Privacy policy

Last updated: 4 October 2026

This privacy policy explains how Wish Fusion collects, uses, shares and protects your personal data when you visit wishfusion.co.uk, buy from us, subscribe to our emails or texts, or contact us. It also explains your rights under UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Wish Fusion is a trading name of Vision Sparrow Limited, which is the data controller for your personal data. That means we decide how and why your data is used, and we are responsible for looking after it.

Address: 167-169 Great Portland Street, London, W1W 5PF, United Kingdom
Email: info@wishfusion.co.uk

2. The Data We Collect

We only collect the data we need. Depending on how you use our website, this may include:

Identity and contact details: your name, email address, phone number, billing address and delivery address.
Order details: the products you buy, order history, subscriptions, returns and refunds.
Payment details: payments are handled by our payment providers. We do not see or store your full card number.
Account details: your login details and preferences if you create an account.
Messages: anything you send us by email, contact form or chat, and any reviews you post.
Quiz answers: if you take our product quiz, the answers you give so we can suggest products.
Marketing preferences: whether you have agreed to receive our emails or text messages.
Technical data: your IP address, device and browser type, pages viewed and how you arrived at our site, collected through cookies and similar technologies.

We do not ask for medical records. Please do not send us detailed health information unless you need to, for example when asking whether a product is right for you. If you do, we will only use it to answer your question.

3. How We Use Your Data

UK GDPR says we must have a lawful basis for every use of your data. This is what we use your data for, and the basis we rely on:

To process and deliver your orders, take payment, manage subscriptions and handle returns and refunds. Basis: to perform our contract with you.
To reply to your questions and give customer support. Basis: contract, or our legitimate interest in helping our customers.
To send you marketing emails and text messages about offers and new products. Basis: your consent. You can withdraw it at any time.
To run, secure and improve our website, understand how it is used and prevent fraud. Basis: our legitimate interests in running a safe and useful online shop.
To show you relevant adverts on other websites and social media. Basis: your consent, given through our cookie banner.
To keep records for tax and accounting and meet other legal duties. Basis: legal obligation.

Where we rely on legitimate interests, we have balanced our interests against your rights. You can object at any time (see section 8).

4. Cookies

Cookies are small files stored on your device. We use:

Essential cookies that make the website work, such as your basket and checkout. These do not need your consent.
Analytics cookies that show us how visitors use the site, so we can improve it.
Marketing cookies that help us and our advertising partners show relevant adverts and measure how well they work.

We only set analytics and marketing cookies if you agree to them. You can change your choice at any time using the cookie preferences link at the bottom of our website, or through your browser settings.

5. Who We Share Your Data With

We do not sell or rent your personal data. We only share it with trusted organisations that help us run our business, and only as much as they need:

our e-commerce platform (Shopify), which hosts our store and processes orders;
payment providers, who take payment and check for fraud;
delivery and courier companies, who deliver your orders;
email, text message, reviews, subscription and customer support providers;
analytics and advertising partners, only where you have agreed to cookies;
our professional advisers, such as accountants and lawyers.

These organisations must keep your data secure and may only use it to provide their services to us. We may also share data if the law requires it, to protect our rights or the safety of others, or if our business is sold or merged, in which case the new owner would have to protect it in the same way.

6. International Transfers

Some of our service providers are based outside the UK, or store data outside the UK. When your data is transferred abroad, we make sure it is protected to UK standards. This means the country has been approved by the UK government as having adequate protection, or we use safeguards approved under UK law, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

7. How Long We Keep Your Data

We only keep your data for as long as we need it:

Order and payment records: 6 years after the end of the financial year of the order, to meet tax and accounting rules.
Account details: until you close your account, or after a long period without activity.
Marketing data: until you unsubscribe or withdraw consent. We keep a record of your opt-out so we do not contact you again by mistake.
Customer support messages: up to 2 years after the matter is resolved.
Cookie data: for the period set out in our cookie banner.

After this, we delete your data or make it anonymous.

8. Your Rights

Under UK GDPR you have the right to:

Access: ask for a copy of the personal data we hold about you.
Rectification: ask us to correct data that is wrong or incomplete.
Erasure: ask us to delete your data, unless we must keep it by law.
Restriction: ask us to limit how we use your data.
Portability: ask for your data in a format you can take to another company.
Objection: object to us using your data based on legitimate interests, and to direct marketing at any time.
Withdraw consent: where we rely on consent, withdraw it at any time. This does not affect anything we did before you withdrew it.
Automated decisions: not be subject to decisions made only by automated means that have a legal or similarly significant effect on you. We do not make decisions like this.

To use any of these rights, email info@wishfusion.co.uk. There is usually no charge. We will reply within one month, and may ask you to confirm your identity first. You can unsubscribe from emails using the link in any email, and from texts by replying STOP.

9. Keeping Your Data Safe

We use appropriate technical and organisational measures to protect your data, including encrypted (HTTPS) connections, secure payment processing and limiting access to staff and providers who need it. No method of sending or storing data online is completely secure, but we work hard to protect your information and will tell you and the ICO about a serious data breach where the law requires it.

10. Children

Our website and products are intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child has given us their data, please email us and we will delete it.

11. Links to Other Websites

Our website may link to other websites and social media. We are not responsible for how they handle your data, so please read their privacy policies.

12. Changes to This Policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top. If we make important changes, we will let you know by email or on our website.

13. Contact Us and Complaints

If you have any questions about this policy or how we use your data, please email info@wishfusion.co.uk.

If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint.