The details

Privacy
policy.

Last updated: 8 November 2026

• We only collect what we need to take, deliver and look after your order.
• Square handles your payment. We never see your full card details.
• We never sell your data, and we don’t send marketing unless you’ve agreed to it.
• No advertising cookies unless you say yes.

1. Who we are

This website is run by Glow Undercover UK (“we” or “us”), which sells Mystique Rosemary Oil. Glow Undercover UK is a trading name of Med Media Collective UK Limited, a company registered in England and Wales with company number 16967603. We’re the controller of the personal information described here, which means we decide how it’s used.

• Registered office: C/O Integral Associates Limited, The Barn, Rear of 3-5 Church Street, Ampthill, Bedfordshire, MK45 2PJ
• Business address: Northgate House, One Business Supplies Ltd, 100/102 Northgate, Huddersfield, HD1 6AR
• Email: help@glowundercover.co.uk

2. What we collect

When you order

Your name, email address, phone number (if you give it), delivery address, billing postcode, what you ordered and how much you paid. You enter these on Square’s checkout page, and Square passes them to us so we can fulfil your order.

Payment details

Your card or digital wallet details are handled by Square. We never receive or store your full card number.

When you contact us

Your name, email address and anything you tell us in your message.

When you visit our website

Our hosting provider may record technical information, such as your IP address, browser type and the pages you request, to keep the site secure and running. Our fonts load from Google Fonts, so your browser sends your IP address to Google when the page loads.

If you accept advertising cookies

The Meta Pixel on our website sends Meta details of the pages you visit here, whether you view our product, and whether you start a checkout or place an order. For orders, that includes what you bought and how much you paid, but not your name, address or payment details. It also sends technical information such as your IP address, browser, device and cookie identifiers. Meta may link this to your Facebook or Instagram account. We only see combined reports, such as how many visits came from an ad, not who you are.

3. How we use it, and why we’re allowed to

• To process and deliver your order, and keep you updated about it. Lawful basis: contract, because we need it to do what you’ve asked.
• To handle returns, refunds and questions. Lawful basis: contract, and our legitimate interests in looking after our customers.
• To keep accounting and tax records. Lawful basis: legal obligation.
• To prevent fraud and keep our website secure. Lawful basis: legitimate interests.
• To send you news and offers, only if you’ve said yes. Lawful basis: consent, which you can withdraw at any time. We don’t currently send marketing emails.
• To measure and improve our adverts on Facebook and Instagram, only if you accept advertising cookies. Lawful basis: consent, which you can withdraw at any time using Cookie settings at the bottom of any page.

4. Who we share it with

We never sell your personal information. We only share it with:

• Square, which runs our checkout and processes payments. Square is responsible for how it handles your payment information, as explained in Square’s privacy notice.
• Our delivery companies, Evri and Royal Mail, which receive your name and address, and may receive your email or phone number to send delivery updates.
• Our website host, Netlify, which stores and runs this website.
• Google, which serves the fonts used on this website and receives your IP address when the page loads.
• Meta (Meta Platforms Ireland Limited), which runs Facebook and Instagram, but only if you accept advertising cookies. We and Meta are jointly responsible for collecting this information on our website and sending it to Meta. After that, Meta uses it for its own purposes too, such as improving its ads, as explained in Meta’s privacy policy.
• Professional advisers, such as our accountants, where they need it.
• Authorities, such as HMRC or the police, if the law requires it.

5. Transfers outside the UK

Some of our providers, including Square, Netlify, Google and Meta, may process information outside the UK. When they do, they protect it with safeguards recognised under UK data protection law, such as adequacy regulations or the UK International Data Transfer Agreement.

6. How long we keep it

• Order and payment records: 6 years after the end of the financial year they relate to, as required for tax purposes.
• Emails and messages: up to 2 years after we last hear from you, unless they form part of an order record.
• Website logs: kept by our hosting provider for a short time, for security.
• Meta’s advertising cookies: up to 90 days in your browser, unless you clear them sooner. Meta keeps what it receives in line with its own privacy policy.

7. Cookies

We only use advertising cookies if you accept them. The first time you visit, we ask, and nothing loads from Meta unless you say yes.

• Your cookie choice (mystique-cookie-consent, saved in your browser by us): remembers whether you accepted or rejected, so we don’t ask on every page. It’s needed for the site to respect your choice, so it doesn’t need consent. It stays until you clear your browser’s data for this site.
• Meta Pixel (_fbp and _fbc cookies, set by Meta): measures how people who see our Facebook and Instagram ads use our website, and whether they go on to order. Only used if you accept. They last up to 90 days.

You can change your mind at any time: change your cookie settings. If you withdraw your consent, we stop the Meta Pixel and remove its cookies.

Square’s checkout pages use cookies that are needed to take payments securely and prevent fraud, which Square explains in its own notices.

We don’t use any analytics tools. If we add any, we’ll update this policy and ask for your consent first.

8. Your rights

Under UK data protection law, you have the right to:

• ask for a copy of the personal information we hold about you
• ask us to correct anything that’s wrong
• ask us to delete your information
• ask us to restrict how we use it, or object to us using it
• ask for it to be sent to you or another organisation in a reusable format
• withdraw your consent, where we rely on it

Some of these rights only apply in certain situations. For example, we have to keep order records for tax purposes. To make a request, email help@glowundercover.co.uk. It’s usually free, and we’ll reply within one month.

9. Complaints

If you’re unhappy with how we’ve handled your information, please contact us first. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

10. Changes to this policy

We may update this policy from time to time. We’ll post any changes on this page and update the date at the top.