Privacy Policy

Privacy Policy

UruShop Limited
Last updated: 9 November 2026

At UruShop, we respect your privacy and are committed to protecting your personal information. This policy explains what information we collect, how we use it, and your rights under UK data protection law.

Matching with Meta and Google: we match some customers’ details with Meta (Facebook and Instagram) and Google, in scrambled form, so that we can avoid showing new-customer ads to people who already shop with us and show offers to past customers. You can stop this at any time. See section 4.

1. Who We Are

UruShop Limited is responsible for the personal information collected through our website, urushop.co.uk.

If you have any questions about this policy or how we handle your information, you can contact us:

Email: [email protected]
Address: UruShop Limited, 5A Morris Road, Leicester, LE2 6BR, United Kingdom.

2. Information We Collect

When you shop with us, create an account, browse our website or contact us, we may collect:

• Personal details: Your name, email address, telephone number, billing and delivery addresses.
• Order information: Products purchased, order history, payment confirmations, delivery information, returns and refunds, and any personalisation details you provide.
• Account information: Login details, saved preferences and account activity.
• Communications: Messages, enquiries, feedback and reviews.
• Website information: IP address, device and browser information, website activity and cookie preferences.
• Marketing preferences: Your subscriptions, consent choices and marketing opt-outs.

We may also receive relevant information from payment providers, delivery companies and marketplaces such as Amazon and eBay when necessary to fulfil your orders.

Payments are processed securely through third-party payment providers.

3. How We Use Your Information

We use personal information to:

• Process payments, fulfil orders and arrange deliveries.
• Manage customer accounts, subscriptions, returns and refunds.
• Respond to enquiries and provide customer support.
• Maintain our website, improve our services and protect against fraud.
• Meet legal, accounting and regulatory obligations.
• Send promotional communications where permitted by law.
• Measure and improve our marketing and advertising, including through customer audience matching with advertising platforms where legally permitted.

Under UK GDPR, we rely on the following lawful bases:

Contract: To process orders, manage accounts and provide services you request.

Legal obligation: To maintain required business records and comply with applicable laws.

Legitimate interests: To operate and secure our business, provide customer support, improve our services and carry out proportionate marketing activities, where our interests are not overridden by your rights.

Consent: For activities that require your permission, including non-essential cookies and certain marketing communications.

You can withdraw consent or object to direct marketing at any time.

Marketing emails: We may send you information about products, promotions and offers where you have consented or where permitted under applicable marketing laws. You can unsubscribe from marketing emails at any time using the link in our emails or by contacting us.

4. Matching Your Details with Meta and Google

What this is: Meta (Facebook and Instagram) and Google let a shop upload a list of its customers, so that ads can be shown to, or kept away from, those customers when they use those services. We do this, as explained below.

Whose details: UruShop customers who ordered through urushop.co.uk, in two groups:

• people who ordered in the last 12 months; and
• people whose last order was between 1 and 3 years ago.

We do not include: customers whose last order was more than 3 years ago; anyone who has unsubscribed from our emails, marked them as spam, objected to ad matching or asked us to erase their information; marketplace (Amazon, eBay) customers; or a random 20% of the second group, whom we leave out on purpose so that we can measure honestly whether the ads make any difference.

What we share: Your email address, phone number, and first and last name, taken from our customer and order records. Meta also receives your postcode, town or city, and country. Before anything leaves our systems, each detail is converted into a scrambled code (a SHA-256 “hash”). Meta and Google can check a code against the codes of their own users, but cannot turn it back into your details. Hashing protects the details in transit, but it is not anonymisation: if you have an account with them, they can still recognise you.

We do not share what you bought or your order dates. Being on a list does tell Meta or Google that you are an UruShop customer and roughly when you last ordered (for example “in the last 12 months”), and being on our Google regular-customers list (below) tells Google that you have ordered at least three times. For one list only, the Meta lookalike list (below), Meta also receives a spending figure for each customer, capped at £500 and not linked to any product.

Why:

• To avoid showing you ads meant for new customers when you have bought from us in the last 12 months. This keeps irrelevant ads away from you and stops us wasting money.
• To show offers to past customers whose last order was 1 to 3 years ago, for example a Black Friday or Christmas offer.
• To help Meta and Google find new people with similar shopping interests. Meta builds a “lookalike” audience from customers whose last order was within 2 years. Google uses a list of our regular customers (3 or more orders, last order within 3 years) as a guide for its automated campaigns, and to show us how our ads perform with existing customers. Neither shows those new people anything about you.

What Meta and Google do with it: They compare the codes with their users’ details. If there is no match, the code is discarded. If there is a match, the account is added to an audience we can select for, or exclude from, our ads. They do not tell us who matched, and they do not give our lists to other advertisers. Meta’s terms say it deletes the uploaded list once matching is complete. Google says it marks the uploaded file for deletion once matching (up to 48 hours) and its policy checks are done.

Who they are: Meta Platforms Ireland Limited (Facebook and Instagram) and Google (Google Ads, which shows ads on Google Search, YouTube, Gmail and other Google services). Meta’s terms describe Meta as our processor for this matching, and Google treats Customer Match as a service it provides as our processor. The Information Commissioner’s Office (ICO) says that a business and an advertising platform are often joint controllers for this kind of targeting. Either way, we are responsible for telling you about it and for acting on your objection. You can also contact Meta or Google directly through their own privacy pages: Meta Privacy Policy and Google Privacy Policy.

Lawful basis: Legitimate interests (direct marketing). We have written an assessment that weighs our interest in advertising efficiently against your privacy. It limits the lists to recent customers, uses scrambled details only, leaves out everyone who has opted out, and deletes the offer lists after each campaign. You can ask us for a copy.

How long:

• The 12-month customers list is updated every week while we advertise, so people who have not ordered for 12 months drop off it. It is deleted when we stop advertising on that platform.
• The past-customers lists, the Meta lookalike list (and the audience built from it) and the Google regular-customers list for the 2026 Black Friday and Christmas season will be deleted after 21 December 2026, and by 31 December 2026 at the latest. If we decide to run them again, we will update this notice first.
• On Google, anyone who is not uploaded again within 540 days drops off a list automatically.

How to object (stop us using your details for this): You have an absolute right to object, and you do not need to give a reason.

• Email [email protected] with the subject “Stop ad matching”, from the email address you shop with (or tell us that address in the message). If you also want to stop our marketing emails, say so.
• You can also tell us in live chat or in reply to any of our emails. Words like “stop” or “don’t use my details for ads” are enough.
• Unsubscribing from our marketing emails also takes you off these lists.

We will reply to confirm. We will leave you out of every upload from that point on, and remove you from lists already uploaded at our next update (normally within a week) and within one month at the latest. We keep a “do not match” note on your contact record in our email system, and nothing more than we need, so that we do not add you back by mistake.

Meta and Google also let you control ads, for example “Hide all ads from this advertiser” on Facebook and Instagram, or My Ad Centre on Google. Those settings stop you seeing our ads but do not take you off our lists, so please email us as well.

Not the same as cookies: List matching uses details from your orders. It is separate from the advertising cookies and pixels described in section 6, which we use only with your consent.

We do not sell your personal information.

5. Sharing Your Information

We share personal information only where necessary to operate our business, provide our services or comply with legal requirements.

This may include:

• Payment processors and financial service providers.
• Delivery and logistics companies.
• Website hosting, security and IT service providers.
• Customer service, email and order management platforms.
• Analytics and advertising partners, including Google, Meta and Microsoft.
• Professional advisers, regulators and authorities where required.

These organisations receive information relevant to the services they provide and handle it according to their applicable data protection responsibilities.

Some providers may process information outside the United Kingdom. Where this happens, we use applicable adequacy arrangements or appropriate legal safeguards, such as approved international data transfer agreements. You can contact us for further information about these safeguards.

6. Cookies and Website Analytics

Our website uses cookies and similar technologies to support essential functions, understand website performance and improve our advertising.

Essential cookies help with functions such as shopping baskets, checkout and website security.

With your consent, we may also use analytics and advertising technologies, including Google Analytics, Microsoft Clarity, Meta and Google Ads.

You can accept, reject or manage non-essential cookies through our cookie banner and change your preferences using the cookie settings available on our website.

7. How Long We Keep Your Information

We keep personal information only for as long as necessary for the purposes described in this policy.

Order, payment and accounting records are generally retained for six years after the relevant financial year, where required for legal and tax purposes.

Account information is retained while your account remains active and for an appropriate period afterwards. Customer service records, marketing information, advertising audiences and website activity data are retained according to their purpose, applicable retention schedules and legal requirements.

Where information is no longer required, we delete or anonymise it, unless we need to retain it for legal obligations or legitimate legal claims.

We may retain limited information about marketing opt-outs to ensure your preferences continue to be respected.

8. Your Privacy Rights

Under UK data protection law, you have rights concerning your personal information, including the right to:

• Request access to information we hold about you.
• Ask us to correct inaccurate information.
• Request deletion of your information in certain circumstances.
• Restrict or object to certain uses of your information.
• Request the transfer of eligible information to another provider.
• Withdraw consent where processing is based on consent.

You have the right to object to direct marketing at any time, including advertising based on customer lists.

To exercise your rights, contact [email protected]. We will respond within the timeframes required by law, normally within one month.

We do not make solely automated decisions about customers that produce legal or similarly significant effects.

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

We may update this policy to reflect changes in our services, legal requirements or data practices. The latest version will always be available on our website.

Related Policies