Privacy & Cookie Policy | Molton Brown UK

Last revised 19 June 2026

 

Molton Brown Limited, 6 Agar Street, London, WC2N 4HN ("Kao Company" or "we" or "our") and each of its affiliates and subsidiaries in the EMEA region collectively, the "Kao Group") takes data privacy seriously. This Privacy Policy informs the users of www.moltonbrown.co.uk and any other Kao Company-owned websites or mobile applications on which this Privacy Policy is displayed ("Website") how we, as controller within the meaning of the General Data Protection Regulation ("GDPR") collect and process the personal data and other information of such users in connection with their usage of the Website. Note that other Kao Group websites or mobile apps may be governed by other privacy policies.

Who is responsible for processing of your personal data?

• Molton Brown Limited is primarily responsible for the processing of personal data within the scope of this Privacy Notice.

• Molton Brown Limited, 6 Agar Street, London, WC2N 4HN. UK is the registered data controller in UK.

• Kao Germany GmbH, Pfungstädter Strasse 98-100, 64297 Darmstadt, Germany (part of the Kao Group) is the EU representative of Molton Brown Limited in Germany and EU.

1.        Categories of Personal Data and Processing Purposes - What personal data do we process about you and why?

1.1    Metadata

You may use the Website without providing any personal data about you. In this case, we will collect only the following metadata that result from your usage of the Website: browser type and version, operating system and interface, website from which you are visiting us (referrer URL), webpage(s) you are visiting on our Website, date and time of accessing our Website, and internet protocol (IP) address.

Your IP address will be used to enable your access to our Website. The metadata, including the shortened IP address, will be used to improve the quality and services of our Website and services by analysing the usage behaviour of our users.

1.2    Account

If you create an account on our Website you will be asked to provide the following personal data about you: name, gender (salutation), date of birth, postal address, email address, telephone number, selected password for your account, payment details, invoicing and delivery address, your preference in joining our Rewards Club, and your preferences in receiving marketing from us (voluntary). We process such personal data for purposes of account administration, answering your queries or information requests, providing desired products or services, providing you with marketing materials where you have provided consent for us to do so, to the extent permitted by applicable law, analysing your interests for marketing purposes, improving our Website according to usage patterns, and for technical administration or other purposes to which you have agreed.

1.3    Product Orders and Withdrawal from the Contract

If you order a product via our Website we collect and process the following personal data about you: name, gender (salutation), postal address, email address, telephone number, payment details, invoicing and delivery address, type and amount of product, purchase price, order date, order status, product returns, customer care requests, and your preferences in receiving marketing from us (voluntary). We process such personal data for purposes of carrying out the contractual relationship and the product order, providing customer care services, compliance with legal obligations, defending, establishing and exercising legal claims, providing you with marketing materials where you have provided consent for us to do so, to the extent permitted by applicable law, and analysing your interests for marketing purposes. If you withdraw from the purchase contract, we will also process contract and order details (e.g. order number), timestamps and, for technical reasons, your IP address (for verification purposes and to prevent misuse).

1.4    Rewards Club

If you join our Rewards Club, we will collect and process the following personal data about you: gender (salutation), name, phone number (voluntary), email address, password, and your preferences in receiving marketing from us (voluntary). We process such personal data for purposes of Rewards Club account administration, answering your queries or information requests, providing desired products or services, providing you with marketing materials where you have provided consent for us to do so, to the extent permitted by applicable law, analysing your interests for marketing purposes, improving our Website according to usage patterns, and for technical administration or other purposes to which you have agreed.  We use a third party, Annex Cloud to administer our Rewards Club, see clause 1.9 for further information.

 

1.5    Subscription Service

 

If you sign up to our Subscription Service, we will collect your details as part of account registration along with an opt in for our subscription service. We process such personal data for the purposes of subscription administration, answering your queries or information requests, providing desired products or services, providing you with marketing materials where you have provided consent for us to do so, to the extent permitted by applicable law, analysing your interests for marketing purposes, improving our Website according to usage patterns, and for technical administration or other purposes to which you have agreed. We use a third party, Ordergroove to administer our Rewards Club, see clause 1.9 for further information.

 

1.6    Competitions

If you participate in a competition, we collect and process the following personal data about you: name, gender (salutation), postal address, email address, telephone number and selection as winner. We process such personal data for purposes of carrying out the competition, informing the winner, delivering the prize to the winner, carrying out the event, and providing you with marketing materials where you have provided us consent to do so, to the extent permitted by applicable law, and analysing your interests for marketing purposes.

1.7    Marketing Communications

If you request to receive our email and/or SMS marketing, we collect and process the following personal data about you: name, email address, mobile phone number, date of birth (optional), gender (optional) and, your preferences in receiving marketing communications (voluntary). We process such personal data for purposes of providing the newsletter and other marketing materials to the extent permitted by applicable law and, where you have provided us consent to do so, and analysing your interests for marketing purposes.

 

We will send our Rewards Club members postal marketing including gifts (such as samples), new collection/campaign information, and exclusive offers. You can opt out of postal marketing in your account settings, or by contacting us.

 

1.8    In Store

When visiting our stores, we may, with your consent, collect your contact details to let you know when out of stock products are back in stock, to invite you to in-store events, or to send you postal marketing.

1.9    Contact Us

On our website, we offer you the opportunity to contact us via a contact form. For this we need the following personal data from you: email name, telephone number (optional), address (optional), date of birth (optional) and gender (optional). The personal data that you provide us in the context of this contact request will only be used to answer your inquiry and for the technical administration thereof. The transfer to third parties does not take place. Your personal data will be deleted as soon as we have processed your request or you revoke the consent you have given.

1.10 Third Party Services

On our website we use a rating tool provided by BazaarVoice. This tool is used to allow our customers to provide feedback on our goods and services. BazaarVoice’s privacy policy applies and is available at https://www.bazaarvoice.com/legal/privacy-policy/.

We also use Rakuten Marketing to help get the most of our digital marketing by delivering data-driven personalised ad experiences. Rakuten collects data using cookies on our Website. If you opt out of cookies when you visit our Website, Rakuten will not collect your personal data. For more information about how Rakuten process your personal data, visit Rakuten Website Privacy Policy.

 

We use Mention Me to allow customers to make referrals to Molton Brown. Please refer to Mention Me’s privacy policy for further information about how they process your information on behalf of Molton Brown: https://mention-me.com/help/privacy_policy_s#referrers.

 

When you sign up to our Rewards Club, we use a third party, Annex Cloud to administer your Rewards Club account. For information about how Annex Cloud process your information for this purpose, see their privacy policy: https://www.annexcloud.com/privacy-policy/.

 

When you sign up to our product subscription service, we use a third party, Ordergroove to administer this service. For information about how Ordergroove process your information for this purpose, see their privacy policy: https://www.ordergroove.com/privacy-policy/.

 

We use StoreMapper and Mapbox to provide you with the store locator service. For more information about how StoreMapper and Mapbox use your information for this purpose, see their privacy policies: https://www.storemapper.com/privacy, https://www.mapbox.com/legal/privacy.

 

We use Amazon Marketing Cloud for data analytics. For more information about how Amazon uses your personal data for this purpose, please visit their privacy policy: https://www.amazon.co.uk/gp/help/customer/display.html?nodeId=GX7NJQ4ZB8MHFRNJ.

 

 

We offer a variety of payment methods which include third party providers such as Klarna, Apple Pay, and PayPal. We encourage you to read their privacy policies for further information about how they process your personal data.

 

2.        Processing Basis and Consequences - What is the legal justification for processing your personal data and what happens if you choose not to provide it?

We rely on the following legal grounds for the collection, processing, and use of your personal data:

• your consent to the processing of your data for one or more specific purposes (as detailed in Section 1) ;

• if we have a legitimate interest in doing so (including but not limited to) a legitimate interest in performing marketing activities, research activities, data analytics, internal administration functions, processing and enforcing legal claims and conducting our business in compliance with all applicable laws, relevant industry standards and our policies); or

 

• To fulfil our contractual obligation when you make a purchase from us.

The provision of your personal data is not required by a statutory. The provision of your personal data is not necessary to enter into a contract with us or to receive our services/products as requested by you. The provision of your personal data is voluntary for you.

Not providing your personal data may result in disadvantages for you, for example, you may not be able to receive certain products and services. However, unless otherwise specified, not providing your personal data will not result in legal consequences for you.

3.        Categories of Recipients and International Transfers - Who do we transfer your personal data to and where are they located?

We may transfer your personal data to third parties for the processing purposes described above as follows:

• Within the Kao Group: Our parent entity, the Kao Corporation, in Japan and each of its affiliates and subsidiaries (each affiliate or subsidiary including us referred to as "Kao Company"; collectively, the "Kao Group") within the global Kao Group may receive your personal data as necessary for the processing purposes described above. Depending on the categories of personal data and the purposes for which the personal data has been collected, different internal departments within the Kao Company may receive your personal data. For example, our IT department may have access to your account data, and our eCommerce and sales departments may have access to your account data or data relating to product orders. Moreover, other departments within the Kao Company may have access to certain personal data about you on a need-to-know basis, such as the legal department, the finance department or internal auditing.

Where we need to share you Personal Data with other Kao Group companies, we have put in place the necessary safeguards including EU Standard Contractual Clauses, the Swiss Addendum, and the UK International Data Transfer Addendum, as applicable.

• With data processors and controllers: Certain third parties, whether affiliated or unaffiliated, may receive your personal data to process such data under appropriate instructions or to allow us to provide services to you as necessary for the processing purposes described above, such as website service providers, order fulfilment providers, customer care providers, marketing service providers, IT support service providers, and other service providers who support us in maintaining our commercial relationship with you. We also engage third parties to carry out analytics on our customer data in order to allow us to better provide you with products and services you may be interested in, to market to you, and to identify any potential Website issues that may impact customers’ experience when using the Website. Data Processors will be subject to contractual obligations to implement appropriate technical and organisational security measures to safeguard the personal data, and to process the personal data only as instructed. Where a third party is a separate data controller, they are responsible for the data they hold about you, however, we thoroughly review all third parties, whether processor or controller to ensure they will look after your personal data to a compliant standard.

• Other recipients: We may transfer - in compliance with applicable data protection law - personal data to law enforcement agencies, governmental authorities, judicial authorities, legal counsel, external consultants, or business partners. In case of a corporate merger or acquisition, personal data may be transferred to the third parties involved in the merger or acquisition. We will not disclose your personal data to third parties for advertising or marketing purposes or for any other purposes without your permission.

Any access to your personal data is restricted to those individuals that have a need-to-know in order to fulfil their job responsibilities.

International transfers. The personal data that we collect or receive about you may be transferred to and processed by recipients that are located inside or outside the European Economic Area ("EEA").

• For recipients located outside of the EEA, some are certified under the EU-U.S. Privacy Framework (and the UK extension of that Framework) and others are located in countries with adequacy decisions and, in each case, the transfer is thereby recognised as providing an adequate level of data protection from a European data protection law perspective.

• Other recipients might be located in countries which do not adduce an adequate level of protection from a European data protection law perspective. We will take all necessary measures to ensure that transfers out of the EEA are adequately protected as required by applicable data protection law.

• With respect to transfers to countries not providing an adequate level of data protection, we will base the transfer on appropriate safeguards, such as standard data protection clauses adopted by the European Commission or by a supervisory authority, approved codes of conduct together with binding and enforceable commitments of the recipient, or approved certification mechanisms together with binding and enforceable commitments of the recipient.

You can ask for a copy of such appropriate safeguards by contacting us as set out in Section 7 below.

 

4.        Social Media

Where we have your consent to do so, we may use your personal data to show you advertising on social media platforms, such as Facebook, Instagram, YouTube, Pinterest, and TikTo[ML1] k, or via third-party advertising that may appear on other websites or apps that you use.

 

We may also use social media to respond to any customer service enquiries that you raise on our social channels via comments on posts or direct messages to our Molton Brown social handles.

 

When using these social platforms, including when clicking any social links on our Website, these social platforms may use cookies which we have no control over. We encourage you to review the privacy and cookie policies of these social platforms when you use them. Our privacy policy no longer applies once you leave our Website.

 

5.        Third Party Links

Our website, marketing, and service emails (for example, order delivery emails) contain links to third party websites. When you click these links, our privacy policy no longer applies, and we encourage you to review the privacy policies of these third parties.

 

6.        Children

To create an account or sign up to any of our services including the Rewards Club or subscription service, and to receive our marketing communications, customers need to be 16 and over.

 

Whilst we do not knowingly collect information from children under the age of 16, we understand that from time-to-time children under the age of 16 may visit our website.  

 

If you are a parent our legal guardian and believe your child may have provided their personal information to us, please contact us using the form in the Questions and Contact Information section of this Policy.

7.        Retention Period - How long do we keep your personal data?

Your personal data will be retained as long as necessary to provide you with the services and products requested. Once you have terminated the contractual relationship with us or the competition has been completed or otherwise ended your relationship with us, we will remove your personal data from our systems and records and/or take steps to properly anonymize it so that you can no longer be identified from it (unless we need to keep your information to comply with legal or regulatory obligations to which the Kao Company is subject--e.g., taxation purposes).

We may retain your contact details and interests in our products or services for a longer period of time if the Kao Company is allowed to send you marketing materials. Also, we may be required by applicable law to retain certain of your personal data for a period of 10 years after the relevant taxation year. We may also retain your personal data after the termination of the contractual relationship if your personal data are necessary to comply with other applicable laws or if we need your personal data to establish, exercise or defend a legal claim, on a need to know basis only. To the extent possible, we will restrict the processing of your personal data for such limited purposes after the termination of the contractual relationship.

8.        Your Rights - What rights do you have and how can you assert your rights?

• Right to withdraw your consent: If you have declared your consent regarding certain collecting, processing and use of your personal data (in particular, regarding the receipt of direct marketing communication via email, telephone/SMS and postal), you can withdraw this consent at any time with immediate effect. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal. Please contact us as stated in Section 7 below to withdraw your consent. Further, you can object to the use of your personal data for the purposes of marketing without incurring any costs other than the transmission costs in accordance with the basic tariffs.

• Additional data privacy rights: Pursuant to applicable data protection law, you may have the right to: (i) request access to your personal data; (ii) request rectification of your personal data; (iii) request erasure of your personal data; (iv) request restriction of processing of your personal data; (v) request data portability; and/or (vi) object to the processing of your personal data (including objection to profiling).

• Please note that these aforementioned rights might be limited under the applicable local data protection law. Below please find further information on your rights to the extent that the GDPR applies:

• Right to request access to your personal data: You may have the right to obtain from us confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, to request access to the personal data. This access information includes – inter alia – the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipient to whom the personal data have been or will be disclosed. However, this is not an absolute right, and the interests of other individuals may restrict your right of access. You may have the right to obtain a copy of the personal data undergoing processing free of charge. For further copies requested by you, we may charge a reasonable fee based on administrative costs.

• Right to request rectification: You may have the right to obtain from us the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

• Right to request erasure (right to be forgotten): Under certain circumstances, you may have the right to obtain from us the erasure of personal data concerning you and we may be obliged to erase such personal data.

• Right to request restriction of processing: Under certain circumstances, you may have the right to obtain from us restriction of processing your personal data. In such case, the respective data will be marked and may only be processed by us for certain purposes.

• Right to request data portability: Under certain circumstances, you may have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you may have the right to transmit those data to another entity without hindrance from us.

• Right to object: Under certain circumstances, you may have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by us and we can be required to no longer process your personal data. Such right to object may especially apply if we collect and process your personal data for profiling purposes in order to better understand your interests in our products and services or for direct marketing. If you have a right to object and you exercise this right, your personal data will no longer be processed for such purposes by us. You may exercise this right by contacting us as stated in Section 7 below. Such a right to object may, in particular, not exist if the processing of your personal data is necessary to take steps prior to entering into a contract or to perform a contract already concluded. If you no longer want to receive direct marketing via email, telephone/SMS, and postal, you need to withdraw your consent as explained at the start of Section 5.

To exercise your rights, please contact us as stated under Section 7 below. You also have the right to lodge a complaint with the competent data protection supervisory authority.

9.        Cookies

We use cookies on our website. For information about these cookies, please read our Cookie Policy at [link][SK2] 

 

10.    Questions and Contact Information

For further information and to exercise your statutory rights according to section 5, please go to www.kao.com/global/en/EU-Data-Subject-Request.

 

To make a complaint about the use of your personal data, please contact customerservice@moltonbrown.com.

11.    Changes to this Privacy Policy

We may update this Privacy Policy from time to time in response to changing legal, regulatory or operational requirements. We will notify you of any such changes, including when they will take effect, by updating the "Last revised" date above or as otherwise required by applicable law.

Your continued use of our Website after any such updates take effect will constitute acceptance of those changes. If you do not accept updates to this Privacy Policy, you should stop using our Website.