1. Who we are

Worth the Blush is an online lingerie retailer operated by Kathryn Blake, a UK sole trader trading as Worth the Blush.
For the purposes of UK data protection law, Kathryn Blake trading as Worth the Blush is the data controller responsible for the personal information described in this policy.
Contact details:
Worth the Blush
Kathryn Blake, sole trader
Email: hello@worththeblush.co.uk

2. Information we collect

We may collect and use the following categories of personal information:

• Identity information, including your name and account username.
• Contact information, including your email address, telephone number, billing address and delivery address.
• Order and transaction information, including the products you purchase, order value, payment method, delivery selection, returns, refunds and communications relating to your order.
• Account information, including your login details, saved addresses, order history and saved payment-method references where you choose to use this facility.
• Communication information, including messages sent through our contact form, emails, customer-service requests and delivery enquiries.
• Marketing information, including whether you have asked to receive The Blush Club emails or optional affiliate updates and information about how you interact with those emails where this tracking is permitted.
• Technical information, including your IP address, browser type, device information, security logs and information collected through cookies and similar technologies.
• Preference information, including your cookie choices, marketing preferences and account settings.
• Affiliate application information, including your name, email address, country, website, social-media profiles, primary promotional platform, audience information and proposed promotional methods.
• Affiliate account information, including your affiliate identifier, referral links, promotional codes, account status and programme communications.
• Affiliate performance information, including referral visits, attributed orders, commission, adjustments, returns, rejected transactions, bonuses and payout history.
• Affiliate payment information, including your selected payment method, PayPal details or bank-transfer details supplied through the affiliate portal.
• Referral information, including the referring affiliate’s code, referral-session identifiers, expiry information and relevant order-attribution information.

We do not store your complete payment-card number or card security code.
We normally collect information directly from you when you browse the website, place an order, create an account, contact us, join The Blush Club or apply to or participate in the Affiliate Programme.
We may also receive relevant information from payment providers, delivery companies, fraud-prevention services, affiliates who refer you and GoAffPro, our affiliate-programme technology provider.

3. How we use your information

We use personal information to:


• Process payments and fulfil, deliver and manage orders.
• Send order confirmations, dispatch notifications, tracking information and other service messages.
• Create and manage customer accounts.
• Respond to questions, complaints, returns, refund requests and delivery issues.
• Prevent fraudulent transactions, misuse and security threats.
• Maintain financial, tax and business records.
• Operate, secure and improve our website and customer service.
• Send The Blush Club newsletters and promotional emails where you have chosen to receive them.
• Remember and respect your cookie and privacy preferences.
• Assess Affiliate Programme applications.
• Create, administer and secure affiliate accounts.
• Generate and manage affiliate links and promotional codes.
• Attribute eligible purchases to affiliates.
• Calculate, approve, adjust and pay affiliate commission.
• Administer affiliate campaigns, bonuses and team incentives.
• Investigate attribution disputes, fraud and programme misuse.
• Send necessary Affiliate Programme account, approval, commission and payment communications.
• Send optional affiliate news and campaign opportunities where the affiliate has chosen to receive them.
• Establish, exercise or defend legal claims and comply with legal obligations.

4. Our lawful bases

UK data protection law requires us to have a lawful basis for using personal information. We rely on the following bases:
Contract — where using your information is necessary to process your order, take payment, arrange delivery, manage your customer account or provide customer service connected with your purchase.
We also rely on contract to assess an affiliate application at the applicant’s request and, if approved, administer the Affiliate Programme agreement, track eligible referrals, calculate commission and arrange payments.
Legal obligation — where we must retain or use information to meet tax, accounting, consumer-protection or other legal requirements.
Legitimate interests — where using the information is reasonably necessary to operate and protect Worth the Blush, prevent fraud, maintain records, improve our service, investigate programme misuse or respond to business and legal matters. We consider the effect on your rights before relying on this basis.
Consent — where you choose to receive marketing emails, optional affiliate updates or permit optional cookies and referral-tracking technologies. You may withdraw consent at any time.
Legal claims — where information is required to establish, exercise or defend a legal claim.
Where referral attribution relies upon cookies or similar technologies that require consent, those technologies will not be used until the relevant consent has been provided.

5. Orders and payments

When you place an order, we need certain identity, contact, delivery and payment information to enter into and perform our contract with you. If this information is not provided, we may be unable to process or deliver your order.
Payments may be processed through WooPayments, PayPal, Klarna, Clearpay, Apple Pay, Google Pay or another payment method displayed at checkout.
Your chosen payment provider receives the information necessary to authorise and process the transaction, prevent fraud and comply with its own legal obligations.
Payment providers process certain information under their own privacy policies and may carry out automated fraud, identity, eligibility or credit checks.
Worth the Blush does not receive or store your complete card number or card security code. We may receive a payment reference, payment status, card type and limited card details such as the final four digits where provided by the payment service.

Buy-now-pay-later services
If you choose Klarna or Clearpay, that provider may perform eligibility, identity, affordability or fraud checks. Its decision is made under its own terms and privacy policy. Worth the Blush does not control the provider’s approval decision.

6. Delivery and order fulfillment

We share the information needed to prepare, dispatch and deliver your order with relevant fulfilment partners and delivery providers.
This may include your name, delivery address, email address, telephone number, order contents and delivery instructions.
Current delivery providers include Royal Mail and FedEx.
Shipment and tracking information may also be processed through the systems used to create tracking references, update order statuses and send delivery notifications.

7. Customer accounts

You may purchase as a guest or choose to create a customer account.
If you create an account, we use your information to provide secure access to your order history, addresses, account details, saved payment references and tracking information.
You are responsible for keeping your password confidential. Please contact us promptly if you believe somebody has accessed your account without permission.

8. The Blush Club and marketing

If you choose to join The Blush Club, your name, email address, subscription status and relevant engagement information will be processed using MailerLite, our email marketing provider.
We rely on your consent to send marketing emails. Joining The Blush Club is optional and is not a condition of purchasing from us.
You can unsubscribe at any time by selecting the unsubscribe link in any marketing email or by contacting hello@worththeblush.co.uk.
Unsubscribing from marketing will not prevent us from sending essential messages about an order, payment, account or delivery.
We may retain a minimal suppression record after you unsubscribe so that we can honour your request and avoid accidentally adding you back to the mailing list.
Affiliate applicants and approved affiliates may separately choose whether to receive optional affiliate news, campaign opportunities and promotional updates. Refusing or withdrawing that consent does not prevent necessary communications about an application, affiliate account, referral, commission or payment.

9. Affiliate Programme

We use GoAffPro to operate the Worth the Blush Affiliate Programme.
When you apply, we use your application information to assess whether your proposed promotional activity is suitable for the programme. Applications are reviewed by us and are not approved solely by an automated decision.
If your application is approved, GoAffPro is used to provide your affiliate account, referral links, promotional codes, performance records and commission information.
We process affiliate information to:

• Administer the Affiliate Programme agreement
• Attribute eligible orders
• Calculate and validate commission
• Apply adjustments for cancellations, returns and chargebacks
• Investigate fraud, misuse and attribution disputes
• Arrange payments by PayPal or bank transfer
• Maintain accounting, tax and legal records
• Administer team incentives and other affiliate opportunities

Approved commission balances of £25 or more are normally paid monthly. Commission ordinarily remains pending for at least 45 days and may be declined or reversed where an order is cancelled, refunded, returned, charged back, fraudulent or otherwise ineligible.
Affiliates are responsible for keeping their account and payment information accurate.
The detailed commercial rules governing the programme are set out in our Affiliate Programme Terms.

10. Affiliate referral tracking

When a visitor follows an affiliate referral link, GoAffPro may use cookies and similar technologies to recognise the referring affiliate and attribute an eligible purchase.
GoAffPro identifies three principal referral cookies:

• ref, which records the affiliate referral code
• gfp_v_id, which identifies the referral session
• gfp_v_expires, which records referral-session expiry information

Our standard referral-tracking period is 90 days.
These technologies are only intended to be set for visitors arriving through an affiliate referral. We treat affiliate tracking as optional and configure our consent mechanism so that it is not activated until the visitor provides the relevant consent.
If a visitor refuses or withdraws consent, blocks or deletes cookies, changes browser or device or otherwise prevents tracking, an order may not be attributed through the referral link.
A promotional code entered at checkout may still identify an affiliate independently of cookie-based referral tracking.
Please see our Cookie Policy for further details and current cookie durations.

11. Cookies

Our website uses cookies and similar technologies to operate essential functions, maintain your basket, process checkout, protect customer accounts, remember preferences and understand whether the website is functioning correctly.
CookieYes is used to display our cookie banner and record your cookie choices.
Essential cookies may be used without consent where they are strictly necessary for the website to function. Optional cookies will only be used after you have provided the relevant consent.
We are not currently using Google Analytics or the Meta/Facebook Pixel. If we introduce analytics, advertising or additional tracking technologies in the future, we will update this Privacy Policy and the Cookie Policy and configure CookieYes to obtain any consent required.
You can review or change your cookie choices through the cookie settings link or banner available on the website. Please see our Cookie Policy for more information.

12. Who we share information with

We may share personal information with carefully selected service providers where necessary to operate the business, including:

• Hostinger and other website hosting, email and security providers
• WordPress, WooCommerce, Automattic and relevant website-extension providers
• WooPayments, Stripe, PayPal, Klarna, Clearpay, Apple Pay and Google Pay, depending on the payment method selected
• MailerLite, where you join The Blush Club or receive optional email communications managed through that service
• GoAffPro, which provides Affiliate Programme registration, account, referral, attribution, commission and reporting technology
• Royal Mail, FedEx, fulfilment partners and shipment-tracking service providers
• Banks and payment providers used to make affiliate commission payments
• Professional advisers such as accountants, insurers, legal advisers and technical consultants
• Government bodies, regulators, law-enforcement organisations, courts or other parties where disclosure is required by law or necessary to protect legal rights

We only provide service providers with the information reasonably required for their role. They may also process information under their own legal obligations and privacy policies.
We do not sell your personal information.

13. International transfers

Some of our technology, payment, affiliate-programme and email service providers may process personal information outside the United Kingdom.
GoAffPro states that it operates data centres in Germany and the United States.
Where personal information is transferred internationally, we take steps to ensure that an appropriate legal safeguard is used where required. This may include an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses or another safeguard permitted by UK data protection law.
You may contact us if you would like further information about the safeguards relevant to your information.

14. How long we retain information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute-resolution requirements.
Our current retention periods are:

• Inactive customer accounts: two years after the account was last used
• Pending unpaid orders: seven days
• Failed orders: 30 days
• Cancelled orders: one year
• Completed and refunded order records: up to seven years
• Locally retained Stripe-related customer data and payment references: two years, unless a longer period is required for an active account, transaction, dispute or legal obligation
• Customer-service messages: normally up to two years after the enquiry has been resolved, unless the message relates to an order, dispute or legal requirement requiring longer retention
• Unsuccessful or withdrawn affiliate applications: normally up to 12 months after the decision or withdrawal
• Active affiliate account information: for the duration of participation in the programme
• Closed affiliate account and programme correspondence: normally up to two years after closure, unless a dispute, investigation or legal obligation requires longer retention
• Affiliate commission, payout and associated transaction records: up to seven years where required for accounting, tax or legal purposes
• Referral cookies: up to the configured 90-day referral period
• Marketing information: until you unsubscribe or we determine that the information is no longer required
• Suppression records: for as long as reasonably necessary to respect an unsubscribe request
• Cookie-consent records: for the period reasonably necessary to demonstrate and respect your choices

Payment providers, GoAffPro, delivery companies and other independent organisations may apply their own retention periods.
When information is no longer required, it will be deleted, anonymised or securely disposed of where reasonably possible.

15. How we protect your information

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
These measures include encrypted website connections, restricted administrative access, secure passwords, website security controls, authenticated email delivery, trusted payment providers and appropriate software updates.
No internet-based system can be guaranteed to be completely secure.
If we become aware of a personal-data breach, we will assess and report it where required by law.

16. Your data-protection rights

Depending on the circumstances, you may have the right to:

• Ask for a copy of the personal information we hold about you
• Ask us to correct inaccurate or incomplete information
• Ask us to delete personal information where there is no lawful reason to continue retaining it
• Ask us to restrict how personal information is used
• Object to processing based on legitimate interests
• Object to direct marketing
• Ask for certain information to be transferred in a portable format
• Withdraw consent at any time where processing is based on consent
• Ask not to be subject to certain decisions based solely on automated processing

These rights are not absolute. We may need to retain information where it is required for accounting, tax, fraud prevention, dispute resolution or another legal obligation.
To make a request, email hello@worththeblush.co.uk.
We may ask for information needed to confirm your identity before responding. We normally respond within one month.

17. Questions and complaints

If you have a concern about how we have handled your personal information, please contact us first so that we have an opportunity to investigate and respond.
Email: hello@worththeblush.co.uk
You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data-protection matters.
Information Commissioner’s Office
Website: ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113

18. Children’s information

Our website, products and Affiliate Programme are intended for adults.
Affiliate applicants must be at least 18 years old. We do not knowingly accept Affiliate Programme applications from children.
We do not knowingly collect personal information from children. If you believe that a child has provided personal information to us, please contact us so that we can investigate and take appropriate action.

19. Changes to this policy

We may update this Privacy Policy when our services, suppliers, technologies or legal obligations change.
The latest version will always be published on this page, with the date of the most recent update shown at the top.
Where a change significantly affects how we use personal information, we will take reasonable steps to provide an additional notice.