Privacy Policy

Last updated: 24 August 2026

1. Who we are

This website, blacktulipstudio.com (the “Site”), is operated by Black Tulip Retail Ltd (“Black Tulip”, “we”, “us”, “our”), a company registered in England and Wales.

• Company number: 14569140
• VAT number: 443557876
• Registered address: 1st Floor Kirkland House, 11–15 Peterborough Road, Harrow, Middlesex, HA1 2AX, United Kingdom
• Email: customercare@blacktulipstudio.com
• Phone: +44 7443 462204
• ICO registration number: 00014052074

For the purposes of UK GDPR and EU GDPR, Black Tulip Retail Ltd is the data controller of the personal information described in this policy.

2. The short version

• We collect what we need to sell you shoes, deliver them, and support you afterwards.
• We use cookies and similar technologies for analytics and advertising. These only run if you consent, and you can change your mind at any time.
• We record how visitors move around the Site to improve it. This only happens with your consent.
• We share data with delivery, payment, analytics and advertising providers — all named below.
• You have rights over your data, including access, deletion and objection. Contact us and we will act on them.

This summary is for orientation only; the full policy below governs.

3. Personal information we collect

You give us

• Contact details — name, billing address, shipping address, email, phone number.
• Order information — items purchased, returned or exchanged; order history; sizes and preferences.
• Account information — username, password, saved preferences, wishlist.
• Payment information — card and payment details. These are collected and processed by our payment providers; we do not store full card numbers.
• Communications — anything you send us by email, contact form, live chat, SMS or social media, including customer service correspondence and reviews.

We collect automatically

• Device and connection information — IP address, browser type and version, operating system, device type, screen size, language, referring URL.
• Usage information — pages viewed, products viewed, items added to cart, searches, time on page, scroll depth, clicks, and navigation paths.
• Interaction recordings — recordings of mouse movement, clicks, scrolling and page interaction, used to diagnose usability problems. See Session recording below.
• Cookie and identifier data — cookie IDs, advertising identifiers, and consent state.

We receive from others

• Advertising and analytics partners — aggregated campaign performance, and limited attribution information about how you reached the Site.
• Payment and fraud providers — payment confirmation and fraud risk signals.
• Delivery partners — delivery status and address validation.

We do not knowingly collect special category data (such as health, religion or biometric data). Please do not send it to us.

4. Why we use your information, and our lawful basis

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and concluded it is not. You may object at any time (see Your rights).

Where we rely on consent, you may withdraw it at any time, with no effect on processing carried out before withdrawal.

5. Cookies, tracking and consent

We use cookies and similar technologies (pixels, tags, local storage, and server-side identifiers).

Your control. When you first visit from the UK or EU/EEA, a consent banner asks what you allow. Nothing in the Analytics, Preferences or Marketing categories runs until you accept it. You can change or withdraw your choices at any time via the Cookie preferences link in the Site footer.

A complete, itemised list of every cookie and tracker we use — including its provider, purpose and duration — is published in our Cookie Policy.

Server-side tracking

Some measurement and advertising tags run on a server we control, reached through our own subdomain, rather than directly in your browser. We do this to improve accuracy and page performance.

Two consequences you should know about:

• Some cookies set this way are first-party and can have a longer lifetime than browser-set equivalents.
• Data still reaches the advertising and analytics providers named below — routing it through our server does not keep it with us.

Server-side tags are subject to the same consent choices. If you decline Analytics or Marketing, these tags do not fire.

Session recording

We use Microsoft Clarity to record how visitors interact with pages — mouse movement, clicks, scrolling, and navigation — and to build aggregated heatmaps. This helps us find broken or confusing parts of the Site.

• Recordings capture interaction with the page, not your screen or any other application.
• Keystrokes in form fields, payment details and passwords are masked and not recorded.
• We do not use recordings to identify individuals, and we do not attempt to link them to your name or email.
• This runs only if you accept Analytics cookies, and you can withdraw consent at any time.

Advertising and measurement

Where you consent to Marketing, we share limited event information (such as page views, add-to-cart and purchase events) with advertising platforms so we can show you relevant advertising and measure results.

For some of these, we send a hashed (irreversibly scrambled) version of your email address or phone number so the platform can match the event to an account without us disclosing the address itself. This happens only where you have consented to Marketing.

We also use Google Consent Mode, which signals your choices to Google’s tags so they adjust their behaviour accordingly.

6. Who we share your information with

We may also disclose personal information to professional advisers under duties of confidentiality; to a buyer or successor in a merger, acquisition or sale of assets; where required by law, court order, or a valid request from a regulator or law enforcement; and to establish, exercise or defend legal claims.

We do not sell your personal information for money.

7. International transfers

We are based in the UK. Some of our providers are outside the UK and EEA, including in the United States and India.

Where we transfer personal information out of the UK or EEA, we rely on one of:

• an adequacy decision by the UK government or European Commission; or
• the UK International Data Transfer Agreement / Addendum, or the European Commission’s Standard Contractual Clauses, with additional safeguards where needed.

You may request details of the safeguards applying to a particular transfer using the contact details below.

8. How long we keep it

Where we no longer need information, we delete it or irreversibly anonymise it.

9. Your rights

If you are in the UK or EEA, you have the right to:

• Be informed — about how we use your data, which is the purpose of this policy.
• Access — get a copy of the personal information we hold about you.
• Rectification — have inaccurate or incomplete information corrected.
• Erasure — ask us to delete your information, where no overriding reason to keep it applies.
• Restrict processing — ask us to pause processing while a concern is resolved.
• Data portability — receive information you gave us in a portable format, or have it sent to another provider.
• Object — object to processing based on legitimate interests, and object to direct marketing at any time, absolutely.
• Withdraw consent — at any time, where we rely on consent.
• Not be subject to solely automated decisions producing legal or similarly significant effects. We do not make such decisions.

To exercise any of these, email customercare@blacktulipstudio.com. We will respond within one month, extendable by two further months for complex requests, and we will tell you if we need longer. We may need to verify your identity first. Exercising your rights costs nothing, and we will not treat you differently for doing so.

Complaints

If you are unhappy with how we have handled your personal information, please contact us first so we can put it right.

You also have the right to complain to the UK supervisory authority:

If you are in the EEA, you may complain to your local data protection authority instead.

10. If you are in the United States

Depending on your state, you may have the right to know what personal information we collect, to delete it, to correct it, to opt out of “sale” or “sharing” for targeted advertising, and not to be discriminated against for exercising those rights.

We do not sell personal information for money. We do disclose limited information to advertising partners for targeted advertising, which some state laws define as “sharing”. To opt out, set the Marketing category to off via the Cookie preferences link in our footer, or email us. We honour Global Privacy Control (GPC) signals where required.

11. Children

The Site is not intended for children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us their information, contact us and we will delete it.

12. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS), access controls, and processing payments through PCI-DSS compliant providers so that we never hold your full card details.

No system is completely secure. Please do not send sensitive information to us by unsecured means.

13. Changes to this policy

We may update this policy to reflect changes in our practices or the law. We will update the “Last updated” date, and where changes are significant we will tell you more prominently — for example by notice on the Site or by email.

14. Contact us

Black Tulip Retail Ltd
1st Floor Kirkland House, 11–15 Peterborough Road, Harrow, Middlesex, HA1 2AX, United Kingdom
Email: customercare@blacktulipstudio.com
Phone: +44 7443 462204
ICO registration: 00014052074