Your Spa Garden — Privacy Policy

Last Updated: 8 October 2026

Your Spa Garden is the trading name of Lister Logistics Ltd. We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, share and protect personal data when you visit our website, purchase our products, contact us, or subscribe to our email or SMS marketing.

This Privacy Policy is governed by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

 

The data controller responsible for your personal data is:

Full legal entity: Lister Logistics Ltd trading as Your Spa Garden   Email: contact@yourspagarden.co.uk   Postal address: 128 City Road, London, United Kingdom, EC1V 2NX

If you have any questions about this Privacy Policy or how we use your personal data, please contact us using the details above.

 

Depending on how you interact with us, we may collect:

●      Your name, billing address, delivery address and contact details.

●      Your email address and telephone or mobile number.

●      Account login details and information associated with your customer account.

●      Order, payment, delivery and transaction information.

●      Details of enquiries, complaints, reviews and other communications with us.

●      Marketing preferences, consent records and records of when you unsubscribe or opt out.

●      Information about how you use our website, including browsing activity, device information, IP address and cookie identifiers.

●      Marketing engagement information, such as whether you open emails, click links or respond to SMS messages.

●      Information used to place you into marketing segments or profiles, such as products viewed, products purchased, location and engagement history.

We do not intentionally collect special category data through our marketing programmes. Please do not provide health information or other sensitive personal data unless it is necessary for us to deal with a specific enquiry or request.

 

We may use your personal data to:

●      Process and deliver orders.

●      Take payments and prevent fraud.

●      Create and administer customer accounts.

●      Provide customer service and respond to enquiries.

●      Use live chat transcripts to answer enquiries, to provide customer support and for staff training and quality assurance.

●      Send order confirmations, delivery updates, service messages and other communications necessary to perform our contract with you.

●      Send email marketing about our products, services, offers and news where permitted by law.

●      Send SMS marketing about our products, services, offers and news where permitted by law.

●      Manage subscriptions, opt-outs and marketing preferences.

●      Analyse campaign performance and improve our products, services and website.

●      Use segmentation and profiling to make marketing more relevant.

●      Operate, secure and improve our website.

●      Meet legal, accounting, tax and regulatory obligations.

●      Establish, exercise or defend legal claims.

●      Detect, investigate and prevent fraud, misuse and other unlawful activity.

 

We rely on one or more of the following lawful bases:

Consent

We rely on your consent for activities such as:

●      Email marketing where consent is required.

●      SMS marketing where consent is required.

●      Marketing cookies, Google Ads remarketing and related advertising features.

●      Certain analytics or other non-essential cookies and technologies.

Where consent is required, we will obtain it through a clear affirmative action. We will not use pre-ticked boxes as a substitute for consent.

You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Contract

We process personal data where it is necessary to:

●      Process and fulfil your order.

●      Arrange payment and delivery.

●      Provide customer support connected with your order.

●      Where live chat is used to take or progress an order, to handle the chat and provide support connected with that order.

●      Send essential order, delivery or service communications.

Legitimate interests

We may process personal data where necessary for our legitimate interests, or those of a third party, provided that those interests are not overridden by your rights and interests. This may include:

●      Administering and improving our business.

●      Maintaining website and information security.

●      Preventing fraud and misuse.

●      Managing customer relationships.

●      Providing customer support and responding to enquiries (including via live chat where the chat is not used to take or progress an order).

●      Staff training and quality assurance for customer support (including reviewing live chat transcripts).

●      Keeping appropriate business records.

●      Sending certain direct marketing communications where permitted by PECR and where our legitimate interests are not overridden.

We will not rely on legitimate interests for marketing where consent is legally required. Where live chat is used for marketing purposes, we will obtain consent where required.

Legal obligation

We may process personal data where necessary to comply with a legal or regulatory obligation, including tax, accounting, consumer protection, fraud prevention and law-enforcement requirements.

 

We may use your email address to send marketing communications about our products, services, offers and news.

Our primary approach is to send marketing emails only where you have provided consent. Consent must be freely given, specific, informed and provided through a clear affirmative opt-in.

Where permitted by PECR, we may rely on the existing-customer soft opt-in. This may apply where:

●      You provided your email address during a sale or negotiations for a sale.

●      We market our own similar products or services.

●      You were given a clear opportunity to refuse marketing when your details were collected.

●      Every subsequent marketing email gives you a simple and free way to opt out.

You can unsubscribe from marketing emails at any time by using the unsubscribe link in the email or by contacting us at contact@yourspagarden.co.uk.

Unsubscribing from marketing does not prevent us from sending essential transactional or service communications, such as order confirmations, delivery updates or information about an active order.

 

We may collect your mobile telephone number when you:

●      Provide it during checkout.

●      Create or use a customer account.

●      Complete an SMS or marketing sign-up form.

●      Contact us or otherwise provide it to us in connection with our services.

We may use your mobile number to send:

●      SMS marketing about our products, services, offers and news.

●      Order and delivery updates.

●      Other service communications connected with your relationship with us.

Marketing SMS messages will be sent on the basis of consent where consent is required. Consent will be obtained through a clear affirmative opt-in and never through a pre-ticked box.

Where permitted by PECR, the existing-customer soft opt-in may apply to SMS marketing where:

●      You provided your mobile number during a sale or negotiations for a sale.

●      We send marketing about our own similar products or services.

●      You were offered a clear opportunity to refuse marketing when your number was collected.

●      Every subsequent marketing message gives you a simple and free way to opt out.

You can opt out of SMS marketing at any time by:

●      Replying STOP to a marketing text message; or

●      Contacting us at contact@yourspagarden.co.uk.

Opting out is free, except for any ordinary network charge that may apply to sending a message to us. Message frequency varies. Standard network or mobile-provider rates may apply to receiving or sending messages, depending on your mobile contract.

If you opt out of marketing, we will stop marketing messages. This will not prevent us from sending essential service messages where they are necessary to fulfil an order or provide a service.

Our SMS marketing is sent using Klaviyo. The SMS sender identity, short code or sender ID used for campaigns will be identified in the relevant message or campaign where applicable.

 

We do not sell your personal data.

We may share personal data with trusted service providers that process it on our behalf, including:

●      Shopify and Shopify Payments, for website operation, order management and payment processing.

●      PayPal, for payment processing where you choose PayPal.

●      Royal Mail, DPD and Evri, for delivery and tracking.

●      Klaviyo, which provides our email and SMS marketing platform and hosts contact lists, consent records, campaign data and engagement information.

●      Google Analytics and Google Ads, for analytics, conversion measurement, advertising and remarketing where the relevant consent has been provided.

●      Tidio, which provides our website live chat and chatbot functionality. When you use the chat, Tidio processes the content of chat conversations with our team and any automated assistant, plus the name, email address and any other details a visitor chooses to share, together with IP address, device and browser information and the pages a visitor viewed before starting a chat.

●      Technology, hosting, security, professional and other service providers where reasonably necessary to operate our business.

We require our processors to process personal data only in accordance with our instructions, to keep it confidential and to apply appropriate security measures. We have data processing agreements in place with Klaviyo and Tidio.

We may also disclose personal data where required by law, court order, regulatory authority or law-enforcement body, or where necessary to establish, exercise or defend legal rights.

 

We may use Google Enhanced Conversions to improve the accuracy of conversion measurement. This may involve sending Google identifiers derived from information such as an email address in a hashed form.

Hashing does not necessarily make information anonymous where it can still be associated with an identifiable person. We therefore treat such information as personal data where applicable.

We may also use Google Ads remarketing and related advertising features. Marketing cookies, remarketing and other non-essential advertising technologies will only be used after the required consent has been obtained.

The lawful basis for these consent-based advertising activities is consent. You can withdraw consent through our cookie-management tool or by contacting us.

 

Our website uses cookies and similar technologies. These may include:

Essential cookies

These are necessary for the website to function, including security, shopping-cart and checkout features. They cannot normally be switched off through our cookie-management tool.

Analytics cookies

These help us understand how visitors use our website, including visitor numbers, traffic sources and navigation patterns.

Marketing cookies

These may be used to measure advertising, support remarketing and show advertising that may be more relevant to you.

We also use a live chat widget. The chat widget and its greeting flow store information in cookies and local storage to recognise a returning visitor and remember an ongoing conversation. Any non-essential elements of the chat widget will only be activated after you have provided consent. The greeting flow is active by default.

Non-essential analytics and marketing cookies will only be set after you have provided consent. You can withdraw or change your consent at any time through our cookie-management tool.

Further information is available in our Cookie Policy.

 

Some of our processors, including Klaviyo and Google, are based in, or may process personal data in, the United States or other countries outside the UK.

Tidio (chat data storage in the EEA): Chat conversation data is stored on AWS servers located in EEA member countries. Transfers are encrypted over private secure servers, and data is not moved between data centres. The UK’s adequacy regulations for the EEA mean this storage is permitted without further safeguards.

Tidio (account and billing administration): Billing and account details for the chat service are shared with Tidio LLC (Tidio’s US subsidiary). Where this involves a restricted transfer outside the UK, we rely on the Standard Contractual Clauses together with a data processing agreement.

Where personal data is transferred outside the UK, we use an approved transfer mechanism and appropriate safeguards. Depending on the processor and the destination, these may include:

●      The UK Extension to the EU-US Data Privacy Framework, where the recipient is appropriately certified.

●      The UK International Data Transfer Agreement.

●      The UK Addendum to the EU Standard Contractual Clauses.

●      A transfer risk assessment and any supplementary measures considered necessary.

We will not make a restricted transfer unless the requirements of the UK GDPR and Data Protection Act 2018 have been met.

 

We use appropriate technical and organisational measures to protect personal data, including:

●      Encryption of data in transit where supported by the relevant service.

●      Access controls and account protections.

●      Limiting staff access to personal data to what is reasonably needed for their role.

●      Monitoring and reviewing access where appropriate.

●      Using reputable service providers subject to contractual data-protection obligations.

●      Procedures for identifying and responding to suspected data-security incidents.

No transmission or storage system can be guaranteed to be completely secure. You should also take reasonable steps to protect your account credentials and devices.

 

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including legal, accounting, tax and reporting requirements.

●      Order and transaction information is typically retained for six years for tax, accounting and legal purposes.

●      Live chat conversations and chat transcripts are retained by our chat provider for approximately 5 years (depending on our Tidio plan and account settings). We review stored chat data periodically and delete conversations we no longer need. We will also delete chat data earlier on request where there is no ongoing need for it, in particular where the conversation does not relate to an order or a complaint. Where a chat forms part of an order or a complaint, it follows the six-year retention period applied to order information.

●      Customer-service and business correspondence is retained for as long as reasonably necessary to deal with the enquiry, relationship or any resulting legal or regulatory issue.

●      Marketing contacts are retained while consent remains valid or while we are otherwise lawfully permitted to market to them.

●      Marketing contacts with no engagement for 24 months will generally be suppressed from marketing campaigns.

●      We retain a suppression record of people who have opted out or withdrawn consent indefinitely, where necessary to ensure that we do not contact them again.

Suppression records are retained only for the purpose of respecting marketing preferences and preventing further unwanted contact.

 

Subject to applicable legal conditions and exemptions, you may have the right to:

●      Access your personal data.

●      Rectify inaccurate or incomplete personal data.

●      Erase your personal data where there is no overriding lawful reason for us to retain or process it.

●      Restrict the processing of your personal data in certain circumstances.

●      Receive or transfer certain personal data in a structured, commonly used and machine-readable format.

●      Withdraw consent at any time where we rely on consent. Withdrawal does not affect processing carried out before withdrawal.

●      Object to processing based on legitimate interests or the performance of a task in the public interest, subject to applicable legal rules.

●      Object to direct marketing at any time. This is an absolute right. If you object to direct marketing, we must stop processing your personal data for that purpose, subject to limited processing necessary to maintain an opt-out or suppression record.

To exercise your rights, please contact us at contact@yourspagarden.co.uk or write to us at 128 City Road, London, United Kingdom, EC1V 2NX.

We may need to verify your identity before completing a request. We normally respond within one month, although this may be extended where legally permitted because of the complexity or number of requests.

 

We may use Klaviyo to segment and profile contacts for marketing purposes. This may involve considering information such as products viewed or purchased, location, campaign engagement and stated preferences so that we can send more relevant communications.

Our live chat may use automated features:

●      Lyro AI conversational agent: this is not enabled by default and requires manual activation. If we enable it, it may answer common questions before a member of staff becomes involved. It does not produce legal or similarly significant effects on you, and you can ask to speak to a human at any point.

●      Rule-based automated messages (Flows): we use automated, rule-based messages (including a standard greeting sent on a visitor's first visit to the site). These messages are not AI-generated.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects on you.

You may object to marketing profiling by unsubscribing from marketing communications or contacting us. You may also object to the underlying direct marketing at any time, as explained above.

 

Our website and services are intended for adults. We do not knowingly collect personal data from children for marketing purposes. If you believe that a child has provided personal data to us, please contact us so that we can investigate and take appropriate action.

 

We may update this Privacy Policy from time to time to reflect changes to our business, technology, legal obligations or processing activities.

The latest version will be published on our website with the updated date shown at the top.

 

If you have concerns about how we use your personal data, please contact us first so that we can try to resolve the issue.

We are registered with the Information Commissioner's Office as a data controller under registration number ZC232303.

You also have the right to complain to the Information Commissioner's Office, the UK's supervisory authority for data protection.

Information Commissioner's Office   Website: www.ico.org.uk   Telephone: 0303 123 1113