Privacy policy
Last updated: 11 August 2026
This Privacy Policy explains how JMF ECOMMERCE LTD, trading as Spa Supreme, collects, uses, shares and protects personal information when you visit spasupreme.co.uk, place an order, contact us or otherwise use our online store.
Who We Are
JMF ECOMMERCE LTD is the controller responsible for the personal information described in this policy.
Legal company name: JMF ECOMMERCE LTD
Trading as: Spa Supreme
Company number: 16939103
Registered in: England and Wales
Address: 128 City Road, London EC1V 2NX, United Kingdom
Email: contact@spasupreme.co.uk
Phone: +44 7456456605
Personal Information We Collect
Depending on how you interact with us, we may collect:
- Identity and contact information: name, billing and delivery address, email address and telephone number.
- Order and transaction information: products ordered, order value, payment status, delivery, tracking, cancellations, returns and refunds.
- Payment information: payment method, payment confirmation and limited transaction details. Complete payment-card details are generally processed by Shopify or the selected payment provider and are not stored by Spa Supreme.
- Account information: login details, account preferences and order history if you create or use a customer account.
- Communications: messages, support requests, complaints, reviews and information you provide when contacting us.
- Technical and usage information: IP address, device and browser information, cookie identifiers, pages viewed, interactions with the website and security logs.
- Marketing preferences: choices about promotional communications and non-essential cookies.
How We Collect Information
We collect information directly from you when you browse, place an order, create an account, submit a form or contact us. We may also receive information automatically through cookies and similar technologies, and from service providers involved in website hosting, payment processing, fraud prevention, order fulfilment, delivery, tracking, analytics or advertising.
Purposes and Lawful Bases
| Purpose | Lawful basis |
|---|---|
| Process payment, confirm and fulfil orders, arrange delivery, provide tracking, manage returns and refunds, and provide order support | Performance of our contract with you and steps taken at your request before entering a contract |
| Maintain business, tax, accounting, consumer-rights and transaction records | Compliance with legal obligations |
| Prevent fraud, secure the website, protect customers, investigate misuse and defend legal claims | Our legitimate interests in operating a secure and lawful retail business, and legal obligations where applicable |
| Respond to enquiries, complaints and service requests and improve our support | Performance of our contract, legal obligations and our legitimate interests in customer service |
| Understand website performance and improve our store, products and services | Our legitimate interests where permitted; consent where non-essential cookies or similar technologies require it |
| Send electronic marketing or use information for personalised advertising | Consent where required, or another lawful basis permitted by applicable direct-marketing law |
Where we rely on legitimate interests, we consider the necessity of the processing and balance our interests against your rights and reasonable expectations.
Cookies and Similar Technologies
We use strictly necessary technologies to operate functions such as the shopping cart, checkout, security and order processing. Where required, we ask for consent before using non-essential analytics, functional, advertising or marketing technologies. You can review further information and manage available choices through our Cookies Policy and website cookie controls.
Marketing
You can unsubscribe from promotional emails by using the unsubscribe link in the message or by contacting us. Withdrawing from marketing does not stop service messages about an order, return, account or security issue.
Who We Share Information With
We share personal information only where reasonably necessary for the purposes described above, including with:
- Shopify, which hosts and supports our online store;
- payment processors, banks and fraud-prevention providers;
- order-fulfilment, postal, courier, delivery and tracking providers;
- website, cloud, IT, customer-support and security providers;
- analytics, advertising and marketing providers where permitted and subject to applicable consent choices;
- professional advisers, insurers, auditors and accountants;
- regulators, courts, law-enforcement bodies or other authorities where disclosure is legally required; and
- a buyer, seller or adviser involved in a genuine business sale, restructuring or transfer, subject to appropriate safeguards.
Service providers may process information only for the services they provide to us or as otherwise permitted by law. Shopify also processes information under its own privacy terms. Information about Shopify's processing is available in the Shopify Consumer Privacy Policy.
International Transfers
Some service providers may process personal information outside the United Kingdom. Where a restricted transfer is made, we use a lawful transfer mechanism where required, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another safeguard permitted by UK data-protection law. You may contact us for further information about the safeguards relevant to your information.
How Long We Keep Information
We keep personal information only for as long as necessary for the purpose for which it was collected, including to fulfil orders, provide support, meet legal and accounting duties, resolve disputes and establish or defend legal claims.
- Order, payment, refund and accounting records are generally retained for the period required by UK tax and company law, which is commonly six years for relevant business records.
- Account information is retained while the account remains active and for a reasonable period afterwards where necessary for security, records or legal claims.
- Support messages and complaints are retained for as long as reasonably needed to address the matter and meet legal or record-keeping requirements.
- Marketing information is retained until you opt out or it is no longer needed. We may retain a minimal suppression record to respect an opt-out.
- Cookie and analytics information is retained according to the relevant technology, consent setting and provider retention period.
We may retain information for longer when required by law, a court order, a regulatory request, fraud prevention or an active dispute.
Your UK Data-Protection Rights
Subject to applicable conditions and exemptions, you may have the right to:
- request access to your personal information;
- request correction of inaccurate or incomplete information;
- request erasure of your information;
- request restriction of processing;
- receive certain information in a portable format or ask us to transfer it;
- object to processing based on legitimate interests;
- withdraw consent at any time where processing is based on consent; and
- raise a complaint about how your information is handled.
Your right to object to direct marketing: You may object at any time to the use of your personal information for direct marketing. We will stop that marketing processing when you object.
To exercise a right, email contact@spasupreme.co.uk. We may ask for information reasonably necessary to verify your identity. We normally respond within the period required by UK data-protection law.
Automated Processing
Automated tools may help payment and security providers identify fraud or secure transactions. We do not intend to make solely automated decisions that produce legal or similarly significant effects about you unless the processing is permitted by law and appropriate safeguards apply.
Security
We use reasonable administrative, technical and organisational measures designed to protect personal information. No transmission or storage method is completely secure, so please do not send complete card details or other unnecessary sensitive information by email or through a contact form.
Children's Information
Our store is not directed to children, and we do not knowingly collect children's personal information except where it is lawfully provided and necessary for an order or communication. A parent or guardian who believes a child has provided personal information may contact us.
Data-Protection Complaints
You may submit a data-protection complaint by emailing contact@spasupreme.co.uk with the subject line Data Protection Complaint, or by writing to our address above. Please explain what happened and the outcome you are seeking.
We will acknowledge a data-protection complaint within 30 days, investigate it appropriately and communicate the outcome without undue delay, as required by applicable UK law.
You also have the right to complain to the Information Commissioner's Office. Information is available at ico.org.uk/make-a-complaint. We would appreciate the opportunity to address your concern first, but you are not required to contact us before contacting the ICO.
Changes to This Policy
We may update this policy when our practices, service providers or legal obligations change. The latest version will be posted on this page with the revised date.
Contact Us
Email: contact@spasupreme.co.uk
Phone: +44 7456456605
Address: 128 City Road, London EC1V 2NX, United Kingdom
Support hours: Monday-Friday, 9:00 AM-6:00 PM
Saturday and Sunday: Closed
Time zone: Europe/London (GMT in winter and BST in summer)
Response time: We respond within one business day.