Skip to main content

Privacy Policy

1. Who we are

This policy explains how we handle your personal data when you use The Loot Hut at theloothut.com, including our client-branded shops, and when you buy from us.

The data controller is ESPI Group Limited, trading as The Loot Hut, a company registered in England and Wales (company number 09114924), registered office 483 Birmingham Road, Marlbrook, Bromsgrove, Worcestershire, B61 0HZ.

If you have any questions about this policy or your data, contact us at [email protected].

2. The data we collect

When you place an order or contact us, we collect:

  • Your details: name, email address, and phone number (where provided).
  • Delivery details: the delivery address for your order.
  • Order details: the products, colours and designs you choose, and any personalisation text you supply (for example, a name to be engraved).
  • Payment information: your payment is processed by Stripe. We receive confirmation that payment succeeded and limited transaction details. We do not collect or store your full card number.
  • Technical and usage data: basic information about how you use the site and how you reached it, collected through essential cookies, our own advert-attribution cookie and, only if you agree, advertising cookies. See section 8.

3. How we use your data and our lawful basis

Why we use it Lawful basis (UK GDPR)
To take payment, produce your personalised order and deliver it Performance of our contract with you
To send order confirmations, updates and respond to enquiries Performance of our contract / our legitimate interests
To handle faults, returns and complaints Performance of our contract / legal obligation
To keep records for tax and accounting Legal obligation
To improve and secure the website Our legitimate interests
To see which advert or link led to an order (our own lh_attr cookie, saved with your order) Our legitimate interests
To measure which of our adverts lead to visits and orders (Meta Pixel and purchase events on our gift pages) Your consent
To send marketing, where you have asked us to Your consent

4. Who we share your data with

We share your data only as needed to fulfil your order and run our business:

  • Stripe (our payment processor) to take and confirm payment.
  • Meta Platforms Ireland Limited, only if you accept advertising cookies on our gift pages, to measure our adverts (see section 8).
  • Couriers and delivery partners to deliver your order.
  • Our IT, hosting and software providers who help us run the site, acting on our instructions.
  • HMRC, regulators or law enforcement where we are legally required to.

We do not sell your personal data to anyone.

5. International transfers

Some of our providers, including Stripe and Meta, may process data outside the UK. Where that happens, we rely on appropriate safeguards (such as UK adequacy regulations or standard contractual clauses) to make sure your data is protected to UK standards.

6. How long we keep your data

We keep order and customer records for as long as needed to fulfil your order and provide support, and then for 6 years to meet our legal and accounting obligations (UK tax records). Marketing contact details are kept until you withdraw consent or unsubscribe.

7. Your rights

Under UK data protection law you have the right to:

  • access the personal data we hold about you;
  • ask us to correct inaccurate data;
  • ask us to delete your data, where there is no overriding reason to keep it;
  • restrict or object to how we use your data;
  • ask for a copy of certain data in a portable format;
  • withdraw consent at any time, where we rely on consent.

To exercise any of these, contact [email protected]. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113, though we would appreciate the chance to put things right first.

8. Cookies

We use a small number of cookies and similar technologies:

  • Strictly necessary: to keep your basket on our gift pages (stored in your browser), to remember your cookie choice (lh_consent, kept for 6 months), and to take payment through Stripe.
  • Advert attribution (our own cookie): if you arrive from one of our adverts, we store the advert details from the link (such as utm_source, utm_campaign, Meta's click ID and the page you landed on) in a cookie on our own site (lh_attr, kept for 30 days). If you then place an order, those details are saved with your order, whether or not you accept advertising cookies, so we know which advert led to it. They are shared with Meta only if you accept advertising cookies.
  • Advertising (only with your consent): on our gift pages we use the Meta (Facebook) Pixel to measure which adverts lead to visits and orders. It only loads if you choose Accept, and it sets Meta's cookies (_fbp, _fbc). Once it has loaded, the Pixel tells Meta which of our gift pages you view and when you personalise a product, add to your basket, start checkout and buy (with the product ids and values). If you accept and then buy, we also send Meta the purchase (order value and products) with your email address, phone number (if you gave one), name, town, postcode and country in hashed (scrambled) form, plus your IP address and browser details, so Meta can match the purchase to the advert. Your IP address, browser details and Meta's cookie values are kept with your order only until the purchase has been sent to Meta, and are then deleted. The copy made at checkout has these details removed once your purchase has been sent to Meta, and any copy from a checkout that wasn't completed is deleted after 30 days.

You can change your choice at any time using Cookie settings on our gift pages. Choosing Reject removes Meta's cookies.

9. Marketing

We will only send you marketing if you have asked us to or otherwise agreed. You can opt out at any time using the unsubscribe link in our emails or by contacting us. Opting out of marketing does not stop service messages about an order you have placed.

10. Changes to this policy

We may update this policy from time to time. The current version is always the one published here, and we will note the date it was last updated below.

Controller: ESPI Group Limited trading as The Loot Hut · Company number 09114924 · 483 Birmingham Road, Marlbrook, Bromsgrove, Worcestershire, B61 0HZ · [email protected]

Last updated: 2 October 2026