Privacy

Privacy and Data Protection Policy

Last updated: 24^th August 2026

At ARRAN Sense of Scotland, we take your privacy seriously. This Privacy Policy explains how we collect, use, store and protect your personal information when you visit our website, create an account, make a purchase, subscribe to our marketing, contact us, interact with us on social media or otherwise use our services.

It also explains your rights in relation to your personal information and how you can contact us if you have any questions or concerns.

1. Who we are

Arran Aromatics Ltd, trading as ARRAN Sense of Scotland (“ARRAN”, “we”, “us” or “our”), is responsible for the personal information described in this Privacy Policy.Arran Aromatics Ltd is a company incorporated in Scotland with Company Registration Number 08399920.

Our registered office is:

International House
14 King Street
Leeds
West Yorkshire
LS1 2HL
United Kingdom

We are registered with the Information Commissioner’s Office (“ICO”) under registration number ZA766045.

If you have any questions about this Privacy Policy or how we use your personal information, please contact us at:

Email: info@arran.com

2. What personal information we collect

The personal information we collect depends on how you interact with us.

It may include:

·       your name;

·       billing and delivery addresses;

·       email address;

·       telephone number;

·       account and login information;

·       order and transaction history;

·       payment and transaction information;

·       customer service enquiries and correspondence;

·       returns, refunds and complaint information;

·       marketing preferences;

·       information about how you interact with our emails and other marketing;

·       browsing and website activity;

·       device, browser and IP address information;

·       cookie identifiers and similar online identifiers;

·       information you provide through competitions, promotions, reviews, surveys or social media interactions; and

·       any other information you choose to provide to us.

We do not normally receive or store your full payment card details. Payments are processed by our payment service providers.

Where information is required to complete an order or provide a service, we will make this clear. If you do not provide required information, we may not be able to process your order or provide the relevant service.

3. How we collect your information

We collect personal information:

·       directly from you, for example when you place an order, create an account, subscribe to our newsletter, contact customer services, enter a competition or leave a review;

·       automatically, when you use our website or interact with our marketing, through cookies and similar technologies;

·       from service providers, such as payment providers, delivery partners, ecommerce and technology providers; and

·       from advertising and analytics partners, where permitted by law and in accordance with your cookie and privacy choices.

We may also receive information when you interact with ARRAN through social media platforms. The way those platforms use your information is governed by their own privacy policies.

4. How and why we use your personal information

We will only use personal information where we have a lawful basis to do so.

Depending on the circumstances, we rely on:

·       Contract – where processing is necessary to enter into or perform a contract with you, for example to fulfil an order.

·       Consent – where you have actively agreed to a particular use of your information.

·       Legitimate interests – where the processing is necessary for our legitimate business interests, provided those interests do not override your rights and freedoms.

·       Legal obligation – where we need to process information to comply with a legal or regulatory requirement.

Our main uses of personal information are set out below.

Purpose	Examples of information used	Main lawful basis
Processing and delivering orders	Name, contact details, delivery address, order and payment information	Contract
Managing your customer account	Identity, contact details, account and order history	Contract / legitimate interests
Customer service, returns and refunds	Contact details, order information and correspondence	Contract / legitimate interests
Product recalls and important service messages	Contact and purchase information	Legal obligation / legitimate interests
Preventing fraud, misuse and protecting our website	Account, transaction, device, IP and technical information	Legitimate interests / legal obligation where applicable
Maintaining accounting and tax records	Identity and transaction information	Legal obligation
Sending marketing communications	Contact details and marketing preferences	Consent and/or legitimate interests where permitted by electronic marketing law
Personalising marketing and customer communications	Purchase history, browsing behaviour and marketing engagement	Legitimate interests and, where required, consent
Website analytics and performance	Device, browser, cookie and website usage information	Legitimate interests, consent or another applicable exemption depending on the technology used
Online advertising	Browsing, device and interaction information	Consent where required
Reviews, competitions and promotions	Identity, contact and submitted information	Contract, consent and/or legitimate interests
Responding to privacy requests and complaints	Identity, contact details and correspondence	Legal obligation / legitimate interests
Improving our products, website and customer experience	Orders, customer feedback, website activity and aggregated information	Legitimate interests

 

Where we rely on legitimate interests, those interests may include operating and improving our business, understanding our customers, providing relevant products and communications, protecting our systems, preventing fraud and delivering effective customer service.

We will balance those interests against your privacy rights before relying on this lawful basis.

5. Marketing communications

If you have asked us to send you marketing, we may use your contact details to send information about ARRAN products, collections, events, offers, promotions and other news.

Where permitted by law, we may also contact existing customers about ARRAN products or services similar to those they have previously purchased or shown an interest in.

Where the law requires us to obtain your consent, we will do so before sending marketing.

You can stop receiving marketing communications from us at any time by:

·       selecting the unsubscribe link in our marketing emails;

·       changing your marketing preferences through your account, where available; or

·       contacting us at info@arran.com.

Stopping marketing communications will not prevent us from sending essential service communications relating to an order, your account, product safety or another service you have requested.

6. Personalisation and profiling

We want the communications and experiences we provide to be relevant to our customers.

We may therefore use information such as:

·       previous purchases;

·       products or pages viewed;

·       responses to promotions;

·       email engagement; and

·       other interactions with ARRAN

to understand likely customer interests and tailor products, content, offers and marketing.

This type of analysis may constitute profiling under data protection law.

Where cookies or similar technologies are used for profiling or advertising and consent is legally required, we will ask for your consent through our cookie preference tools.

You have the right to object to the use of your personal information for direct marketing, including profiling that relates to direct marketing.

ARRAN does not currently use solely automated decision-making that produces legal or similarly significant effects on customers.

7. Cookies and similar technologies

We use cookies and similar technologies to operate our website and provide our online services.

These technologies may be used to:

·       keep the website and shopping basket functioning;

·       remember preferences;

·       maintain security;

·       understand how our website is used;

·       measure website and marketing performance;

·       personalise content; and

·       provide and measure advertising.

Some technologies are necessary for our website to function and do not require consent.

We may also use certain technologies without consent where an exemption is available under applicable law, for example for limited statistical or functionality purposes. Where an exemption applies, we will provide the information and choices required by law.

Where consent is required, including for relevant advertising, tracking or profiling technologies, we will ask for your permission before using them.

For further information about the cookies and technologies currently used on our website, including their purpose and duration, please see https://arran.com/pages/cookie-policy.

8. Who we share your information with

We do not sell your personal information.

We may share personal information where necessary with trusted organisations that help us operate our business and provide our services.

These may include:

·       ecommerce and website technology providers;

·       payment processors and payment service providers;

·       delivery, fulfilment and logistics providers;

·       customer account providers;

·       customer service technology providers;

·       email, CRM and marketing platforms;

·       analytics providers;

·       advertising and social media platforms;

·       review and customer feedback providers;

·       fraud prevention and security providers;

·       professional advisers, insurers, auditors and accountants;

·       IT, cloud hosting and data storage providers; and

·       government bodies, regulators, courts or law enforcement agencies where required or permitted by law.

Where a third party processes personal information on our behalf, we require appropriate contractual and security protections.

Some third parties may process information as independent data controllers. Where this happens, their own privacy policies will explain how they use your information.

9. Klarna

Where we offer Klarna payment options, we may provide Klarna with certain personal information, such as your contact and order details.

Klarna uses this information to assess whether you qualify for its payment options, provide its services and, where applicable, tailor the payment options available to you.

Klarna processes personal information in accordance with its own privacy policy, which can we viewed here.

10. Advertising, analytics and personalisation providers

We use analytics, marketing and advertising services to help us understand how customers interact with ARRAN and to improve our website, marketing and customer experience.

Subject to your privacy and cookie choices, these providers may receive information such as:

·       IP address;

·       browser and device information;

·       pages or products viewed;

·       links clicked;

·       purchases or conversions;

·       advertising identifiers; and

·       interactions with our website or marketing.

This information may be used to measure marketing performance, understand customer behaviour, create audiences and deliver more relevant advertising.

Advertising and profiling technologies that require consent will not be used until the required consent has been obtained.

Examples of our current providers are Google, Microsoft, Meta, Shoify, Rebuy Dotdigital, Feefo and Recharge.

11. International transfers

Some of the organisations that provide services to us may process personal information outside the United Kingdom.

Where we transfer personal information internationally, we take steps to ensure that it continues to receive an appropriate level of protection.

Depending on the destination and circumstances, this may include:

·       transferring information to a country recognised by the UK government as providing an adequate level of data protection;

·       using approved contractual safeguards; or

·       relying on another legally permitted transfer mechanism.

Where required, we also carry out appropriate risk assessments before making international transfers.

You can contact us at info@arran.com if you would like further information about the safeguards used for international transfers of your personal information.

12. How long we keep your information

We do not keep personal information for longer than we need it.

How long we retain information depends on why it was collected, our legal and regulatory obligations and whether we need the information to establish, exercise or defend legal claims.

Our typical retention periods are:

Information	Typical retention period
Customer orders and transaction records	At least three years from the end of the tax year to which they relate. Certain related records may be retained for up to six years where justified for tax, accounting or legal-claims purposes.
Customer account information	While account remains active then 3 years after last meaningful activity for accounting and record keeping purposes.
Customer service and complaint correspondence	Typically 2-3 years, unless connected to an ongoing dispute or claim.
Marketing subscriber records	Until you unsubscribe or haven’t actively engaged with us for 12 months.
Marketing suppression records	Retained as necessary to ensure we continue to respect your opt-out
Cookie and online identifiers	As shown in our cookie preference centre
Competition and promotion records	Typically 12 months following the end of the competition or promotion.
Privacy rights requests and data protection complaints	3 years after the request or complaint has been closed.

 

We may retain information for longer where required by law, where there is an ongoing dispute or claim, or where another legitimate reason applies.

We may also anonymise personal information so that it can no longer identify you. We may retain anonymous information for research, statistical and business analysis purposes.

13. How we protect your information

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures include controls relating to access, security, systems, suppliers and staff.

No method of transmitting or storing information can be guaranteed to be completely secure. We regularly review the measures we use and update them where appropriate.

14. Your data protection rights

Depending on the circumstances, you may have the right to:

Access

Ask us for a copy of the personal information we hold about you.

Rectification

Ask us to correct inaccurate or incomplete personal information.

Erasure

Ask us to delete your personal information in certain circumstances.

Restriction

Ask us to restrict how we use your personal information in certain circumstances.

Data portability

Ask us to provide certain personal information in a structured, commonly used and machine-readable format, or transfer it to another organisation where applicable.

Object

Object to certain uses of your personal information where we rely on legitimate interests.

You have an absolute right to object to your personal information being used for direct marketing, including related profiling.

Withdraw consent

Where we rely on your consent, you may withdraw it at any time.

Withdrawing consent will not affect processing that took place before you withdrew it.

Rights relating to automated decision-making

Where applicable, you may have rights relating to decisions made using solely automated processing, including appropriate safeguards such as the ability to challenge a decision and request human involvement.

Not all of these rights apply in every situation. We may need to verify your identity before dealing with a request.

To exercise any of your rights, please contact info@arran.com.

We will respond in accordance with the timescales required by data protection law.

15. Subject access requests

If you ask for access to your personal information, we will take reasonable and proportionate steps to locate the information covered by your request.

Where necessary, we may ask you for clarification to help us understand the information you are requesting.

We may also ask you to provide information that is reasonably necessary to verify your identity.

16. Data protection complaints

If you are unhappy with how we have used your personal information or how we have dealt with a data protection request, please contact us.

Email: info@arran.com

We will take appropriate steps to help you make a complaint and will:

·       acknowledge a data protection complaint within 30 days;

·       take appropriate steps to investigate it;

·       respond without undue delay;

·       keep you informed of progress where appropriate; and

·       tell you the outcome of our investigation.

You also have the right to raise a concern with the Information Commissioner’s Office (ICO), the UK’s data protection regulator.

Information about how to contact the ICO is available at ico.org.uk.

We would appreciate the opportunity to address your concerns directly, but you do not need to contact us before raising a concern with the ICO.

17. Children

Our website and products are intended primarily for a general adult audience and we do not knowingly seek to collect personal information from children for marketing purposes.

18. Links to other websites

Our website may contain links to websites or services operated by other organisations.

Once you leave our website, those organisations are responsible for how they collect and use your personal information.

We recommend reviewing their privacy information before providing personal information to them.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example where our services, suppliers or legal obligations change.

We will publish the latest version on this page and update the “Last updated” date at the top.

Where a change materially affects how we use your personal information, we will take appropriate steps to bring the change to your attention.

20. Contact us

If you have questions about this Privacy Policy, wish to exercise your data protection rights or would like to make a complaint about how we use your personal information, please contact:

ARRAN Sense of Scotland
Arran Aromatics Ltd

Email: info@arran.com

Contact Address:
The Home Farm

Brodick

Isle of Arran

KA27 8DD