Privacy policy

Privacy & Cookie Policy

Last updated: 27 October 2026

At Burghley & Co, we respect your privacy and are committed to handling your personal information carefully, lawfully and transparently.

This policy explains how we collect, use, store, share and protect personal information when you visit our website, place an order, provide a prescription, use our optical services, contact us or otherwise interact with Burghley & Co.

We do not sell your personal information for money. We do not use your prescription, optical measurements or optical health information for advertising or behavioural marketing.

We process personal data in accordance with applicable UK data protection and privacy law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and the Data (Use and Access) Act 2025, together with any applicable privacy requirements in other regions in which we operate.

1. Who We Are

Burghley & Co Eyewear Ltd, trading as Burghley & Co, is the data controller responsible for personal information processed in connection with our business and services.

Burghley & Co Eyewear Ltd
Company Registration Number: 16463855
Registered in England & Wales
102 Kesteven Road
Stamford
PE9 1SS
United Kingdom

Email: hello@burghleyandco.uk

2. Information We Collect

Depending on how you use our services, we may collect and process:

Contact information – including your name, billing address, delivery address, email address and telephone number
Order information – including products purchased, order history, delivery preferences, returns, refunds and aftercare history
Prescription and optical information – including spectacle prescriptions, pupillary distance, fitting heights, lens requirements, optical measurements and other information required to provide prescription eyewear
Fitting photographs and images – where you choose or are asked to provide photographs to help us assess frame fit, pupillary distance, fitting heights or other dispensing measurements
Payment and transaction information – payments are processed by authorised payment providers and we do not normally receive or store your complete payment-card details
Customer service information – including emails, enquiries, complaints, prescription discussions, aftercare communications and other correspondence
Technical and website information – including IP address, browser information, device information, website interactions, cookies and analytics information where applicable
Marketing preferences – including whether you have subscribed, unsubscribed or otherwise expressed preferences about receiving communications from us
Fraud and security information – including information or risk indicators provided by ecommerce, payment, security or fraud-prevention services

3. Information We Receive From Other People

Most personal information is provided directly by you.

In some circumstances, and normally with your knowledge or permission, we may also receive information from another organisation or person. For example, we may receive prescription information or clarification from your prescribing optometrist or optical practice where this is necessary to help fulfil or investigate your order.

We may also receive transaction, delivery, fraud-prevention or payment-status information from service providers involved in completing your order.

4. Prescription & Optical Health Information

Prescription and related optical information may constitute health information and therefore special category personal data under UK data protection law.

We only process this information where it is reasonably necessary to provide prescription eyewear, professional dispensing services, aftercare, customer support, or to meet our legal or professional responsibilities.

For the ordinary processing required to provide an order or service, our Article 6 lawful basis may include performance of a contract with you, taking steps at your request before entering into a contract, compliance with a legal obligation, or another appropriate lawful basis depending on the purpose.

Where prescription or optical information constitutes special category health data, we must also have an additional condition under Article 9 of the UK GDPR. Where the legal requirements are met, this may include the health or social care condition under Article 9(2)(h) together with the relevant provisions of the Data Protection Act 2018.

Relevant optical information is processed by, or under the responsibility of, a registered optical professional who is subject to professional duties of confidentiality where required.

We do not intentionally disclose your prescription, optical measurements, fitting photographs or other health information to advertising platforms for the purpose of targeting advertising to you.

5. Photographs & Dispensing Measurements

Where a photograph is supplied to help us obtain or check optical measurements, assess frame fit or provide dispensing advice, we use that image only for purposes connected with your optical order, aftercare or related customer service.

We do not use fitting photographs supplied for an optical order for facial recognition, advertising or unrelated identification purposes.

6. How We Use Your Information

Depending on the purpose, we may rely on:

Contract – to process your order, manufacture prescription eyewear, arrange payment, provide delivery, offer aftercare, process returns and provide customer support
Legal obligation – where processing is required for taxation, accounting, customs, regulatory, professional, consumer-protection or other legal obligations
Legitimate interests – where reasonably necessary to operate and improve our business, maintain security, prevent fraud, investigate complaints, protect our legal rights, improve customer service or understand how our website and services are used, provided those interests are not overridden by your rights
Consent – where we ask for your permission, including certain marketing communications, cookies or similar technologies where consent is required

7. How We Use Prescription Information

Prescription and optical information may be used to:

Review a prescription order before manufacture
Select or recommend appropriate lens options
Manufacture and glaze prescription lenses
Calculate or confirm dispensing measurements
Assess frame and lens suitability
Provide varifocal, bifocal, single-vision or other prescription eyewear
Provide professional optical advice and aftercare
Investigate vision, prescription, fitting or non-tolerance concerns
Communicate with a prescribing practitioner where appropriate and where we have authority to do so
Maintain appropriate optical and customer records

8. Data Minimisation

We aim to collect and use only the personal information reasonably necessary for the purpose for which it is required.

Where information is no longer required, we will delete it, anonymise it, restrict its use or otherwise manage it in accordance with our legal and professional responsibilities.

9. Who We Share Information With

We do not sell your personal information for money.

We may share personal information with organisations that help us provide our services, including:

Shopify and ecommerce technology providers
Payment processors and payment-service providers
Delivery companies and courier providers
Optical laboratories and glazing providers
Lens manufacturers and optical suppliers where required to fulfil an order
IT, hosting, security, backup and business-software providers
Customs brokers, tax providers and international shipping providers
Fraud-prevention and payment-security providers
Analytics and advertising providers, including services such as Google and Meta, where permitted and subject to applicable consent or privacy requirements
Professional advisers, insurers, regulators, courts, law-enforcement authorities or other organisations where disclosure is required or reasonably necessary by law

Where prescription or optical health information needs to be shared with an optical laboratory, lens manufacturer or other provider, we aim to share only the information reasonably necessary to provide the relevant service.

Organisations processing information on our behalf are expected to protect it appropriately and process it only in accordance with applicable law and their contractual obligations.

10. Communicating With Your Prescribing Practitioner

If there is a concern about an externally issued prescription, we may suggest that the prescription is checked by the practitioner who issued it.

Where appropriate, and with your permission or another lawful basis where applicable, we may contact the prescribing practitioner or optical practice and share relevant information needed to investigate or resolve the issue.

11. International Data Transfers

Some organisations involved in operating our website, processing payments, providing technology, delivering orders or supporting our business may process personal information outside the United Kingdom.

Where UK data protection rules relating to international transfers apply, we take appropriate steps to ensure that the transfer is permitted by law.

Depending on the destination and provider, this may include relying on UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses or another legally recognised transfer mechanism.

You may contact us if you would like further information about the safeguards used for relevant international transfers.

12. International Orders & Customs Information

For international orders, including orders to the United States, certain information may need to be provided to couriers, customs authorities, customs brokers, tax providers or other organisations involved in delivering the order.

This may include:

Your name
Your delivery address and contact details
Order and shipment information
Order value
Country of origin information
Product classification and customs information

13. Marketing Communications

We may send marketing emails or other electronic marketing where you have given the appropriate consent or where marketing is otherwise permitted by applicable law.

UK electronic-marketing rules may, in certain circumstances, allow us to contact existing customers about our own similar products or services where the requirements of the customer "soft opt-in" are met, including giving you a clear opportunity to opt out.

You can unsubscribe from marketing at any time by using the unsubscribe link in our communications or by contacting us.

We may retain a limited suppression record after you unsubscribe so that we can continue to respect your preference.

Prescription and optical health information is not used to determine what marketing communications you receive.

14. Cookies & Similar Technologies

Our website uses cookies and similar technologies for purposes including website operation, security, preferences, analytics, performance and advertising.

Cookies are small files or pieces of information stored or accessed on your device when you use a website.

Essential Cookies

Essential cookies and similar technologies may be used where necessary to operate our website and provide services you request, including:

Shopping basket functionality
Checkout
Security and fraud prevention
Account or session management
Remembering privacy or cookie preferences

These technologies do not normally require consent where the applicable legal exemption applies.

Statistical & Service-Improvement Technologies

UK law allows certain limited cookies or similar technologies to be used without prior consent where the statutory conditions for an exemption are met.

This can include certain technologies used solely to collect statistical information about how our website or online service is used with a view to improving that service.

Where we rely on this type of exemption, we will provide clear information about the purpose and provide a simple and free way for you to object where the law requires this.

Analytics Cookies

Analytics technologies help us understand how visitors use our website and identify areas that could be improved.

Where an analytics technology does not meet an applicable legal exemption and consent is required, it will only be used in accordance with your consent choices.

Advertising & Marketing Cookies

Advertising technologies may be used to measure advertising performance, understand campaigns or provide advertising through services such as Google or Meta.

Where consent is required, these technologies will not be activated until you have made the appropriate choice.

Your Cookie Choices

Where our cookie preference tool is available, you can use it to accept, reject or manage relevant categories of cookies and similar technologies.

You can also control certain technologies through your browser or device settings, although blocking essential technologies may affect website functionality.

Cookie and privacy controls may differ by region to reflect applicable legal requirements.

15. United States Privacy Rights

Depending on your state of residence and whether the relevant law applies to Burghley & Co, you may have additional privacy rights.

These may include rights to:

Know or access personal information held about you
Request correction of inaccurate personal information
Request deletion in certain circumstances
Request a portable copy of certain information
Opt out of certain targeted advertising, sale or sharing where applicable
Limit certain uses of sensitive personal information where applicable
Appeal certain privacy decisions where applicable state law provides that right

We do not sell personal information in exchange for money.

Some advertising or tracking technologies can be treated as a "sale", "sharing" or targeted advertising under certain US state privacy laws even where no money changes hands. Where applicable, we provide the controls required by the relevant law.

16. Your UK Privacy Rights

Subject to the circumstances and applicable law, you may have rights including:

The right to access personal information we hold about you
The right to have inaccurate information corrected
The right to request deletion of information in certain circumstances
The right to request restriction of processing in certain circumstances
The right to data portability where applicable
The right to withdraw consent where processing relies on consent
The right to object to certain processing
Rights relating to certain automated decision-making where applicable
The right to raise a data-protection complaint

Your Right to Object

You have the right to object at any time to the use of your personal information for direct marketing.

You may also have the right to object to other processing carried out on the basis of our legitimate interests. Whether we can continue processing will depend on the circumstances and applicable law.

17. Making a Privacy Request

To exercise a privacy right, please contact: hello@burghleyandco.uk.

We may need to request information reasonably necessary to confirm your identity before releasing, changing or deleting personal information.

We will respond within the time required by applicable law. For many UK data-protection requests this will normally be within one month, although the law may allow additional time in certain circumstances.

18. Data Protection Complaints

If you are unhappy with how we have handled your personal information, you can make a data-protection complaint directly to us.

You can complain by emailing hello@burghleyandco.uk, using our website contact form, or writing to us at the address shown in this policy.

We will acknowledge receipt of a data-protection complaint within 30 days.

We will take appropriate steps to investigate and respond to the complaint without undue delay, keep you appropriately informed of progress and tell you the outcome.

UK individuals also have the right to raise concerns with the Information Commissioner's Office (ICO).

Visit the Information Commissioner's Office →

19. Fraud Detection & Automated Tools

Shopify, payment providers and other security providers may use automated systems to help identify potentially fraudulent, suspicious or high-risk transactions.

Burghley & Co may use information generated by these systems to review an order, request additional information, protect customers or reduce fraud and misuse.

We do not use prescription or optical health information to make automated advertising or marketing decisions about you.

20. Data Security

We take appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, misuse, alteration, disclosure or unauthorised access.

Depending on the information and system involved, these measures may include:

Secure ecommerce and payment infrastructure
Encrypted website connections
Restricted access to customer and optical information
Password and account-security controls
Secure third-party service providers
Fraud monitoring and security systems
Appropriate backup and record-management procedures

No internet or electronic storage system can be guaranteed to be completely secure, but we take reasonable steps appropriate to the nature of the information we hold.

21. How Long We Keep Your Information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, accounting, regulatory, professional, complaints, insurance and record-keeping requirements.

Our usual retention approach includes:

Order, transaction and accounting records – normally up to 7 years, or longer where required by law
Prescription, dispensing and optical aftercare records for adults – normally retained for up to 10 years after the last relevant optical interaction, in line with professional record-keeping guidance
Optical records relating to children or young people – normally retained for 10 years after the last relevant optical interaction or until the individual's 25th birthday, whichever is later, where appropriate under professional guidance
Customer service and complaint records – retained for as long as reasonably necessary to provide support, manage complaints or establish, exercise or defend legal rights
Marketing records – retained while marketing is appropriate or until you unsubscribe, with limited suppression information retained where necessary to honour your preference
Website and security records – retained for an appropriate period based on their purpose, security requirements and applicable law

Retention periods may be extended where information is relevant to an ongoing complaint, dispute, legal claim, regulatory enquiry, insurance matter or another legal obligation.

When information is no longer reasonably required, it will be securely deleted, anonymised or otherwise appropriately disposed of.

22. Children & Young People

Our website purchasing services are primarily intended for adults.

Where an adult places an order or provides information on behalf of a child or another person, the adult must be authorised to provide the relevant information and act on their behalf.

Where we process information relating to a child or young person for the provision of optical services, we take additional care appropriate to the nature of the information and the circumstances.

23. Providing Information About Another Person

If you provide personal information about another person, for example when ordering eyewear on their behalf, you should ensure that you are authorised to provide that information and that they are appropriately informed about how their information will be used.

24. Third-Party Websites & Services

Our website may contain links to or integrations with third-party websites, platforms or services.

Where another organisation processes personal information for its own purposes, its own privacy policy and terms may apply. We are not responsible for the privacy practices of independent third-party websites.

25. Changes to This Policy

We may update this Privacy & Cookie Policy periodically to reflect changes to our services, technology, suppliers, professional requirements or applicable law.

The current version will be published on our website together with the date it was last updated.

26. Contact Us

For questions about privacy, data protection, cookies, marketing preferences or the information we hold about you, please contact:

hello@burghleyandco.uk