Privacy policy

Last updated: 6 November 2026

1. Who we are

DEFREI is operated by DEFREI Holdings Limited, trading as DEFREI.

Our business contact address is:

DEFREI
71–75 Shelton Street
London
WC2H 9JQ
United Kingdom

Email: info@defrei.com
Website: https://www.defrei.com

DEFREI Holdings Limited is the controller responsible for the personal information we collect and use for our business purposes. Where a service provider processes information independently for its own purposes, its privacy notice also applies.

This policy explains how we handle personal information when you browse our website, purchase products, subscribe to communications, use our website features or contact us.

2. Information we collect

Depending on how you interact with us, we collect:

  • Contact details: your name, email address, billing address, delivery address and telephone number.

  • Order information: products purchased, order history, delivery information, returns, refunds and correspondence about purchases.

  • Payment and transaction information: information needed to process payments, payment status, transaction references and information made available to us by your selected payment provider.

  • Account information: information associated with your customer account, order history and preferences.

  • Communications and contributions: enquiries, feedback, reviews and information you choose to provide through forms or other communications.

  • Marketing preferences: subscription choices, unsubscribe requests and relevant consent records.

  • Device and website-use information: IP address, browser and device details, approximate location, referral source, pages viewed, product interactions and identifiers used by cookies, pixels or similar technologies.

  • Privacy preferences: information needed to record and respect your choices.

Payment details are processed through Shopify and the payment services available at checkout. Please do not send full payment-card details or sensitive personal information through ordinary email or contact forms.

We need certain information to process and deliver an order. If you do not provide necessary contact, delivery or payment information, we may be unable to fulfil your purchase. Subscribing to marketing is optional.

3. Where information comes from

We obtain information:

  • Directly from you when you shop, create an account, complete a form, subscribe, submit a review or contact us.

  • Through your browser or device when you interact with our website.

  • From Shopify, payment services, delivery providers and other services supporting your purchase.

  • From advertising, analytics and other connected services, where those features are enabled and processing is permitted.

4. Why we use information and our lawful bases

Where UK GDPR or EU GDPR applies, our lawful basis depends on the purpose.

Purchases and accounts — contract

We process information necessary to take payment, fulfil and deliver orders, administer customer accounts, provide order updates and handle returns or refunds. This is necessary to perform our contract with you or take steps you request before entering into a contract.

Customer support — contract or legitimate interests

For questions about an order or proposed purchase, processing may be necessary for our contract or pre-contractual steps. For other enquiries, our legitimate interest is responding to people who contact our business.

Security, fraud prevention and business administration — legitimate interests

We use relevant information to protect customers and our business, investigate suspicious activity, maintain reliable systems and handle disputes. When relying on legitimate interests, we consider whether processing is necessary and balance our interests against your rights and reasonable expectations.

Legitimate interests do not replace consent where consent is required for tracking or marketing.

Accounting and legal requirements — legal obligation

We process relevant records to meet accounting, tax and other legal obligations and respond to lawful requests from authorities.

Marketing subscriptions — consent

When you subscribe to DEFREI marketing, we use your information to send relevant news, product launches and offers.

You can unsubscribe through the link in our marketing emails or by contacting info@defrei.com. Necessary order and service messages are separate from marketing subscriptions.

Optional analytics, personalisation and advertising — consent

We rely on consent for optional tracking used to understand website behaviour, personalise experiences, measure advertising and support targeted advertising.

You have the right to withdraw consent. Withdrawal does not affect processing that was lawful before it was withdrawn.

5. Cookies, pixels and browser storage

Our website uses cookies and related technologies, including tracking pixels, local storage and session storage.

Some technologies support functions you request, such as maintaining your basket, checkout, security and remembering privacy choices. Other technologies support optional personalisation, analytics and marketing.

Our cookie banner provides choices about optional categories. Accepting optional tracking is not a condition of purchasing from DEFREI.

Persistent cookies and local storage can remain after you leave the website. Session storage generally lasts for the browsing session. Applications may also apply their own validity and cleanup rules.

Browser settings can help you inspect, block or delete stored information. Blocking all cookies may affect shopping functions. Clearing stored information may also remove your saved consent choice, causing the banner to appear again.

For questions about the technologies used on our website, or to request a change to your privacy choices, contact info@defrei.com.

6. Connected services and tracking

Our store includes integrations for website operation, customer communications, reviews, product recommendations, creator activity, analytics and advertising. Information shared depends on the features in use, their configuration and applicable privacy choices.

These integrations include:

  • Shopify: store hosting, checkout, accounts, website forms, communications and other commerce features.

  • Facebook & Instagram: Meta advertising, campaign measurement and customer matching.

  • Google & YouTube: connected Google analytics and advertising features.

  • Pinterest: advertising and campaign measurement.

  • Meta Growth Agent Service App: a server-side integration listed in our Shopify customer-event settings.

  • Octane AI: quiz responses, product recommendations and related enabled integrations.

  • STOQ: back-in-stock requests and related enabled features.

  • Yotpo: customer reviews, widgets and associated analytics or measurement.

  • Collabs: creator and affiliate activity and attribution.

  • Fast Bundle: product bundles, basket state and associated discount processing.

  • Hotjar: website-interaction analysis, which can include heatmaps and session recordings depending on the features enabled.

Our website scan also identified Snowplow-based analytics identifiers. These identify visits and sessions; the technology may be deployed through another connected service.

Advertising integrations can process website events such as product views, basket additions and purchases, together with device information and identifiers. Depending on the settings in use, customer contact information can also be shared for matching and advertising measurement.

Some integrations send information between servers, including through Meta’s Conversions API. The absence of a browser cookie does not necessarily mean no information is being shared.

Advertising services may associate activity with an account you hold with them and use it for measurement, matching, audience creation or personalisation. Their own privacy notices and account settings also apply to their independent processing.

7. Our relationship with Shopify

Shopify provides the platform supporting our store and checkout and processes information about your interactions with our website.

We also use Shopify Network Intelligence. Through enhanced services, Shopify can use information about interactions with our store together with information from other merchants to support personalised experiences, relevant advertising and understanding store and advertising performance.

Information is shared with Shopify and relevant third parties, including providers in other countries, to provide these services. For some enhanced services, Shopify acts as an independent controller and handles privacy rights relating to its own processing.

Shopify Consumer Privacy Policy:
https://www.shopify.com/legal/privacy/consumers

Shopify privacy controls and rights requests:
https://privacy.shopify.com

8. Other recipients

We share relevant information with organisations supporting the purposes described in this policy, including:

  • Payment and fraud-prevention providers.

  • Delivery and logistics providers.

  • Website, communications, review, analytics and advertising services.

  • IT, cloud-storage and business-administration providers.

  • Accountants, legal advisers and other professional advisers.

  • Authorities or other recipients where disclosure is legally required or necessary for legal claims.

Relevant information may also be shared with advisers or successors in connection with a business sale, restructuring or transfer, subject to appropriate safeguards.

Providers processing information on our behalf are subject to contractual requirements governing its use and protection. Providers acting independently are responsible for their own processing.

9. International transfers

Our service providers operate internationally, so information may be processed outside the UK or European Economic Area.

Where a transfer is restricted by applicable data-protection law, an appropriate transfer mechanism is required. Depending on the destination and recipient, this can include an applicable adequacy decision or contractual safeguards, such as the EU Standard Contractual Clauses with the appropriate UK Addendum, or the UK International Data Transfer Agreement.

Contact info@defrei.com for information about the destinations and safeguards relevant to your information, including how to obtain a copy of applicable safeguards.

10. Retention

We retain personal information for the period needed for its purpose, taking account of legal obligations, your rights and relevant disputes.

We determine retention by category:

  • Orders and accounting: applicable tax and accounting requirements, together with any justified period for disputes or legal claims.

  • Customer accounts: while needed to provide the account, with necessary transaction records retained separately where required.

  • Enquiries and complaints: while resolving the matter and for any justified follow-up or claims period.

  • Marketing: while your subscription remains active and relevant. Limited suppression records may be retained to respect an unsubscribe request.

  • Consent records: while needed to demonstrate and respect privacy choices.

  • Analytics and advertising: according to the purpose, consent, provider configuration and applicable storage settings.

We review information and delete or anonymise it when it is no longer needed. Account deletion or consent withdrawal does not necessarily require deletion of records retained for a separate lawful purpose.

11. Your rights

Depending on applicable law and the reason for processing, you may have rights to:

  • Access your information.

  • Correct inaccurate or incomplete information.

  • Request deletion.

  • Restrict processing.

  • Receive certain information in a portable format.

  • Object to processing based on legitimate interests.

  • Withdraw consent.

  • Exercise applicable rights concerning solely automated decisions with legal or similarly significant effects.

Rights have conditions and exceptions. Contact info@defrei.com to make a request. We may request information reasonably necessary to verify your identity and will respond within the applicable legal timeframe.

If automated fraud or security screening affects your order, contact us to ask about the outcome and request appropriate review.

Your right to object to direct marketing

You can object to our use of your information for direct marketing at any time, including related profiling. We will stop using it for those purposes.

Use the unsubscribe link in our marketing emails or email info@defrei.com.

Depending on where you live, you may also have rights to opt out of certain sales, sharing or targeted-advertising uses. Contact us to exercise applicable rights. Shopify’s privacy portal provides choices about Shopify’s own processing.

12. Security

We use appropriate technical and organisational measures to protect information against unauthorised access, loss, misuse or disclosure.

Access is limited to people and providers who need information for their work. No system can guarantee absolute security. Contact us promptly if you believe your information or account has been compromised.

13. Children

Our store is not directed at children. If you believe a child has provided information that we should not hold, contact info@defrei.com.

14. Complaints

Contact info@defrei.com if you have concerns about how we handle personal information.

You also have the right to complain to the UK Information Commissioner’s Office:
https://ico.org.uk/make-a-complaint/

Where EU GDPR applies, you may complain to the relevant supervisory authority, including where you live, work or believe an infringement occurred.

You do not need to contact us before exercising your right to complain to a regulator.

15. Changes and contact

We may update this policy when our practices, providers or legal requirements change. We will update the date and provide additional notice or seek fresh consent where required.

For privacy enquiries:

DEFREI Holdings Limited, trading as DEFREI
DEFREI, 71–75 Shelton Street
London, WC2H 9JQ
United Kingdom
info@defrei.com