Cookie & Privacy Policy

Last updated: 13 November 2026

1. Who we are and how to contact us

Brocklehursts is a trading name of John Brocklehurst Manufacturing Limited. We are responsible for deciding how your personal information is used when you shop on our website, contact us, or use our customer services and rewards programme. This policy also explains how information from purchases in our shops may be linked to your online customer record.

For privacy questions, requests or complaints, contact us at sales@brocklehursts.com, telephone 01629 812089, or write to Brocklehursts, The Beeches, Matlock Street, Bakewell, Derbyshire, DE45 1EE. Please mark written requests “Privacy”.

2. Information we collect

Depending on how you interact with us, we collect:

• Your name, billing and delivery addresses, email address and telephone number.
• Customer account details, preferences, orders, payments, delivery records, returns, exchanges and correspondence.
• Rewards membership, points, tier, redeemed rewards, reviews and wishlist information. If you provide your birthday for a birthday reward, we use it to administer that reward.
• Information you provide in enquiries, price-match requests, competitions, event registrations or requests for stock notifications.
• Information about your device and use of our website, such as your IP address, browser, products viewed, basket activity and cookie identifiers.
• Email subscription preferences and recorded interactions with our messages, including opens and clicks.

Payment providers process your payment details. We receive transaction information needed to administer your order; we do not keep your full payment card details in our customer records.

We obtain information directly from you, from your use of our website and messages, from purchases recorded in our shops, and from service providers that process payments, deliveries, website activity and customer communications. Customer records may include information transferred from our previous retail or website systems.

3. Why we use information and our legal grounds

• Orders and customer services: to take payment, supply products, arrange delivery, handle returns and respond to requests. We use information where necessary to enter into or perform our contract with you. Our legitimate interests in providing customer support also apply to general enquiries.
• Accounts and rewards: to administer the services you request, including rewards, points and benefits, on the basis of our contract with you. We also have a legitimate interest in preventing misuse and keeping accurate records.
• Marketing: to send email marketing where we have your consent or where the law otherwise permits us to do so. Where we rely on consent, you can withdraw it at any time. Where the law permits marketing without consent, we rely on our legitimate interests in promoting our own relevant products and services. You can object to direct marketing at any time.
• Personalisation and service improvement: to understand purchasing patterns, tailor communications and improve our products and services. We rely on our legitimate interests in running and improving our business where this is appropriate and does not override your rights. Where consent is required for tracking or advertising technologies, we rely on consent.
• Security and fraud prevention: to protect customers, payments, accounts and our business, based on our legitimate interests and any applicable legal obligations.
• Record keeping and disputes: to meet tax, accounting and other legal obligations, and for our legitimate interests in establishing, exercising or defending legal claims.

Our payment providers use automated security and fraud checks when processing payments. These checks may decline a payment or prevent it from completing without prior review by our staff. For example, Shopify Payments can decline a card payment that fails card security-code verification, so that no order is placed. If you have difficulty completing a payment, contact us at sales@brocklehursts.com.

Some information is necessary to process an order or provide a requested service. If you do not provide it, we may be unable to fulfil that request. Optional information, such as a birthday for rewards, is not required to shop with us.

4. Marketing, personalisation and your choices

Our direct marketing communications are currently sent by email only. We send these messages where we have your consent or another permission allowed by law. You can unsubscribe at any time using the link in a marketing email or by contacting us at sales@brocklehursts.com.

We use Klaviyo to manage email subscriptions and communications. Purchase history, interests and recorded email or website activity may help us choose relevant products, offers and messages. For example, we may group customers according to recent purchases or engagement. These groupings help us plan marketing; they are not a requirement to buy from us.

You have the right to object to direct marketing at any time, including profiling connected with direct marketing. Use the unsubscribe link in an email or contact us. Unsubscribing from marketing does not prevent necessary communications about an order, refund or service you have requested.

We use Klaviyo tracking pixels and tracked links to record email opens and clicks. Email-to-website tracking can connect interactions with our emails to subsequent activity on our website. Our website integration also collects activity such as site visits, product views, searches and basket updates.

Klaviyo can associate previously collected browsing activity with your customer profile once you are identified. We use this information to measure performance, personalise communications, group audiences and support automated messages. Contact us about tracking and your privacy choices.

We retain limited information about opt-outs where necessary to respect your preferences. An unsubscribe does not automatically delete order records or other information we need for a separate lawful purpose.

5. Cookies, similar technologies and advertising

What these technologies do

Cookies are small files stored on your device. They help websites remember information between visits or pages. Pixels, tags and similar technologies can also collect information about website or email activity. This section should be read alongside the email-tracking information in section 4.

First-party cookies are stored under the domain of the website you visit; third-party cookies are stored under another domain. Service providers can use either type, so a provider’s cookie is not necessarily a third-party cookie. Session cookies normally expire when your browsing session ends. Persistent cookies remain until their expiry date or until you delete them.

Why we use them

We use technologies from Shopify and connected providers, including Google, Meta and Klaviyo, to operate the shop, remember choices, understand usage and support marketing. Advertising integrations may share identifiers and browsing or purchase events to measure advertising and reach relevant audiences.

• Required: functions such as signing in, using the basket and keeping the service secure.
• Personalisation: remembering activity and preferences to personalise your experience.
• Analytics: understanding how visitors use the website and identifying improvements.
• Marketing: measuring marketing, tailoring communications and supporting relevant advertising.

Cookie names, purposes and lifetimes

The table below gives provider-published details for cookies associated with services used on our website. Which cookies are set depends on the features you use, your choices and your browser. These are documented lifetimes, rather than a guarantee that every cookie is set on every visit. Browsers can shorten these periods, and cookies may be renewed during subsequent use. Cookie expiry is separate from how long a provider retains information already collected.

For the providers’ explanations, see Shopify’s merchant-storefront cookie list, Google Analytics cookie information, Klaviyo cookie information and Meta’s advertising cookie information. These providers’ wider lists also cover services and websites other than ours.

The Google Analytics cookie defaults above are different from our 14-month user and event data retention setting. A tracking pixel or server-to-server event does not necessarily create a cookie with its own expiry date; the information collected is subject to the relevant retention arrangements described elsewhere in this policy.

Your choices

Our Shopify cookie banner is configured for visitors in the United Kingdom and offers Accept, Decline and Manage preferences. Where consent is required, you can choose whether to allow optional technologies. Required technologies support the operation of the service and cannot be switched off using its optional-cookie controls.

In the customer account area, the footer’s Cookie preferences control opens the Cookie and privacy preferences panel. You can choose Decline all to refuse optional categories, or select individual categories and choose Save my choices. These controls also allow you to change your choices for the customer account area.

Withdrawing consent does not affect processing that was lawful before withdrawal. Website cookie choices and email marketing preferences concern different activities: changing cookie choices does not unsubscribe you from marketing emails. Use the unsubscribe link in an email or contact us to stop email marketing.

Browser controls and further information

Your browser also provides controls to block or delete cookies. See your browser’s help pages for instructions. Blocking required cookies may prevent parts of the website from working. Deleting cookies may also remove saved preferences, so you may be asked to choose again. Browser cookie controls do not cover every form of tracking or replace email privacy choices.

For questions about cookies or help with your choices, contact sales@brocklehursts.com. The other sections of this policy explain how we use personal information, who receives it, international processing, retention and your rights.

6. Who receives information

We use service providers to run our website and customer services. Relevant providers and purposes include:

• Shopify: our ecommerce platform, customer accounts, checkout and connected point-of-sale services.
• Payment providers, including Shopify Payments and PayPal: payment processing, refunds and payment security.
• Klaviyo: customer communications, marketing preferences, audience management and reporting.
• Growave: rewards, reviews, wishlists and related customer communications.
• AMP Back in Stock and Hulk form tools: requested stock alerts and customer enquiries.
• Matrixify, Autoprinter and business-system integrations: importing and exporting records, order-document printing and synchronising business records. Our Shopify integration connects with Brightpearl.
• Google and Meta: analytics, advertising measurement and relevant advertising, subject to applicable consent requirements.
• Delivery companies, technology and support providers, professional advisers and public authorities: where needed to deliver orders, maintain systems, provide advice or meet legal obligations.

We may also disclose relevant information where necessary for a business sale or restructuring, or to establish, exercise or defend legal rights. Some providers process information on our instructions; others, such as certain payment and advertising providers, have their own responsibilities and privacy policies.

7. Shopify’s own use of information

Our store uses Shopify enhanced services, including Shopify Network Intelligence. These services can involve Shopify combining information about interactions with our store with information from other merchants and Shopify services to provide and improve services, personalisation and advertising. For relevant processing, Shopify acts as a controller in its own right.

Read the Shopify Consumer Privacy Policy and visit the Shopify Privacy Portal for information about Shopify’s use of information and privacy choices.

8. International processing

Our providers operate internationally. Personal information may be stored, backed up or accessed by authorised support personnel outside the United Kingdom. A provider's main hosting location does not necessarily cover all of its processing or support activities.

Shopify permits international processing, including in Canada and Singapore, even where a store uses European Union data hosting. Klaviyo hosts customer data in the United States. Growave also hosts data in the United States and permits remote support and operational access from the Kyrgyz Republic, Philippines, India, Türkiye, European Economic Area and United States. Autoprinter publishes United States hosting and processing arrangements. Other providers may use international infrastructure and support teams.

The safeguards depend on the provider and the transfer. Shopify and Klaviyo publish contractual arrangements incorporating the UK Addendum to the European Commission's Standard Contractual Clauses. Growave publishes a UK International Data Transfer Agreement. Autoprinter and HulkApps also specify UK contractual addenda. Other arrangements can include UK adequacy regulations and, for eligible transfers to participating US organisations, the UK Extension to the EU–US Data Privacy Framework. Google publishes reliance on that framework; PayPal describes adequacy arrangements and contractual safeguards according to the transfer.

For further information, see the Shopify data-processing terms, Klaviyo data-processing terms and Growave UK transfer agreement. Contact sales@brocklehursts.com for details of the safeguards applicable to your information and how to obtain a copy.

9. How long we keep information

We keep information for as long as it is needed for the purpose for which it is held, taking account of legal requirements, customer service, outstanding transactions and disputes. Different types of records have different retention needs:

• Orders, payments and accounting records: We normally retain order, payment and associated accounting records for six years after the end of the financial year to which they relate. We may retain relevant records for longer where required by law or where necessary to resolve an outstanding complaint, dispute or legal claim. Once the applicable retention period and any continuing need have ended, we delete or anonymise the information.
• Customer accounts and rewards:

  We retain customer account and rewards information while it is needed to administer your account, membership and benefits. When reviewing inactive accounts or handling an account-closure request, we consider outstanding orders, returns, points, reward codes, complaints and any legal record-keeping requirements.

  Once the information is no longer needed, we delete or anonymise it. Expiry of points or reward codes does not automatically delete your account. Records needed for accounting or other legal purposes are retained separately for the applicable period.

• Enquiries and customer-service correspondence:

  We retain enquiries and customer-service correspondence for as long as needed to respond, resolve the matter and deal with relevant follow-up questions.

  Correspondence relating to an order, return, complaint or dispute may be retained with the relevant records for their applicable retention period where necessary. Routine enquiries that are no longer needed are deleted or anonymised.

• Marketing records:

  We retain marketing information while it is needed to manage your subscription and provide relevant communications, taking account of your preferences, engagement and our ongoing relationship with you.

  If you unsubscribe or object to direct marketing, we stop using your information for that purpose. We retain limited information where necessary to record and respect your opt-out, together with evidence of consent where needed to demonstrate compliance.

  Unsubscribing does not automatically delete your customer account or order history. Marketing information that is no longer needed is deleted or anonymised, subject to any applicable legal requirements.

• Matrixify import and export job files: the app is configured to erase job files older than 365 days. This does not delete the underlying Shopify records. Separately retained recovery or reconciliation copies are assessed according to their purpose and any continuing need.
• Google Analytics: our user and event data retention setting is 14 months, with user retention resetting on new activity. This setting does not govern all aggregated reports or information held in other systems.

When information is no longer needed, we delete or anonymise it in accordance with the applicable retention arrangements. Backup copies and records subject to a legal hold may have different deletion schedules.

10. Security

We use technical and organisational measures designed to protect personal information and limit access to those who need it for their work. No online service can guarantee absolute security. Please do not send full payment card details or unnecessary sensitive information by email or through an enquiry form.

11. Your rights and complaints

Subject to the conditions and exceptions in data protection law, you can request access to your information, correction of inaccuracies, deletion, restriction of processing, or a portable copy of certain information. You can object to processing based on legitimate interests and withdraw consent where we rely on it.

Contact us using the details above. We may need information to verify your identity. We normally respond to rights requests within one month; if the law allows additional time, we will explain this. Requests are normally free of charge.

If you are unhappy with how we handle your information, you can make a complaint to us by email, telephone or post. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint/ or by telephone on 0303 123 1113. You do not have to complete our complaints process before contacting the ICO.

12. Other websites and changes to this policy

Other websites linked from ours have their own privacy policies. Please review those policies when using their services.

We may update this policy to reflect changes to our services or legal requirements. We will update the date above and provide further notice where required. Publishing a revised policy does not replace any consent required for a new use of your information.