Cookie Monster Macarons

Our Privacy Notice

LAST UPDATED: 26/02/2024
(AND where you can find information about cookies)

We certainly wouldn’t like our private information or data shared with any old Claire, Jane or Nuala so we are respectful of yours. This Privacy Notice explains more about the information that Holly & Co collects about you, how we use and protect this information, your rights in relation to that data, and the choices you can make about the way we use it (we'll show you how you can correct or update it, too).

After all, respect, inclusion and fairness are cornerstones of the Holly & Co ethos. This is reflected in how we use your personal information by being transparent, and ensuring you always have a choice.

  • The information that Holly & Co collects

    First things first. We may collect information about you from a variety of sources. This includes information we collect directly from you, information we collect when you visit our sites or view our online content, and information we collect about you from other sources.

    Information we collect directly from you

    We collect information directly from you when you choose to participate in our offers and programmes, create an account on our websites, purchase a product/s on our websites, call or email us, or otherwise provide information directly to us for example, when applying for a position of employment. The following are examples of information we may collect directly from you:

    • Name
    • Email address
    • Postal address
    • Username and password
    • Telephone and/or fax number
    • Date of birth
    • Demographic information
    • Payment information (such as a credit card or bank details)
    • Future communication preferences
    • Telephone number and recordings when you call our office
    • Location information
    • Biographic information
    • Educational information
    • Information provided on CVs

    Information we collect when you visit our sites, view our online ads or promotions, or other services

    We use cookies and other technologies to collect information when you visit our sites, view our online advertisements or promotions, or other services. The following are examples of information we may collect with these technologies:

    • Information about your device browser and operating system
    • IP address
    • Web pages you view
    • Links you click
    • The Holly and Co emails you open
    • Purchase history

    All the information we collect about you may be combined to help us improve our communications with you and to develop our services.

    Information Holly & Co collects from other sources

    We may obtain information from other sources, including commercially available sources. Examples of information we may collect from other sources are:

    • Name
    • Postal address
    • Email address
    • Date of birth
    • Income level
    • Household information
    • Position and/or job title
    • Your interests such as hobbies and pets
    • Consumer and market research data
    • Purchase behaviour
    • Publicly observed data or activities, such as blogs, videos, internet postings, user profiles and user generated content.

    Holly & Co is a Data Controller for the majority of its operations and we keep written records of all data processing undertaking as required by UK privacy regulations.

  • Uses and information sharing

    We use the information we collect to provide you with offers and services, to deliver to you advertisements, offers or other content tailored to your interests, and to conduct other Holly & Co business operations. In most cases, our lawful basis for processing your personal data is Legitimate Interest, except for cases where processing your data is necessary as a Contractual Obligation (such as fulfilling orders after you have shopped with Holly & Co).

    The following are examples of how we may use the information we collect:

    • Answer your questions or respond to your requests
    • Send consumer related information you may be interested in buying or using as a service
    • Develop new products and services
    • Create and manage your account
    • Process payment for purchases or other services
    • Protect against or identify possible fraudulent transactions
    • Send you email and/or postal messages with information about Holly & Co brands and other content we think may be of interest to you, including brand and service information from carefully selected third party business partners
    • Develop and provide advertising tailored to your interests, including interest-based advertising
    • Personalise your experience on our websites by presenting services and information tailored to you
    • Analyse the use of our services and advertising
    • Enforce our Terms & Conditions and otherwise manage our business

    The success of our business depends on your trust, and we will only share your personal information within Holly & Co, with other retailers who are members of our third party co-operative partners, Abacus Alliance, and as described in this privacy notice. We do not share personal information with any other marketers outside of Holly & Co unless you consent to such sharing, or as described within this Privacy Notice.

    We work with Epsilon Abacus (registered as Epsilon International UK Ltd), a company that manages the Abacus Alliance on behalf of UK retailers and charities. The participating retailers are active in the clothing, collectables, food & wine, gardening, gadgets & entertainment, health & beauty, household goods, home interiors and travel categories. These retailers and charities share information about their customers and supporters and what they buy or donate. Epsilon Abacus processes this information as a processor on behalf of these companies to help them understand individuals’ behaviour and preferences. Epsilon combines information provided by participating retailers and charities with third party data. From this combined information, these companies can tailor their communications, sending individuals suitable offers and appeals that should be of interest to them. You can learn more about how Epsilon Abacus processes your personal information in their Privacy Policy.

    Promotions with carefully selected business partners

    Holly & Co may collect personal and other information for a co-promotion or joint programme with a business partner and share your information with that business partner. For these programmes, we will make it clear at the point of collection that the information will be shared with Holly & Co and the participating business partner and ask for your consent as required by applicable laws.

    Third-party service providers

    We rely on third-party service providers to perform a variety of business operations on our behalf. In doing so, we may need to share your personal information with them. We provide our service providers with only the personal information they need to perform the services we request, and we require that they protect this information and not use it for any other purpose. For example, we may rely on a service provider to:

    • Fulfil your service requests and answer your questions
    • Host our sites and deliver our email or other communications
    • Manage payments or take other actions on our behalf
    • Analyse our data, sometimes combined with data from other sources, to send you communications or provide professional services
    • Conduct research and analyse data to improve our products, services and sites
    • Perform other services that we request

    Other situations

    We may disclose your personal information:

    • As part of the sale of a Holly & Co brand to another company
    • To protect and defend the rights and property of Holly & Co (including enforcing our Terms & Conditions)
    • When required by law and/or government authorities
    • To fulfil contracted professional services such as data privacy related consultancy
    • To meet the Terms & Conditions of our sponsorship relationships

    Personal information retention period

    We will retain Personal Information for the period necessary to fulfil the purposes outlined in this Privacy Notice, unless a longer retention period is required or permitted by law. For example:

    • When you notify us, you wish to come off our mailing lists, we will erase your data within four weeks
    • We may keep your personal data for periods as stipulated under our data classification policy, for example 10 years if the information relates to health and safety
    • Customer personal information is regularly updated and deleted if no longer necessary as outlined above but a least every 18 months

    Aggregated and non-personal information

    We share aggregated and/or anonymous information that does not identify you for Holly & Co business purposes. For example, we may disclose the number of visitors to Holly & Co sites or services. We may also share aggregated and/or anonymous information with our business partners for their own business purposes.

    Information security

    Holly & Co is committed to keeping personal information secure. We have implemented technical, administrative and physical procedures designed to protect personal information from loss, misuse, alteration and have process in place to make sure the information is available when needed.

    We limit access to personal information to those who have a business need. We keep personal information secure using appropriate technologies such as firewalls and password management.

    Information transfer

    Holly & Co may transfer your personal information within Holly & Co and/or to other third parties, such as our third-party service providers. Your personal information may be transferred to, stored and processed in a country other than the one in which it was collected. This information will remain within the European Union or countries with appropriate adequacy status.

    We have implemented procedures and controls to help ensure that personal information is protected no matter what country it is stored in or transferred to, for example using approved Standard Contractual Clauses (SCCs).

    Children's online privacy

    We do not intend to collect personal information online from children under the age of 13 or as defined by local legal requirements.

    Legal effects and impact to individuals

    In some cases, the personal information you provide our clients (Data Controllers) may form contractual obligation and have a significant impact on the individual or individuals providing the information. If you decide not to provide personal information, Holly & Co may not be able to complete the data processing on behalf of our clients. The provision of personal information direct to Holly & Co would not normally in its self adversely affect an individual.

    Lawful grounds for processing personal data

    Holly & Co processes personal data as permitted under UK data protection laws and regulations. This can depend on how and why the information is being processed, some examples are provided in 'Information Holly & Co collects' above.

  • Use of cookies

    You can read more about how we use cookies by opening our Cookie Notice (by clicking the small golden cog on the bottom right hand corner of our website). Our Cookie Notice is powered by CookieHub.

  • Your choices and access to your information

    We give you choices about how we communicate with you.

    Email communications

    You can stop receiving promotional email messages from Holly & Co by following the opt-out instructions provided in any such message you receive.

    Postal mail

    You can stop receiving promotional postal mail from Holly & Co or other retailers who are part of our third party co-operative partners Abacus Alliance by following the opt-out instructions that may be included within those communications. You can also stop receiving promotional email or postal communication through this Privacy Notice. Please navigate to our contact page, select ‘other’ as a reason for contact and ask to unsubscribe.

    PLEASE NOTE: We will honour your request to stop receiving promotional email and postal messages from Holly & Co. However, we may continue to send you service-related communications such as emails confirming purchases through our websites. And we may keep information for record keeping, such as to ensure we fulfil consumer requests not to send particular types of messages.


    We take steps to keep your personal information accurate. Contact us to learn how to access and/or update the personal information you provide to Holly & Co. Holly & Co does not charge for this service and responds to reasonable requests in an appropriate timeframe.

    Data erasure and processing choices

    You can instruct Holly & Co to cease processing or erase your personal data. Where this request does not impact the freedoms and rights of others, as defined by UK privacy regulations, we will act on your instructions in a reasonable time frame and use appropriate resources to comply with your request. The withdrawal of consent or erasure of data from an individual to cease processing will not invalidate the original legitimate and lawful basis for processing of personal data as outlined in this notice.

    Data portability

    You can instruct Holly & Co to transfer personal data relating to you to another company. Where this request does not impact the freedoms and rights of others as defined by UK privacy regulations, we will act on your instructions in a reasonable time frame and use appropriate resources to comply with your request. The transfer of your personal data will not invalidate the original legitimate and lawful basis for processing of personal data as outlined in this notice.

    Holly & Co are not responsible for another company accepting the data transfer in whole or in part. Holly & Co will not be responsible for the data on completion of the transfer of data in whole or in part to another company regarding their obligations under UK privacy regulations.

    On completion of the data transfer to another company, you can instruct Holly & Co to cease processing and store the transferred data, delete the transferred data or continue processing the transferred data.

    Data portability rights are conditional to criteria as set down under UK data protection laws.

    Right to object

    You have the right to object to the processing of your personal data by Holly & Co. You can click here to contact Holly & Co or you can object to an appropriate data protection authority.

    Details of the UK data protection authority are listed below:

    • Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
    • Telephone: 0303 123 1113
  • Links to third-party sites and social media

    Holly & Co sites may include links to third-party sites. Holly & Co does not control these third-party sites, and we encourage you to read the privacy notice of every site you visit.

    Social networks and third-party plug-ins

    Our websites may include plugins from social networks or other third parties. An example of a plug-in is the Facebook “Like” button. Where legally permitted, these plug-ins may communicate with and send information to the party that provided the plug-in, even if you do not click on the plug-in itself. This information may include your IP address, information about your browser and device or the address of the web page you are visiting on our site. Loading, using or clicking the plug-ins may also place, read and transmit cookies. These cookies may contain a unique identifier the social network or third party assigns to you. The loading, functionality and your use of the plug-ins are governed by the Privacy Notice and terms of the party that provided the plug-in.

    Social network and third-party login

    Our websites may allow you to log in using a social network or other third-party account. An example of a third-party login is “Log in with Facebook.” Logging into one of our sites with your social network or other third-party account may allow us to gather information that you give us permission to access from that social network or third party. The login feature may also transfer information to the social network or third party, such as your username and password, to authenticate you. The social network or third party may also automatically collect information such as your IP address, information about your browser and device, and the address of the web page you are visiting on our site. The login feature may also place and read cookies from that third party that may contain a unique identifier the social network or other third party assigns to you. The functionality of and your use of the login is governed by the privacy notice and terms of the party that provided the login functionality.

    User generated content

    Some Holly & Co and applications enable users to submit their own content for contests, blogs, videos, and other functions. Please remember that any information you submit or post as user-generated content to Holly & Co sites become public information. You should exercise caution when deciding to disclose your personal, financial or other information in such submissions or posts. Holly & Co cannot prevent others from using such information in a manner that may violate this Privacy Notice, the law, or your personal privacy and safety. Holly & Co is not responsible for the results of such postings.

    Special categories of personal information

    Holly and Co will only process special categories of personal information as allowed under the UK data protection regulations and applicable laws.

    Automated decision making and profiling

    Holly & Co does not use automated decision making technologies that produce legal or similar significant effects on individuals.

    Holly & Co do not profile individuals as defined under the UK data protection laws and regulations and should this become the case then Holly & Co will explain the logic and criteria behind any decisions being made.

    Holly & Co does not warrant that this is the case for its third parties or business partners (Co's).

  • Important information

    Holly & Co is committed to working with customers and data protection authorities to resolve any privacy concern. Holly & Co has a program in place to demonstrate compliance with UK data protection laws. You can contact Holly & Co by clicking here.

    This notice is reviewed by Holly & Co on a regular basis and should be checked by individuals for the latest updates.

    This Privacy Notice was last updated:

    • 26th February 2024 - to include information about the grounds for which we process data and how we work with third parties.
    • 9th October 2023 - to update our Privacy Notice inline with the arrival of our new marketplace.
  • Contact information

    To submit a comment, request or complaint, please contact HCO Limited (company registration number: 04868578) via our Customer Contact Form or via email [email protected]. Alternatively, you can write to us at:

    Data Protection Manager, HCO Limited, River Unit, Phoenix Wharf, Twickenham, Middlesex, TW1 3DY.

    Please be sure to provide the following information if making contact by post or email:

    • Your name
    • Your email address
    • Your request or question (and please tell us what you would like us to do)

    This information will only be used to complete your request. Thanks.

    We know that was a lot to read. Maybe reward yourself with a nice cup of tea and a... cookie?