1. Who we are
homeward is operated by a group of companies. The company responsible for your personal data (the “controller”) depends on where you shop:
- United States and Canada: Homeward Beauty Inc., [REGISTERED ADDRESS], Canada.
- United Kingdom (and the EU from February 2027): Homeward Beauty UK Ltd, company no. [COMPANY NUMBER], [REGISTERED ADDRESS].
- Nigeria: Homeward Beauty Nigeria Ltd, RC [RC NUMBER], [REGISTERED ADDRESS], Lagos.
When you send a gift from one market to another (for example from London to Lagos), the company in the buyer’s market and the company that delivers the gift each act as controller for the parts of the order they handle.
[COUNSEL REVIEW] Confirm controller allocation and whether a joint-controller arrangement (UK GDPR Art. 26) is needed between group companies for cross-market gifting and shared customer accounts.
2. What we collect
- Account and contact details: name, email address, phone number (including WhatsApp), and your home market and language.
- Orders: what you bought, prices, delivery addresses, delivery preferences and messages you include with gifts.
- Gift recipients: the name, address and phone number you give us for someone else, and your message to them. Please only give us a recipient’s details if you reasonably believe they would expect to receive your gift.
- Payments: handled by Stripe (US, Canada, UK, EU) and Paystack (Nigeria). We receive confirmation and the last four digits of your card; we never store full card numbers.
- Shade and skin profile: your tone family, undertone, skin and hair concerns, hair type and porosity from the quiz or a consult, and which shades you kept or exchanged. See “Shade and skin information” below.
- The ritual and the house: your subscription items and schedule, membership tier and number, savings record, and ritual wallet balance (Nigeria).
- Conversations: messages with our advisors by WhatsApp, email or chat.
- Device and usage data: pages viewed, approximate location from your IP address (to suggest a market), and cookie identifiers. See “Cookies” below.
- Business contacts: if you apply as a brand, creator, investor or journalist, the details you submit in the form.
3. Shade and skin information
Your shade, undertone and skin or hair details can reveal your racial or ethnic origin, and some concerns (such as acne or sensitivity) can relate to health. We treat all of it as special-category or sensitive personal data, whatever the law in your market strictly requires.
- We only save a shade and skin profile with your explicit consent, given separately from any marketing consent. You can use the quiz without saving anything.
- We use it only to recommend products, match shades, choose ritual samples and, for brands, produce aggregated reports (for example, how often a shade was kept). Brands never receive information about you as an individual.
- It is encrypted at field level, access is limited to the systems and staff that need it, and every access is logged.
- It is never sent to advertising platforms, never used to build advertising audiences, and never sold.
- You can view, change or delete your profile at any time in your account, or ask us to.
4. How we use your data, and our legal bases
- To take, deliver and support your orders and gifts, and to run your ritual or membership — because we have a contract with you.
- To meet tax, customs, consumer-protection and product-safety obligations, including keeping invoices and batch records — because the law requires it.
- To prevent fraud, secure our services and improve the store — in our legitimate interests, balanced against your rights.
- To send marketing by email or WhatsApp — only with your consent, which you can withdraw in one click or by replying STOP.
- To save and use your shade and skin profile — only with your explicit consent.
Shade recommendations are made automatically from your profile. They are suggestions only and never decide whether you can buy something or what you pay.
6. International transfers
Because we operate in several countries, your data may be processed outside your own, including in Canada, the UK, the US and Nigeria. Where we transfer personal data out of the UK or EU, we use the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, or rely on an adequacy decision. For Nigeria, we transfer data only on a basis permitted by the Nigeria Data Protection Act 2023. For residents of Quebec, we assess the protection the data will receive before it is communicated outside Quebec, as Law 25 requires.
[COUNSEL REVIEW] Confirm hosting region ([HOSTING REGION]), complete transfer impact assessments, and the Quebec privacy impact assessment for transfers outside Quebec.
7. How long we keep it
- Order, invoice and batch records: [RETENTION — ORDERS] years, as tax and product-safety law requires.
- Account data: while your account is open, then [RETENTION — ACCOUNT] months.
- Shade and skin profile: until you delete it or withdraw consent, or after [RETENTION — SHADE] months of inactivity.
- Marketing consent records: for as long as we market to you, plus [RETENTION — CONSENT] years as proof.
- WhatsApp and support conversations: [RETENTION — SUPPORT] months.
8. Your rights
Wherever you live, you can ask to see the personal data we hold about you, correct it, delete it, or take a copy with you, and you can withdraw any consent at any time. Write to [PRIVACY EMAIL] or use the privacy page in your account. We reply within one month (or the shorter period your law requires).
- United Kingdom and EU: you also have the right to restrict or object to processing, and to complain to the Information Commissioner’s Office (UK) or your local data protection authority (EU).
- Canada: under PIPEDA you can complain to the Office of the Privacy Commissioner of Canada. In Quebec, under Law 25, you can also ask to be told about automated decisions, request de-indexation of information, and complain to the Commission d’accès à l’information.
- Nigeria: under the Nigeria Data Protection Act 2023 you can complain to the Nigeria Data Protection Commission.
- United States: residents of California and other states with privacy laws can request to know, delete and correct their personal information, limit the use of sensitive personal information, and will not be discriminated against for using these rights. You may use an authorised agent.
9. Our privacy officer
Our person in charge of the protection of personal information (Quebec Law 25), and data protection contact for every market, is [PRIVACY OFFICER NAME], [PRIVACY OFFICER TITLE], reachable at [PRIVACY EMAIL] or [POSTAL ADDRESS].
[COUNSEL REVIEW] Confirm whether a Data Protection Officer must be appointed under the NDPA (data controller of major importance) and UK GDPR given the scale of special-category processing; appoint an EU Art. 27 representative before the EU launch in February 2027; file NDPC registration and annual audit returns as applicable.
11. Children
homeward is not intended for children under 16, and we do not knowingly collect their data. Gift recipients may be any age; we collect only the delivery details the sender gives us.
12. Security
We encrypt data in transit and at rest, encrypt shade and skin data at field level, limit staff access by role, and test our systems regularly. If a breach puts your rights at risk, we will tell you and the relevant regulator as the law requires.
13. Changes to this notice
We will post any changes here with a new date, and tell you directly about significant changes.
Draft 0.1 · 11 October 2026 · [COUNSEL REVIEW]