Privacy Policy

Effective date: 30 July 2026
Last updated: 30 July 2026

This policy explains what personal data Harper and Shade collects, why we collect it, who we share it with and what rights you have. It applies to harperandshade.com and to any order you place with us.

1. Who we are (data controller)

The controller of your personal data is:

Despecom Limited, trading as Harper and Shade
Registered address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Company registration number: 16697484
Irish warehouse address: 25 Crotty Ave, Walkinstown, Dublin 12, D12 P2R5, Ireland
Email: info@harperandshade.com

Because we offer goods to people in Ireland and the European Union, we process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.

For any question about this policy or about your data, email us at info@harperandshade.com and put “Privacy” in the subject line.

2. What data we collect

You give us:

Name, delivery address, billing address and Eircode
Email address and phone number
Order details and order history
Correspondence with our customer service team, including returns requests
Email address if you subscribe to our newsletter
Reviews or photos you choose to send us

We collect automatically when you use the site:

IP address, approximate location (country/city level), device type, browser and operating system
Pages you visited, products you viewed, what you added to your basket, and how you arrived at the site
Cookie and similar identifiers (see section 7)

We receive from others:

Confirmation from our payment providers that a payment succeeded or failed, plus the last four digits and card type
Delivery status updates from our carriers
Aggregated advertising and analytics data from Google and Meta

We never collect or store your full card number, expiry date or security code. Those go directly to our payment processor.

3. Why we use your data, and our legal basis

What we do	Why	Legal basis
Process and deliver your order, handle returns and refunds	To fulfil the contract you entered into	Performance of a contract (Art. 6(1)(b))
Send order, dispatch and delivery emails	To keep you informed about your purchase	Performance of a contract
Answer your questions and handle complaints	Customer service	Performance of a contract / legitimate interests
Keep accounting, tax and transaction records	Legal obligation	Legal obligation (Art. 6(1)(c))
Detect and prevent fraud and payment abuse	To protect our business and our customers	Legitimate interests (Art. 6(1)(f))
Send marketing emails and newsletters	To tell you about new collections and offers	Consent (Art. 6(1)(a)), withdrawable at any time
Analytics and advertising cookies, retargeting	To understand and improve the store and reach the right audiences	Consent (Art. 6(1)(a))
Improve our products, ranges and website	To run and develop the business	Legitimate interests

Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms. You can object at any time (see section 8).

4. Who we share your data with

We do not sell your personal data. We share it only with service providers who need it to do their job for us, under contracts that require them to protect it:

Shopify Inc. — our ecommerce platform, hosting and checkout
Shopify Payments and card acquirers, Apple Pay, Google Pay, Shop Pay — payment processing
An Post, DPD Ireland, Fastway, GLS Ireland — delivery of your parcel
ParcelPanel — order tracking
Email and customer service providers — order emails and newsletters
Google (Google Analytics, Google Ads, Merchant Center) and Meta (Facebook, Instagram) — analytics, advertising and conversion measurement, where you have consented
Accountants and professional advisers — for bookkeeping and tax
Public authorities — where we are legally required to disclose

5. International transfers

Some of these providers process data outside the European Economic Area, including in the United States and the United Kingdom.

Where that happens we rely on lawful transfer mechanisms, principally the European Commission's Standard Contractual Clauses, the EU–US Data Privacy Framework where the recipient is certified, and the Commission's adequacy decision for the United Kingdom. You can ask us for details of the safeguards used for any specific transfer.

6. How long we keep your data

Order and transaction records: 7 years, to meet accounting and tax obligations
Customer service correspondence: 3 years after the matter is closed
Newsletter subscriptions: until you unsubscribe, plus a suppression record so we do not email you again
Website analytics data: typically 14 months, depending on the tool
Cookie consent records: 12 months

After these periods we delete or irreversibly anonymise the data.

7. Cookies and tracking

Cookies are small files placed on your device. We use:

Strictly necessary cookies — to run the basket, checkout, login and security. These do not require consent, and the store cannot function without them.
Analytics cookies — to understand how the site is used, so we can improve it.
Marketing and advertising cookies — including the Google Ads and Meta pixels, to measure the results of our advertising and to show relevant ads.

Analytics and marketing cookies are only set after you give consent through our cookie banner, in line with the ePrivacy Regulations (S.I. 336/2011). You can change or withdraw your choice at any time through the cookie settings link on our site, and you can block or delete cookies in your browser settings.

8. Your rights

Under the GDPR you have the right to:

Access the personal data we hold about you and receive a copy
Rectification of data that is inaccurate or incomplete
Erasure of your data, where we have no overriding reason to keep it
Restriction of processing in certain circumstances
Data portability — receive your data in a structured, machine-readable format
Object to processing based on legitimate interests, and to direct marketing at any time
Withdraw consent at any time, without affecting processing that already took place
Not be subject to a decision based solely on automated processing that significantly affects you. We do not carry out such decision-making.

To exercise any of these, email info@harperandshade.com. We respond within one month. There is no charge, and we may ask you to confirm your identity before we release data.

Right to complain: if you are unhappy with how we handle your data, you can complain to the Irish supervisory authority:

Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
www.dataprotection.ie

You may also complain to the supervisory authority in the EU country where you live or work.

9. Marketing emails

If you subscribe, we will email you about new arrivals, collections and offers. Every email contains a one-click unsubscribe link, and you can also email us to be removed. Unsubscribing from marketing does not stop transactional emails about an order you have placed — those are part of fulfilling your contract.

10. Security

We use TLS encryption across the site, restrict access to personal data to people who need it, and work only with processors who maintain appropriate security measures. No system is perfectly secure, but if a breach occurs that is likely to result in a high risk to your rights, we will notify you and the Data Protection Commission as required by law.

11. Children

Our store is intended for adults. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email us and we will delete it.

12. Changes to this policy

We may update this policy as our business or the law changes. Updates are published on this page with a revised date. If the change is significant, we will tell you by email or by a notice on the site.

Questions? Email info@harperandshade.com — Monday–Friday 9:00–17:00, Weekends 11:00–17:00 (Irish Standard Time).