Skip to main content

Privacy policy

Last updated: 18 August 2026

Session Kit Ltd ("Session Kit", "we", "us" or "our") respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store and protect your personal data when you visit our website, create an account, place an order, contact us, subscribe to our marketing communications, or otherwise interact with Session Kit.

1. Who we are

Session Kit Ltd is the data controller responsible for your personal data.

Session Kit Ltd
104 High Street
West Wickham
United Kingdom
BR4 0NF

Email: info@sessionkit.com

If you have any questions about this Privacy Policy or how we use your personal data, please contact us using the details above.

2. Personal data we collect

Depending on how you interact with us, we may collect:

  • Your name.

  • Email address.

  • Telephone number.

  • Billing and delivery address.

  • Information required to create and manage your Session Kit customer account.

  • Order and purchase information, including products purchased and order history.

  • Information you provide when contacting us or submitting an enquiry.

  • Information you provide when subscribing to our marketing communications.

  • Information submitted through forms on our website.

  • Payment and transaction information required to process your purchase. Payment card details are processed by the relevant payment provider.

  • Technical information about your device and use of our website, such as IP address, browser type, device type and operating system.

  • Information collected through cookies and similar technologies, subject to your cookie choices and applicable law.

We only collect personal data that is reasonably necessary for the purposes described in this Privacy Policy.

Some personal data is necessary for us to provide products and services to you. For example, we need certain information to process and deliver an order or to create and maintain a customer account. If you do not provide information that is necessary for these purposes, we may be unable to provide the relevant product, service or functionality.

3. How we collect your personal data

We collect personal data:

  • Directly from you when you create an account.

  • When you place an order.

  • When you contact us or submit an enquiry.

  • When you subscribe to our marketing communications.

  • When you complete forms on our website.

  • Automatically when you use our website, including through cookies and similar technologies where permitted by law.

  • From service providers where necessary to provide our services, process transactions, prevent fraud or otherwise operate our business.

4. How we use your personal data

We use your personal data for the following purposes.

Providing and managing your account

We use your personal data to create, maintain and administer your customer account, provide account functionality and allow you to view relevant information such as your orders.

Processing and fulfilling orders

We use your personal data to process payments, fulfil and deliver orders, provide order confirmations and updates, and deal with customer service issues relating to your purchases.

Processing payments

Payments may be made by credit or debit card through Shopify Payments, PayPal or other payment options made available at checkout, including Shop Pay.

Payment information is processed by the relevant payment provider. We do not ordinarily receive or store your full payment card number or security code.

Responding to enquiries

We use information you provide to respond to questions, requests and other correspondence.

Operating and securing our website

We use technical information to operate, maintain, protect and improve our website and services, including detecting and preventing fraud, abuse and security incidents.

Analytics

We use Shopify's analytics and reporting features to understand how customers use our website and how our store performs.

We may also use Google Ads and associated measurement technologies to measure and improve our advertising campaigns.

Where cookies or similar technologies require consent, we will obtain consent before using them.

Marketing

We may use your email address to send newsletters, product information, offers and other marketing communications where we have a lawful basis to do so.

Our email marketing is currently managed using Mailchimp and Klaviyo.

Where the requirements for the products-and-services soft opt-in under the Privacy and Electronic Communications Regulations 2003 ("PECR") are satisfied, we may send you marketing about our own similar products and services without obtaining separate consent. We will give you a clear opportunity to opt out when we collect your contact details and in every subsequent marketing communication.

Legal and regulatory obligations

We may process personal data where necessary to comply with legal, accounting, tax, regulatory or other legal obligations.

5. Our lawful bases for processing

Under UK data protection law, we must have a lawful basis for processing your personal data. Depending on the circumstances, we rely on the following lawful bases:

Contract
 We process personal data where it is necessary to enter into or perform a contract with you. This includes creating and managing your customer account, processing and fulfilling orders, processing payments, delivering products and providing services you have requested.

Legal obligation
 We process personal data where necessary to comply with legal obligations, including accounting, tax, financial, regulatory and other legal requirements.

Legitimate interests
 We may process personal data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights, interests or freedoms.

Our legitimate interests include operating and administering our business, responding to enquiries, maintaining and improving our website and services, maintaining website and information security, preventing fraud and misuse, keeping appropriate business records, and understanding and improving the performance of our website and services.

Consent
 We rely on your consent where required by law, including for certain marketing communications and for non-essential cookies and similar technologies. Where we rely on consent, you may withdraw it at any time.

For direct marketing by electronic mail, we may in certain circumstances rely on the products-and-services soft opt-in under the Privacy and Electronic Communications Regulations 2003 (PECR), where all applicable requirements are met.

6. Marketing and your choices

You can unsubscribe from marketing emails at any time by:

  • clicking the unsubscribe link in the relevant email; or

  • contacting us at info@sessionkit.com. 

You have an absolute right to object to the processing of your personal data for direct marketing.

We will maintain appropriate suppression records where necessary to ensure that people who have opted out of marketing are not inadvertently contacted again.

7. Cookies and similar technologies

Our website uses cookies and other storage and access technologies. These technologies may be provided by Session Kit, Shopify, Google and other third-party service providers whose services are integrated with our website.

We use these technologies for different purposes.

Strictly necessary technologies

Some cookies and similar technologies are necessary to provide services or functionality you have requested and to operate our website. These may include technologies required for:

  • Shopping basket functionality.

  • Customer account functionality.

  • Checkout and payment functionality.

  • Website security.

  • Maintaining your session.

  • Remembering your privacy and cookie choices.

  • Other essential website functionality.

Where a technology is strictly necessary for a service or functionality you have requested, we may use it without consent where an applicable exemption under the Privacy and Electronic Communications Regulations 2003 ("PECR") applies.

Analytics

We use Shopify's analytics and reporting functionality to understand how customers use our website and how our online store performs.

Analytics technologies may collect information about your device, browser, pages visited, interactions with our website and other information about how you use our website.

Where consent is required under PECR, we will obtain your consent before using analytics technologies.

Advertising and marketing

We use Google Ads and associated technologies to advertise Session Kit, measure advertising performance and understand how advertising campaigns perform.

These technologies may involve the collection or access of information about your device, browsing activity, interactions with our website and interactions with our advertising.

Where consent is required under PECR, we will obtain your consent before using these technologies.

Third-party technologies

Some of the services integrated with our website may use their own cookies or other storage and access technologies.

These may include technologies associated with Shopify, Google, our email marketing providers, and applications or services that we use to provide website functionality.

Where a third-party technology requires consent under PECR, we will identify the relevant third party in our consent mechanism and obtain your consent before that technology is used.

Your choices

When you visit our website, our cookie consent mechanism allows you to accept or reject non-essential cookies and similar technologies.

You can also manage your preferences by selecting the available cookie preference options.

We do not rely on simply continuing to browse our website as consent to non-essential cookies or similar technologies.

Where you reject non-essential cookies, we will not use non-essential storage and access technologies for purposes requiring your consent.

You can change or withdraw your consent at any time through our cookie preference mechanism. We will make it no more difficult to withdraw consent than it was to give it.

8. Who we share your personal data with

We share personal data with service providers and other organisations where necessary to provide our services, fulfil orders, process payments, communicate with you, operate our website, measure advertising, comply with legal obligations or protect our business.

Shopify

Our website and online shop are operated using Shopify.

Shopify provides our ecommerce platform and related services, including website functionality, customer accounts, order management, checkout, analytics and payment-related services.

Shopify may process personal data on our behalf and may also process certain information as an independent controller for its own services.

Shopify's current privacy information explains that it processes information including customer contact information, payment information, device information, order history and activity with merchants and Shopify services.

Shopify Payments and Shop Pay

Where you use Shopify Payments or Shop Pay, Shopify processes information necessary to provide those payment services.

This may include payment, billing, shipping and order information.

PayPal

If you choose PayPal at checkout, PayPal processes information necessary to process your payment and provide its services.

Mailchimp and Klaviyo

We use Mailchimp and Klaviyo for email marketing. These providers may process information such as your name, email address, marketing preferences and information about your interactions with our marketing communications.

We will only use and share personal data with these providers in accordance with applicable data protection and electronic marketing requirements.

Mailchimp's current Data Processing Addendum provides for UK data protection terms and international transfer mechanisms.

Klaviyo's current documentation states that it processes customer personal data on behalf of its customers and provides a Data Processing Agreement containing UK transfer provisions.

Google

We use Google Ads and associated measurement technologies to advertise Session Kit and measure the effectiveness of our advertising.

Where these technologies use cookies or similar technologies that require consent, we will obtain consent before using them.

Other service providers

We may also share personal data with:

  • Delivery and fulfilment providers.

  • Website and technology service providers.

  • Fraud prevention and security providers.

  • Professional advisers, such as accountants, lawyers and insurers.

  • Government bodies, regulators, law enforcement agencies or other authorities where required or permitted by law.

We require processors that process personal data on our behalf to comply with applicable data protection requirements and to provide appropriate security measures.

We do not sell your personal data.

9. Payment information

Our checkout supports payment by card through Shopify Payments and may also support PayPal and Shop Pay.

When you make a payment, the relevant payment provider processes the payment information required to complete the transaction.

We do not ordinarily receive or store your complete payment card number or security code.

The payment provider may process your personal data under its own privacy policy in addition to the processing carried out by Session Kit.

10. International transfers

Some of our service providers may process personal data outside the United Kingdom, including in countries where data protection laws may differ from those in the UK.

This includes providers such as Shopify, Mailchimp, Klaviyo and Google.

Where a transfer of personal data outside the UK is subject to the UK international transfer rules, we will ensure that an appropriate transfer mechanism or other lawful basis is in place.

Depending on the provider and circumstances, this may include an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.

You may contact us at info@sessionkit.com if you would like further information about the safeguards applicable to a particular international transfer.

11. How long we keep your personal data

We retain personal data only for as long as necessary for the purpose for which it was collected, including where necessary to meet legal, accounting, tax, reporting, security or dispute-resolution requirements.

The retention period depends on the type of information and the reason we hold it.

For example:

  • Customer account information: generally retained while your account remains active and for a reasonable period afterwards where necessary for legal, security or dispute-resolution purposes.

  • Order and transaction information: retained for as long as necessary to administer the transaction and comply with applicable accounting, tax and legal requirements.

  • Customer enquiries: retained for as long as reasonably necessary to respond to and resolve the enquiry and any related matter.

  • Marketing information: retained while you remain subscribed or otherwise eligible to receive marketing, subject to applicable law. Where you unsubscribe, we may retain limited information on a suppression list so that we can respect your request not to receive further marketing.

  • Cookie and analytics information: retained according to the applicable technology or service provider's retention period and your cookie choices.

When personal data is no longer required, we will securely delete it or anonymise it where appropriate.

12. Security

We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

These measures include appropriate access controls, authentication, secure systems and other measures appropriate to the nature and risks of the personal data we process.

No internet transmission or electronic storage system can be guaranteed to be completely secure.

13. Your data protection rights

Depending on the circumstances and the lawful basis on which we process your personal data, you may have rights including:

  • The right to be informed about how we use your personal data.

  • The right of access to the personal data we hold about you.

  • The right to rectification of inaccurate or incomplete personal data.

  • The right to erasure of your personal data in certain circumstances.

  • The right to restrict processing in certain circumstances.

  • The right to data portability in certain circumstances.

  • The right to object to certain processing.

  • The right to object to direct marketing at any time.

  • The right to withdraw consent where we rely on consent as our lawful basis.

Right to object to direct marketing

You have an absolute right to object to the processing of your personal data for direct marketing.

You can exercise this right at any time by contacting: info@sessionkit.com. 

You can also unsubscribe using the link in any marketing email.

To exercise any of your other data protection rights, contact us at the same address.

We will normally respond to a valid request within one month. This period may be extended where permitted by law.

We may need to request information to verify your identity before processing a request.

14. Automated decision-making

We do not currently make decisions about individuals based solely on automated processing, including profiling, that produce legal or similarly significant effects.

15. Complaints

If you have concerns about how we use your personal data, please contact us first: info@sessionkit.com. 

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection.

ICO:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

You can also make a complaint through the ICO's website:

Make a complaint to the ICO

16. Third-party websites

Our website may contain links to third-party websites or services.

Those websites have their own privacy policies and terms. We are not responsible for the privacy practices, content or security of third-party websites.

We recommend reviewing the privacy information provided by any third-party website you visit.

17. Changes to this Privacy Policy

We may update this Privacy Policy when our services, processing activities, technology or legal requirements change.

When we make changes, we will update the "Last updated" date at the top of this Privacy Policy.

Where required by law, we will provide additional information or obtain consent before introducing a new use of personal data.