubscribe and prevent further marketing emails. They are used only for that purpose. |
| Google Analytics user and event data | The GA4 data retention setting is 14 months. This setting does not apply to standard aggregated reports. |
| Analytics client identifiers held with orders | Deleted automatically 120 days after the order. Used only to report a later refund. |
| Consent rate-limit counters containing a hashed IP address | 15 minutes. |
| Recently viewed pieces and page count in browser storage | 30 days, or until you withdraw Personalisation consent or clear the storage. |
| Cookie choices and requested Saved list | No expiry date. The choice record remains until you clear it or change your choices. Saved pieces remain in browser storage until removed or cleared. |
| Other cookies and browser storage | The individual periods appear in our cookie notice. |
| Mail logs, including service email delivery status | Up to 30 days from the log entry, for security and troubleshooting. Not included in backups. |
| Server access and security logs | Up to 30 days from the log entry, for security and troubleshooting. Not included in backups. |
| Complaint, rights request and legal claim records | 6 years after the matter closes. |
| Website backups | The schedule appears under Hosting and backups above. |
Deleting an account or unsubscribing does not automatically erase records we must keep for another lawful purpose. Any longer retention for a legal requirement or unresolved claim is limited to the information needed for that purpose. Browser deletion does not erase copies already held by suppliers. You can contact us to exercise your rights in relation to those copies.
Your rights
Subject to the conditions in data protection law, you can ask to access your information, correct inaccurate information, erase information or restrict its use. You can request a portable copy of information you supplied where processing is automated and based on consent or contract.
You can object to processing based on legitimate interests for reasons relating to your situation. You have an absolute right to object to direct marketing, including associated profiling. You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
You also have rights concerning decisions made solely by automated processing that have legal or similarly significant effects. Where these apply, they include safeguards such as obtaining human intervention and challenging the decision.
Use support@bskly.com or write to our address to exercise a right. We may ask for information reasonably needed to verify your identity. Requests are normally free. We respond without undue delay and normally within one month. If a lawful extension or clarification affects the deadline, we will explain it. An extension for complexity or the number of requests can be up to two further months, with notice within the initial period.
Use “Cookie settings” in the footer to change website tracking consent. Email unsubscribe and cookie choices are separate controls. Contact us if you need help applying a withdrawal to a past order or another device.
Complaints and changes
You have the right to complain to us about how we handle your information. Email support@bskly.com or write to 67 Westow Street, London SE19 3RW. We aim to reply within 2 working days and to resolve complaints within 14 days. We will acknowledge a data protection complaint within 30 days at the latest, investigate it, keep you informed and communicate the outcome without undue delay. These service aims do not extend any statutory deadline.
You also have the right to complain to the UK’s data protection regulator, the ICO. Use the ICO complaints service. Its guidance explains the information to provide and how it considers complaints. You can raise a concern with us without giving up your right to contact the ICO.
We will update this notice when our processing changes. The date and version above identify the notice. An update does not itself give us consent to a new use of your information.