Privacy Policy
LAST UPDATED: 8 JULY 2026.
1. WHO WE ARE AND HOW TO CONTACT US
1.1 This privacy notice is provided by Carrington Hull Associates Limited, trading as Drakes (“Drakes”, “we”, “us”, “our”). We collect, use and are responsible for certain personal data about you. When we do so, we are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are also subject to the EU General Data Protection Regulation (EU GDPR) in relation to goods and services we offer to individuals in the European Economic Area (EEA).
1.2 If you have any questions or comments about this notice or our data protection practices, you can contact us by email at concierge@drakes.com or by post at: Carrington Hull Associates Limited, 9 Savile Row, London W1S 3PF, United Kingdom.
2. ABOUT THIS NOTICE
2.1 This notice applies to all information collected through our websites, https://www.drakes.com, https://us.drakes.com/and https://www.drakesarchive.com, and/or any related services, sales, marketing or events (together, the “Sites”). It explains what information we collect, how we use it, who we share it with, and the rights you have in relation to it. Please read it carefully - it will help you make informed decisions about sharing your personal information with us.
2.2 To place an order with us, you will need to provide certain personal data - including your name, delivery address, email address and payment details. Providing this information is a contractual requirement: without it we cannot enter into or perform our contract with you and your order cannot be processed or fulfilled. You are not under any statutory obligation to provide this data, but if you choose not to, we will be unable to complete your purchase.
3. WHAT INFORMATION DO WE COLLECT?
In short: We collect personal information that you provide to us (such as name, address, contact information, passwords and security data, and payment information), some information automatically when you visit our Sites (such as IP address and browser and device characteristics), and limited data from other sources.
3.1 Information you provide to us. We collect personal information that you voluntarily provide to us when registering at the Sites, expressing an interest in obtaining information about us or our products and services, participating in activities on the Sites, or otherwise contacting us. The personal information we collect depends on the context of your interactions with us and the Sites, the choices you make and the products and features you use. It may include:
3.1.1 Name and contact data: your first and last name, email address, postal address, phone number, and other similar contact data.
3.1.2 Credentials: passwords, password hints, and similar security information used for authentication and account access.
3.1.3 Payment data: data necessary to process your payment if you make purchases, such as your payment instrument number (for example a credit card number) and the security code associated with your payment instrument. All payment data is stored by our payment processor - please review its privacy policy and contact the payment processor directly with any questions.
3.2 All personal information that you provide to us must be true, complete and accurate, and you must notify us of any changes to it.
3.3 Information collected automatically. We automatically collect certain information when you visit, use or navigate the Sites. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Sites, and other technical information. This information is primarily needed to maintain the security and operation of our Sites, and for our internal analytics and reporting purposes. Like many businesses, we also collect information through cookies and similar technologies (see section 5).
3.4 Information collected from other sources. We may obtain information about you from other sources, such as public databases, joint marketing partners and other third parties. Examples include social media profile information, marketing leads, and search results and links (including paid listings such as sponsored links).
4. HOW WE USE YOUR INFORMATION AND WHO WE SHARE IT WITH
In short: The table below sets out each way we use your personal data, the lawful basis we rely on, and who we share it with. We process your information on one or more of the following lawful bases under Article 6 UK GDPR and EU GDPR: (a) performance of a contract with you; (b) compliance with a legal obligation; (c) our legitimate interests (or those of a third party), where these are not overridden by your interests or rights; or (d) your consent. We only share information to provide you with our services, to comply with laws, to protect your rights, or to fulfil business obligations.
4.1 Where we rely on legitimate interests, we have conducted a legitimate interests assessment to balance our interests against your rights and interests. You can ask us for more information about the balancing test we have carried out for any of these interests by contacting us (see section 1). If we have processed your data based on your consent and you wish to withdraw that consent, please contact us.
|
What we use your personal data for |
Lawful basis |
Who we share it with |
|
Operating our websites |
Performance of our contract with you; our legitimate interest in operating our business |
Shopify - our website platform |
|
Creating and managing your account, including where you choose to link a third-party account (such as Google or Facebook) |
Performance of our contract with you, or taking steps at your request before entering into a contract |
Facebook, Google and Instagram - only where you choose to link an account |
|
Processing your orders and payments. We do not store your full card details; Apple Pay and Google Pay details are handled directly by those providers and are not seen by us |
Performance of our contract with you |
Shopify Payments - our main payment gateway; Braintree (PayPal) - card, Apple Pay, Google Pay and PayPal payments; Shop Pay - where you choose to use it, your payment and delivery details are stored with Shopify to speed up future purchases |
|
Providing buy-now-pay-later payment options, where you choose to pay this way |
Performance of our contract with you - it is necessary to complete your purchase using your chosen payment method |
Clearpay Limited or Shop Pay Instalments. They carry out their own credit and identity checks as separate controllers - their own privacy policies govern how they use your data |
|
Delivering your orders |
Performance of our contract with you |
DHL Express - your name, delivery address, email address and telephone number, for delivery and delivery notifications; a third-party logistics provider - your name, order details and delivery address, for warehousing and fulfilment |
|
Managing returns and exchanges |
Performance of our contract with you |
SWAP - your name, order details and return information |
|
Sending you marketing communications |
Your consent, where you sign up via a pop-up or sign-up form on our website; otherwise, our legitimate interest in promoting our products and services to existing customers. You can unsubscribe at any time (see section 8) |
Klaviyo - email marketing and sign-up forms, including pop-up subscription forms |
|
Notifying you when a product is back in stock, where you have requested this |
Your consent - we send a one-off notification only. You can withdraw consent at any time by contacting us at concierge@drakes.com |
The Back In Stock app - your email address, for that purpose only |
|
Managing made-to-order (MTO) appointments, including appointment reminders |
Performance of our contract with you (appointment reminders); your consent (marketing opt-in) |
Wilford AI - MTO booking forms |
|
Personalising search results and product recommendations on our website |
Our legitimate interest in helping customers find relevant products |
Klevu - your search queries and browsing behaviour on our website |
|
Delivering advertising tailored to your interests and/or location, and measuring its effectiveness |
Your consent, which we collect through our cookie banner for advertising cookies and similar technologies (see our Cookie Policy); and, for measuring advertising effectiveness using aggregated information, our legitimate interest in promoting our products effectively |
Google AdSense and Bing Ads - advertising and lead generation; Facebook - social media advertising; Awin - affiliate marketing |
|
Analysing how our Sites are used, identifying usage trends, and evaluating and improving our Sites, products, services and marketing |
Our legitimate interest in running our business efficiently and improving what we offer, so we can deliver the best service to our customers |
Google Analytics - web and mobile analytics |
|
Sending you service communications, for example about changes to our terms, conditions, policies or features |
Our legitimate interest in keeping our customers properly informed; compliance with our legal obligations, where we are required to notify you of changes (for example, changes to this notice) |
- |
|
Administering prize draws and competitions you choose to enter |
Performance of our contract with you - we process your entry to run the promotion in accordance with its terms |
- |
|
Requesting feedback and contacting you about your use of our Sites |
Our legitimate interest in understanding our customers' experience and improving our Sites, products and services |
- |
|
Keeping our Sites secure and preventing fraud |
Our recognised legitimate interest in detecting, investigating and preventing crime under the UK GDPR; for processing subject to the EU GDPR, our legitimate interest in preventing fraud, which could be damaging for you and for us |
- |
|
Enforcing our terms and policies, responding to legal requests, and protecting our business, our customers and others - including investigating suspected fraud, threats to safety or illegal activity, and using information as evidence in litigation |
Compliance with our legal obligations; in other cases, our legitimate interest in protecting our business, our customers and others, in enforcing our legal rights and in preventing and detecting crime |
Courts, law enforcement agencies, regulators and other public authorities, where we are legally required to disclose information (including in response to a court order or subpoena, or to meet national security or law enforcement requirements); our professional advisers, where necessary |
4.2 Other service providers. As well as the companies named in the table, we may share your data with other third-party vendors, service providers, contractors or agents who perform services for us or on our behalf and need access to that information to do their work - for example data analysis, email delivery, hosting and customer service. We may allow selected third parties to use tracking technology on the Sites, which will enable them to collect data about how you interact with the Sites over time. This information may be used to, among other things, analyse and track data, determine the popularity of certain content and better understand online activity. All of these providers are permitted to use your personal data only to provide their services to us and not for any other purpose. Unless described in this notice, we do not share, sell, rent or trade any of your information with third parties for their promotional purposes.
4.3 Business partners. We may share your information with our business partners to offer you certain products, services or promotions. The lawful basis for this sharing is our legitimate interest in offering our customers relevant products, services and promotions; where consent is required for this sharing or for any resulting marketing, we will ask for it first.
4.4 Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company. The lawful basis for this sharing is our legitimate interest in protecting, realising or growing the value of our business and assets. Where possible, information will be anonymised and will only be shared where necessary, and any recipient will be bound by confidentiality obligations.
5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
In short: We may use cookies and other tracking technologies to collect and store your information.
5.1 We may use cookies and similar tracking technologies (like web beacons and pixels) to access or store information. Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Policy.
6. HOW LONG DO WE KEEP YOUR INFORMATION?
In short: We keep your information for different periods depending on the type of data and the purpose for which it is held, as set out below.
6.1 We will only keep your personal information for as long as it is necessary for the purposes set out in this notice, unless a longer retention period is required or permitted by law (such as tax, accounting or other legal requirements). The following specific retention periods apply:
6.1.1 Transaction and order records (including order details, invoices, payment records, delivery and returns records): 7 years from the date of the transaction, to comply with our tax and accounting obligations and to enable us to establish, exercise or defend legal claims.
6.1.2 Account credentials and preferences (including your password and security data, saved items and linked accounts): for the duration of your account. If you close your account, we will delete or anonymise this data within 30 days of closure. Your transaction records will still be retained for the period above.
6.1.3 Marketing preferences: until you withdraw consent or object, or until 2 years of inactivity. If you opt out of marketing, we will keep a minimal record of your email address on our suppression list for as long as necessary to make sure we honour your opt-out.
6.1.4 Correspondence and enquiry data: 3 years from the date of last contact, or 6 years where the correspondence relates to a dispute or potential legal claim.
6.1.5 Fraud prevention and chargeback records: up to 6 years in relation to disputed transactions.
6.1.6 Prize draw and competition entries: for the duration of the promotion and for 6 months afterwards, or longer where needed to deal with a dispute or claim.
6.1.7 Cookie and analytics data: in accordance with the periods set out in our Cookie Policy.
6.2 When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it, or, if this is not possible (for example, because your personal information has been stored in backup archives), we will securely store your personal information and isolate it from any further processing until deletion is possible.
7. HOW DO WE KEEP YOUR INFORMATION SAFE?
In short: We aim to protect your personal information through a system of organisational and technical security measures.
7.1 We have implemented appropriate technical and organisational security measures designed to protect the security of any personal information we process. However, please remember that we cannot guarantee that the internet itself is 100% secure. Although we will do our best to protect your personal information, transmission of personal information to and from our Sites is at your own risk. You should only access the services within a secure environment.
8. WHAT ARE YOUR PRIVACY RIGHTS?
In short: You have rights under UK data protection law in relation to your personal data. If you are located in the EEA, you have equivalent rights under the EU GDPR. These rights apply regardless of where you are located.
8.1 You have the following rights, which you can exercise free of charge:
8.1.1 Access: the right to obtain a copy of your personal data.
8.1.2 Rectification: the right to require us to correct inaccurate personal data.
8.1.3 Erasure: the right to require us to delete your personal data in certain circumstances. Where the law requires us to keep some of your data (for example, transaction records for tax purposes), we will explain this to you, retain only what is necessary, and isolate it from any other use.
8.1.4 Restriction of processing: the right to require us to restrict how we use your personal data in certain circumstances.
8.1.5 Data portability: the right to receive your personal data in a structured, commonly used and machine-readable format in certain circumstances.
8.1.6 Objection: the right to object to our processing of your personal data where we rely on legitimate interests, and to object at any time to processing for direct marketing purposes.
8.1.7 Automated decision-making: rights in relation to automated decision-making.
8.2 How to make a request. To exercise any of these rights - including to review, update or delete your personal information - you can: (a) contact us using the details in section 1; (b) submit a request form at [insert link to request form]; or (c) for reviewing and updating your account information, log into your account settings at any time. When you make a request, please give us enough information to identify you and tell us which right you want to exercise and the information your request relates to. We may ask you for additional information to confirm your identity, but only where this is reasonably needed to make sure we do not disclose your data to the wrong person.
8.3 How we will respond. Exercising your rights is free of charge. We will respond within one month of receiving your request. If your request is particularly complex, or you have made a number of requests, we may extend this by up to two further months - if so, we will tell you within the first month and explain why. In limited cases where a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act on it; if we do, we will explain our reasons and you can complain to us and to the ICO (see below).
8.4 If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time. This will not affect the lawfulness of the processing before its withdrawal.
8.5 Complaints. You have the right to make a complaint directly to us. Please email us at concierge@drakes.com. If you remain dissatisfied, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk. If you are located in the EEA, you may also complain to your local supervisory authority - a list is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.
8.6 Account information. If you would at any time like to review or change the information in your account, or terminate your account, you can log into your account settings and update your user account, or contact us using the details in section 1. If you terminate your account, we will delete or anonymise your account credentials and preferences within 30 days, in line with section 6. However, some information will be retained for the periods set out in section 6 - in particular your transaction records, which we must keep to comply with tax, accounting and legal requirements - and we may retain information where necessary to prevent fraud, troubleshoot problems, assist with any investigations or enforce our Terms of Use. Where we retain information for these reasons, it is kept only for those purposes and isolated from any other use.
8.7 Opting out of email marketing. You can unsubscribe from our marketing email list at any time by clicking the unsubscribe link in the emails that we send or by contacting us using the details in section 1. You will then be removed from the marketing email list - however, we will still need to send you service-related emails that are necessary for the administration and use of your account.
9. CONTROLS FOR DO-NOT-TRACK FEATURES
9.1 We do not currently respond to Do-Not-Track signals. If you wish to opt out of tracking, you can manage your preferences through our cookie consent manager.
10. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
In short: Yes - if you are a resident of California, you are granted specific rights regarding access to your personal information.
10.1 California Civil Code Section 1798.83, known as the “Shine The Light” law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about the categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact details in section 1.
10.2 In addition, if the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) apply to our processing of your data, you may have additional rights, including the right to know, delete, correct, and opt out of the sale or sharing of your personal information. Please contact us using the details in section 1 to exercise these rights.
11. DO WE TRANSFER YOUR PERSONAL DATA INTERNATIONALLY?
In short: We transfer personal data outside the UK and EEA, including to the United States. We take steps to ensure your data is protected when we do so.
11.1 We share your personal data with third-party service providers based in the United States, including Google, Meta (Facebook), Microsoft (Bing), DoubleClick, Tapad, Twitter/X Corp, Apple, Criteo, and Snapchat.
11.2 Transfers to the United States are made on the basis of: (a) an adequacy regulation under Article 45A UK GDPR, where the recipient participates in the UK-US Data Bridge; or (b) standard data protection clauses under Article 46(2) UK GDPR, where no adequacy regulation applies. You may request a copy of the relevant transfer safeguards by contacting us using the details in section 1. If you are located in the EEA, transfers are made on equivalent bases under the EU GDPR.
12. DO WE MAKE UPDATES TO THIS NOTICE?
In short: Yes - we will update this notice as necessary to stay compliant with relevant laws.
12.1 We may update this privacy notice from time to time. The updated version will be indicated by an updated “Last updated” date and will be effective as soon as it is accessible. If we make material changes to this notice, we may notify you either by prominently posting a notice of the changes or by directly sending you a notification. We encourage you to review this notice frequently to stay informed about how we are protecting your information.