Brodies 1867 Privacy Policy

Last updated: 11/11/2026

1. Who we are

This website, brodies1867.co.uk (the Site), is run by Brodie Melrose Drysdale & Co. Limited, trading as Brodies, a company registered in Scotland (company number SC201590). Our registered office is 1c Newhailes Industrial Estate, Newhailes Road, Musselburgh, East Lothian, Scotland, EH21 6SY.

In this policy, "Brodies", "we", "us" and "our" mean Brodie Melrose Drysdale & Co. Limited. We are the controller of the personal information described here. We are registered with the UK Information Commissioner's Office (ICO) under registration number  ZA141819.

Contact us about privacy

• Email: enquiries@brodies1867.co.uk
• Phone:  +44 (0) 131 653 4010
• Post: Data Protection, Brodie Melrose Drysdale & Co. Limited, 1c Newhailes Industrial Estate, Newhailes Road, Musselburgh, EH21 6SY

2. Scope of this policy

This policy explains how we collect, use, share and protect personal information when you visit the Site, buy from us, create an account, sign up to our newsletter, or contact us. It applies to customers and visitors in the UK.

It is written to meet the UK General Data Protection Regulation and Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), and the Privacy and Electronic Communications Regulations (PECR).

It does not cover third-party websites we link to, or how Shopify uses information for its own purposes through the Shop app or Shop Pay (see section 5).

3. Personal information we collect

We collect information you give us, information collected automatically when you use the Site, and information from partners. We do not knowingly collect sensitive personal information (such as health data, or "special category" data under GDPR), and we never see or store your full payment card number.

If you do not give us information we need to fulfil an order (for example a delivery address), we will not be able to complete your purchase.

4. How we use your information and our lawful bases

Under UK GDPR we must have a lawful basis for each use of your information. These are ours:

Where we rely on legitimate interests, we have weighed our interests against your rights. You can ask us for details and you can object (section 11).

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Our payment providers and Shopify may use automated fraud screening on orders; if an order is declined, you can contact us and ask for a person to review it.

5. Shopify: our e-commerce platform and payments

• Our online store is hosted by Shopify (Shopify International Limited, Ireland, with Shopify Inc. and its group companies). Shopify provides the Site, checkout, customer accounts, order management and related tools. When Shopify processes your information to run our store, it acts on our instructions as our processor, under a data processing agreement.

Shopify may also use some information for its own purposes, as an independent controller, for example:

• to detect and prevent fraud and keep its platform secure;
• if you use Shop Pay or the Shop app, which Shopify provides to you directly under its own terms; and
• if you choose Shopify Payments to process payments and meet legal ("know your customer" and anti-money-laundering) requirements.

Shopify's handling of your information for those purposes is covered by the Shopify Consumer Privacy Policy. You can make privacy requests to Shopify through its privacy portal.

Payments. Payments are handled by Shopify Payments (Stripe). Card details are entered on secure, PCI DSS compliant payment pages; we do not receive or store full card numbers. Each payment provider may act as an independent controller for fraud checks and legal compliance. Payment providers are Visa, Mastercard, American Express, Apple Pay, Google Pay, Shop Pay, PayPal and Klarna. 

Shopify apps. We use Shopify apps to add features to the Site, such as reviews, live chat, email marketing, subscriptions. These apps receive only the information needed to provide their service and are included under Shopify apps and IT providers in section 8.

6. Cookies, analytics and advertising

We use cookies and similar technologies (pixels, tags, local storage). Except for strictly necessary cookies, we only set them after you agree through our cookie banner. You can change your choice at any time via the Cookie settings link in the footer of every page. You can see a full list of the cookies we use, who sets them, what they’re for and how long they last in our Cookie Policy. 

Google Consent Mode. We use Google Consent Mode v2. If you decline analytics or advertising cookies, Google tags do not set cookies; they may send limited, cookieless signals (such as that a page loaded) which Google uses only in aggregate to model conversions.

Enhanced matching. If you consent to advertising cookies and place an order, we may send Google (Enhanced Conversions) and Meta (Advanced Matching / Conversions API) a hashed (scrambled) version of your email address or phone number so they can match the sale to an ad. Hashing means the data cannot be read in plain text, but it is still personal information.

Google and Meta's own use. Google and Meta may combine this data with information they already hold about you under their own privacy policies: Google Privacy Policy, How Google uses data from sites that use its services, Meta Privacy Policy. For Meta, we are joint controllers for the collection and transmission of pixel data, under Meta's controller addendum.

Other ways to opt out. You can also block cookies in your browser, install the Google Analytics opt-out add-on, manage Google ad settings, and adjust Meta ad preferences. 

7. Newsletter and marketing communications

You can sign up to the Brodies newsletter on the Site, at checkout or in your account. The sign-up box is never pre-ticked. We may send news, offers and new products by email.

• New subscribers: we email you only with your consent. We record when and how you signed up.
• Existing customers (soft opt-in): where you buy from us and do not opt out at checkout, we may email you about our own similar products. You can opt out at checkout and in every email.
• Unsubscribing: use the unsubscribe link in any email, update your account preferences, or contact us. We stop marketing to you promptly, and keep only a minimal suppression record so we do not email you again.
• Email tracking: our emails contain pixels that tell us whether an email was opened and which links were clicked, so we can improve our content. You can block this by turning off images in your email app.
• Provider: our newsletter and transactional emails are sent using Shopify Email, and trade emails using Brevo, both of which act as our processors. 

If you consent to advertising, Google or Meta may show you relevant ads, or to exclude you from ads ("Customer Match" / "Custom Audiences"). You can object to this at any time by contacting us.

Order confirmations and delivery updates are service messages, not marketing, and are sent even if you have not subscribed.

8. Who we share your information with

We do not sell your personal information for money. We share it only as follows:

Our processors may only use your information on our instructions and must keep it secure.

9. International transfers

Some of our providers, including Shopify, Google and Meta, store or access information outside the UK and EEA, mainly in Canada and the United States. When this happens we make sure your information is protected by one of these safeguards:

• an adequacy decision or UK adequacy regulations (for example, for Canada, or for US companies certified under the EU-US Data Privacy Framework and its UK Extension);
• the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum; or
• another safeguard permitted by data protection law.

You can ask us for a copy of the relevant safeguards using the contact details in section 1.

10. How long we keep your information

We keep personal information only as long as we need it for the purposes above, then delete or anonymise it.

We may keep information longer if we need it to resolve a dispute, enforce our terms or meet a legal obligation.

11. Your rights under UK GDPR

You have the right to:

• Access a copy of the personal information we hold about you;
• Rectification of information that is wrong or incomplete;
• Erasure of your information in certain circumstances;
• Restrict how we use your information in certain circumstances;
• Data portability: receive information you gave us in a machine-readable format, or have it sent to another company;
• Object to processing based on legitimate interests, and to direct marketing at any time (we will always stop marketing when you object);
• Withdraw consent at any time, for example by unsubscribing or changing your cookie settings. This does not affect processing before you withdrew it;
• not be subject to solely automated decisions with legal or similarly significant effects.

How to exercise your rights. Contact us using the details in section 1. We may need to verify your identity. We will respond within one month, which can be extended by two further months for complex requests. We do not charge a fee unless a request is clearly unfounded or excessive. You can also view and update much of your information in your account.

12. Security, children, links and changes

Security. The Site uses HTTPS encryption, and Shopify's platform is PCI DSS Level 1 certified. We limit access to personal information to staff and providers who need it, and use strong passwords and two-factor authentication on our admin accounts. No system is completely secure; if a breach is likely to put you at risk, we will tell you and the regulator as the law requires.

Children. The Site is not aimed at children under 16 and we do not knowingly collect their information. If you think a child has given us information, contact us and we will delete it.

Third-party links. The Site may link to other websites and social media. Their privacy practices are their own; please read their policies.

Changes to this policy. We may update this policy from time to time. The "Last updated" date at the top shows when it last changed. We will tell you about significant changes by email or a notice on the Site.

13. Complaints

If you have any concerns or complaints about how we collect, use or protect your personal information, please contact us using the details provided in Section 1.

We will acknowledge receipt of your complaint within 30 days, investigate your concerns appropriately and without undue delay, and keep you informed of the progress of our investigation. We will communicate the outcome to you without undue delay. You also have the right to complain to the UK Information Commissioner's Office: ico.org.uk/make-a-complaint, phone 0303 123 1113.