privacy policy.

who we share your information with

We don’t share your information randomly. We mainly use it to:

• verify the validity of a credit card - via Stripe, our payment processor.
  
• send you products - we use Despatch Cloud, Royal Mail and Whistl.
  
• recommend other products you may like - we use our own algorithms, we don’t involve third parties.
  
• communicate with you on smol related matters - we use Klaviyo to send our emails.
  
• provide you with order and billing history information - Recharge is our e-commerce platform.
  
• offer a referral feature if you want to refer your friends - this is Referral Candy.
  
• the authorities, when required by law - for instance, the ICO.
  

We never sell your information.

sending information abroad

If we send your data outside the UK or EU when strictly necessary to US-based partners such as Recharge, we use GDPR-approved safeguards to ensure adequate data protection in accordance with Article 45 GDPR. We always require a DPA when working with a new partner outside the UK and ensure they are GDPR compliant. Also, we check whether they are listed on the official Data Privacy Framework list website to make sure they are certified and, if not, we make sure their DPA includes the UK Addendum to the EU Standard Contractual Clauses. If neither of these are available, we require an International Data Transfer Agreement (IDTA).

Do you need more info? Email privacy@smolproducts.com.

keeping your information safe

We have implemented technology and security features such as data encryption and two-factor authentication where possible, as well as strict internal access control and guidelines, to safeguard to an appropriate extent the privacy of your personal data from loss, alteration, unauthorised access or improper use. Our security and privacy policies are periodically reviewed, and we will continue to enhance our security procedures as new technology becomes available. Whilst we cannot ensure or guarantee that loss, alteration, unauthorised access or improper use of information will never occur, we use all reasonable efforts to prevent it.

While we make every effort to ensure that your information is secure on our system, you should bear in mind that submission of information over the internet is never entirely secure. As a result, we cannot guarantee the security, integrity, availability or retention of any information you transmit to us and you do so at your own risk.

Your account information is password-protected for your privacy and security. You can play an important role in keeping your personal data secure by maintaining the confidentiality of your password used on our Site. We recommend that you change your password from time to time for additional security. Please advise us immediately if there is any unauthorised use of your account by any other internet user or any other breach of security.

Only key members of our personnel have access to personal data. Backups are run to prevent loss of information and our internet servers are housed in secure facilities in the UK.

It is advisable to log out and close your browser when you have finished your user session to help ensure that others do not access your personal data if you use a shared computer or a computer in a public place.

Information may be retained in countries outside of the European Economic Area, including the USA. We will ensure that any information transferred outside of the European Economic Area will be adequately protected. For more information, see the section “sending information abroad” above. You agree to the transfer of your information.

As required by GDPR, we will notify the Information Commissioner’s Office (ICO) and will contact you in case of a breach (e.g. a data breach) within 72 hours if it is likely to result in a high risk to your rights and freedoms, such as identity theft or financial loss.

how long we keep your information

We keep it only for as long as needed:

• Account information: until your account closes, then up to 6 years for payment details to comply with tax laws.
  
• Marketing information: until you opt out via the unsubscribe link or by emailing us at help@smolproducts.com.
  
• Website data: IP addresses and analytics for up to 12 months, unless needed longer for security investigations.
  

When the period is over, we securely delete or anonymise your information.

your rights

You have control over your data. GDPR gives you these rights:

the right to be informed: You have the right to be provided with clear, transparent and easily understandable information about how we use your information and your rights. This is why we are providing you with the information in this policy.

the right of access:  You have the right to obtain access to your information (if we are processing it), and certain other information (similar to that provided in this privacy policy). This is so you are aware and can check that we are using your information in accordance with data protection law. You can do this by writing to us on help@smolproducts.com.

the right to rectification: You are entitled to have your information corrected if it is inaccurate or incomplete. You can do this through your account page or by writing to us on help@smolproducts.com

the right to erasure:  This is also known as ‘the right to be forgotten’ and in simple terms, enables you to request the deletion or removal of your information where there is no compelling reason for us to keep using it. This is not a general right to erasure; there are exceptions.

the right to restriction of processing:  You have rights to ‘block’ or suppress further use of your information. When processing is restricted, we can still store your information, but may not use it further. We keep lists of people who have asked for further use of their information to be ‘blocked’ to make sure the restriction is respected in future.

the right to data portability:  You have rights to obtain and reuse your personal data for your own purposes across different services. For example, if you decide to switch to a new provider, this enables you to move, copy or transfer your information easily between our IT systems and theirs, safely and securely without affecting its usability. Your data will be provided electronically, via email, in the JSON format structured for interoperability and reuse across systems.

the right to object to processing:  You have the right to object to certain types of processing, including processing for direct marketing (i.e., if you no longer want to be contacted with potential opportunities). You can do this by emailing us at help@smolproducts.com.

the right to lodge a complaint: You have the right to lodge a complaint about the way we handle or process your personal data with your national data protection regulator. In the United Kingdom, this is the Information Commissioner’s Office. Further information can be found at: 

www.ico.org.uk

the right to withdraw approval: You have the right to withdraw your consent to processing at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful). This includes your right to withdraw consent to us using your personal data for marketing purposes. You can do this by any of the following means:

• send us an e-mail at help@smolproducts.com

• contact us by mail at smol, The Portland Building, 27-28 Church Street, Brighton, East Sussex, BN1 1RB.

Usually we act on requests and provide information free of charge after going through a process of identity verification, but we are permitted to charge a reasonable fee to cover our administrative costs of providing the information in certain circumstances, including in the case of any baseless or excessive/repeated requests, or where further copies of the same information are requested.

Alternatively, we may be entitled to refuse to act on the request.

Please consider your request responsibly before submitting it. We will respond as soon as we can. Generally, this will be within one (1) month from when we receive your request but, if the request is going to take longer to deal with, we will come back to you and let you know.

cookies

what are cookies?

Cookies are small pieces of information which are issued to your computer when you visit a website and which store and sometimes track information about your use of the website.

what types of cookies do you use?

We identified 4 types of cookies:

1. essential cookies

These cookies are critical for the website to operate correctly, supporting key functions like security, order processing, and user login.

2. analytics cookies

These cookies gather data on how users engage with our website, tracking metrics like page views, traffic sources, and click behaviour. This information remains anonymous until consent is given.

3. functionality cookies

These cookies help us track users coming from affiliates and store your preferences to enhance your experience with personalised features. These cookies are disabled until consent is given.

4. advertising cookies

These cookies monitor your browsing activity to provide tailored advertisements and promotions, and may be placed by us or third-party ad networks. These cookies are disabled until consent is given.

what about my rights?

When you visit our website (smol.com) for the first time, we always display a banner for you to decide what type of cookies you consent to. These cookies will be transferred to your computer only after you have given us  your consent. You can adjust your cookie settings or withdraw your consent at any time via our Cookie Preference modal (link available in the footer on all pages except some such as the checkout or the help centre).

how long do they last for?

A number of cookies we use last only for the duration of your web session and expire when you close your browser. Other cookies are used to remember you when you return to the site and will last for longer.

If you withdraw your consent, non-essential cookies part of the category you chose not to consent to will become inactive.

what else?

Although they do identify a user's computer, cookies cannot be used by a third party to personally identify users. Some of the cookies used by our site are set by us and some by or with the help of third parties who are delivering services on our behalf. In particular, we use third parties to help us collect performance and measurement statistics about our site.

When you use the services, we use persistent and session cookies and other tracking technologies to: (a) analyse the usage of our sites and services; (b) customise the services to your preferences; and (c) control the advertising displayed by the services. We may also use other internet technologies, such as web beacons or pixel tags and other similar technologies, to deliver or communicate with cookies and track your use of the services (including to serve you ads when you are on other websites or the internet when we can access those cookies). We may also include web beacons in email messages or newsletters to determine whether the message has been opened. As we adopt additional technology, we may also gather additional information through other methods.

Most web browsers automatically accept cookies, but if you prefer, you can set your browser to disable cookies or to notify you when you receive a cookie, giving you the chance to decide whether or not to accept it. Please note however, that by blocking or deleting cookies used on the site you may not be able to take full advantage of the site as it may impair your use of or prevent access to some areas, including taking advantage of special offers and vouchers. If you do leave cookies turned on, please take care to sign off when you are finished using a shared computer.

You can also learn more about cookies by visiting www.allaboutcookies.org which includes additional useful information on cookies and how to block them using different types of browser.

communication with you

emails

If you opt to accept our terms of service and privacy policy within the account sign up process you agree to our use of your email address. We will be able to associate this email address with your previous browsing and purchase experiences, whether you are logged on or not. We will know whether you receive email alerts and will be able to associate this with any other contact information you may have given us.

marketing

If you opt to accept our terms of service and privacy policy within the account sign up process but subsequently change your mind and no longer wish to receive such communications, you can opt out of receiving future communications at any time by emailing us at 

help@smolproducts.com. Please note; when opting out you may continue to receive some information from us where this is already in the communication pipeline, but this will typically be the case for up to 1 day after the date on which you update your account.

In addition, an unsubscribe link is given at the end of every marketing email should you no longer wish to receive marketing communications from smol.com.

Please note that we use the same sender for marketing communications and transactional emails so marking us as spam means transactional communications such as upcoming order emails and order confirmation emails will land in your spam folder.

post

If you opt to accept our terms of service and privacy policy within the account sign up process, then you are agreeing that from time to time we may also contact you by post with information on special offers or events regarding our products or services.

third-party links

Our site might link to other websites. Clicking third-party links may allow those sites to collect data like your IP address. We are not responsible for their privacy practices and we recommend you to take time to check their policies before sharing information.

children’s data

Our products and site aren’t for children under 16, and we will not knowingly collect their information. If we did by mistake, email us at help@smolproducts.com and we will delete it in a timely manner.

updates to this policy

We might update this policy if our practices or the law change. We’ll post updates here and let you know about significant changes via email or a site notice.

Data Protection Officer

We have appointed a Data Protection Officer on 10 March 2025, Adrien Sala, to oversee GDPR compliance, reachable at privacy@smolproducts.com

get in touch

Questions? Want to use your rights? Reach out:

• DPO: privacy@smolproducts.com
  
• post: smol Limited, The Portland Building, 27-28 Church Street, Brighton, East Sussex, BN1 1RB, UK
  

You can also contact the ICO in case of a complaint (www.ico.org.uk).

Thanks for trusting smol with your information. Let’s keep it clean and green!