Privacy policy

Fleur by Fable & Femme Privacy Policy (UK)

Last updated: August 2026

Fleur by Fable & Femme respects your privacy and is committed to protecting your personal data. This policy explains how we collect, use, and safeguard your information when you visit our website, make a purchase, or interact with us.

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

1. Who we are

Fleur by Fable & Femme is a trading name of Fable and Femme Ltd.

  • Company name: Fable and Femme Ltd
  • Registered office: 17 St John's Road, Ipswich, IP4 5DF
  • Email: [email protected]
  • Company number: 16868495
  • Telephone: 020 3393 0913

Fable and Femme Ltd is the Data Controller responsible for your personal data.

2. The data we collect

We collect only the information necessary to provide our services effectively.

Information you provide

  • Name
  • Email address
  • Billing and delivery address
  • Phone number (optional)
  • Order details
  • Date of birth, where needed to confirm you meet our 18+ age requirement
  • Customer support communications

Information collected automatically

  • IP address
  • Device and browser type
  • Cookie identifiers
  • Website usage data (pages viewed, interactions, referral source)

Sensitive data

We do not intentionally collect special category (sensitive) personal data, such as health data. We recognise that a record of a CBD purchase could suggest something about a customer's wellbeing, and we do not use order data to infer or profile anyone's health. Please avoid including health details in free-text fields such as customer support messages unless it is necessary to resolve your enquiry. Orders are processed and stored discreetly.

3. How we use your data (and our legal basis)

We only process your data where we have a lawful basis to do so:

  • Contract – to process and deliver your orders, and to confirm you meet the age requirement for CBD products
  • Legal obligation – for accounting, tax, and product traceability compliance
  • Legitimate interests – to improve our website, prevent fraud, and maintain security
  • Consent – for marketing emails and non-essential cookies

We use your data to:

  • Verify your age before completing a purchase
  • Process payments and fulfil orders
  • Communicate order updates
  • Provide customer support
  • Improve our website and user experience
  • Detect and prevent fraud
  • Send marketing communications where permitted

4. Marketing communications

You will only receive marketing emails if:

  • You have opted in, or
  • You are an existing customer and have not opted out

You can unsubscribe at any time using the link in any email or by contacting us.

We never sell or share your data for third-party marketing.

5. Cookies

We use cookies to ensure our website functions properly and to improve your experience.

Types of cookies we use:

  • Essential – required for the website to function
  • Performance – to understand how visitors use our site
  • Preference – to remember your settings
  • Marketing – for advertising and tracking (only with your consent)

Non-essential cookies are only set after you provide consent via our cookie banner. You can update your preferences at any time.

6. How we share your data

We only share your data with trusted service providers necessary to run our business.

These may include:

  • Shopify (our website platform and hosting provider)
  • Klarna, our current payment provider for CBD orders, and any additional CBD-approved payment provider we introduce (such as Viva.com)
  • Delivery and fulfilment partners
  • Analytics providers (such as Google Analytics)
  • IT and security providers

All partners are required to process your data securely and in line with data protection laws.

We do not sell your personal data.

7. International data transfers

Some of our service providers may process data outside the UK.

Where this happens, we ensure appropriate safeguards are in place, such as:

  • UK-approved Standard Contractual Clauses
  • Adequacy regulations
  • Additional technical and organisational safeguards

8. How long we keep your data

We only retain your data for as long as necessary:

  • Order and financial records: up to 7 years
  • Customer support communications: up to 2 years
  • Marketing data: until you unsubscribe or withdraw consent
  • Cookies: in line with individual cookie durations

9. Your rights

Under UK GDPR, you have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Request deletion of your data
  • Restrict or object to processing
  • Request data portability
  • Withdraw consent at any time

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

To exercise your rights, contact: [email protected]

10. Security

We take data protection seriously and implement appropriate security measures, including:

  • Encrypted payment processing
  • SSL-secured website
  • Access controls
  • Secure hosting infrastructure
  • Ongoing monitoring and testing

We prioritise discretion and confidentiality at every stage.

11. Age restriction and children's privacy

Our products are restricted to customers aged 18 and over. Our website is not intended for individuals under 18, and we do not knowingly collect data from children. We may ask you to confirm your age before completing a purchase.

12. Automated decision-making

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

13. Changes to this policy

We may update this policy occasionally to reflect legal or operational changes. Updates will be posted on this page with a revised date.

14. Contact us

If you have any questions about this policy or your data:

Fable and Femme Ltd 71–75 Shelton Street London WC2H 9JQ Email: [email protected]