Privacy policy

Last updated: 25 July 2026

1. WHO WE ARE

This Privacy Policy explains how DIFFLS LTD collects, uses, shares and protects personal information when you:

  • Visit a website or online storefront operated by us;
  • Purchase a product from us;
  • Contact us;
  • Subscribe to marketing communications;
  • Use our checkout, cart or customer-service features; or
  • Interact with our advertisements.

This policy applies to our brands and online storefronts, including Diffls and Formstead, and websites including diffls.com and formstead.co.uk where applicable.

The data controller is:

DIFFLS LTD
Company number: 16285040
Registered in England and Wales
Registered office: Office 5889, 58 Peregrine Road, Ilford, England, IG6 3SZ

Email: hello@diffls.com

2. INFORMATION WE COLLECT

Depending on how you interact with us, we may collect the following categories of information.

A. Identity and contact information

  • Name;
  • Billing address;
  • Delivery address;
  • Email address;
  • Telephone number; and
  • Customer-account information, where an account is available.

B. Order and transaction information

  • Products ordered;
  • Selected sizes, colours and quantities;
  • Order number;
  • Purchase value;
  • Discounts used;
  • Payment status;
  • Delivery status;
  • Returns and refunds;
  • Communications concerning an order; and
  • Fraud-prevention information.

C. Payment information

Payments are processed by Shopify and the payment providers offered at checkout.

We do not normally receive or store your complete payment-card number, security code or full payment credentials. We may receive limited payment information such as the payment method, transaction status and the last digits of a card where provided by the payment processor.

D. Website and device information

We may collect:

  • IP address;
  • Browser type and version;
  • Device type;
  • Operating system;
  • Referring website;
  • Pages viewed;
  • Buttons or links clicked;
  • Time and date of visits;
  • Approximate location derived from IP address;
  • Cart and checkout interactions;
  • Cookie identifiers; and
  • Advertising or analytics identifiers where permitted.

E. Customer-service information

If you contact us, we may collect:

  • The content of your message;
  • Photographs or videos you send;
  • Details of a complaint, return or product issue; and
  • Records of our communications with you.

F. Marketing information

Where you subscribe to receive offers, request a discount such as WELCOME10 or otherwise agree to marketing, we may collect:

  • Your email address;
  • Your marketing preferences;
  • The date and method of consent;
  • Whether emails were delivered, opened or clicked; and
  • Records of unsubscribing or objecting.

3. HOW WE COLLECT INFORMATION

We collect personal information:

  • Directly from you;
  • Through our websites and checkout;
  • Through Shopify;
  • Through cookies, pixels and similar technologies;
  • From payment processors;
  • From delivery providers;
  • From advertising and analytics providers;
  • From marketplaces through which you purchase our products; and
  • From publicly available sources where lawful and relevant.

4. HOW AND WHY WE USE YOUR INFORMATION

We use personal information for the following purposes.

A. Processing and fulfilling orders

We use your information to:

  • Accept and process orders;
  • Take and confirm payment;
  • Deliver products;
  • Provide order updates;
  • Operate the cart and checkout;
  • Handle cancellations, returns and refunds; and
  • Provide customer support.

Our lawful basis is normally that processing is necessary to enter into or perform our contract with you.

B. Complying with legal obligations

We may use and retain information to:

  • Maintain tax and accounting records;
  • Comply with consumer-protection requirements;
  • Respond to lawful requests from authorities;
  • Meet product-safety obligations;
  • Prevent unlawful transactions; and
  • Establish, exercise or defend legal claims.

Our lawful basis is compliance with a legal obligation and, where applicable, our legitimate interests.

C. Operating and protecting our business

We may process information to:

  • Keep our websites and services secure;
  • Detect fraud, abuse and unauthorised activity;
  • Troubleshoot technical problems;
  • Monitor performance;
  • Protect our customers, systems and business;
  • Maintain records of transactions and communications; and
  • Improve our products and customer service.

Our lawful basis is our legitimate interest in operating, securing and improving our business, provided those interests are not overridden by your rights.

D. Analytics and website improvement

Where permitted, we use analytics tools to understand how visitors use our websites and to improve usability, performance and product presentation.

These tools may include Google Analytics.

Where consent is legally required, non-essential analytics technologies are used only after you provide the relevant consent through our cookie controls.

E. Advertising and measurement

Where permitted, we may use Google Ads, Meta Pixel and TikTok Pixel to:

  • Measure advertising performance;
  • Understand whether an advertisement resulted in a visit or purchase;
  • Create advertising audiences;
  • Limit repeated advertisements;
  • Show advertisements that may be more relevant; and
  • Improve our marketing campaigns.

These providers may receive device, browser, cookie, interaction, purchase or conversion information.

Where consent is legally required, advertising technologies are activated only after you provide the relevant consent.

F. Email marketing

We may send promotional emails where:

  • You have expressly consented; or
  • The law permits us to contact an existing customer about similar products and we provided an opportunity to opt out.

You may unsubscribe at any time by using the unsubscribe option in an email or by contacting hello@diffls.com.

Withdrawing consent does not affect processing that was lawful before consent was withdrawn.

5. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies for purposes including:

  • Keeping the website and cart functioning;
  • Remembering privacy and cookie choices;
  • Security and fraud prevention;
  • Analytics;
  • Advertising measurement; and
  • Personalised or targeted advertising, where permitted.

Strictly necessary technologies may operate without consent where they are required to provide a service you requested or to keep the website secure.

Where required, optional analytics and advertising technologies will not be activated until you make a choice through our cookie controls.

You can change your preferences using the Cookie Settings option available on our website. You can also adjust browser settings, although blocking necessary cookies may prevent some website functions from working properly.

6. WHO WE SHARE INFORMATION WITH

We may share personal information with the following categories of recipients where necessary.

A. Shopify

Shopify provides our ecommerce backend, cart, checkout, order-management and related services.

B. Payment providers

Payment processors and financial institutions process payments, refunds and fraud checks.

C. Cloudflare

Cloudflare provides website hosting, content delivery, performance and security services.

D. Delivery and fulfilment providers

We share the information needed to prepare, dispatch, track and deliver your order.

E. Analytics and advertising providers

Subject to your choices and applicable law, we may share relevant information with:

  • Google, including Google Analytics and Google Ads;
  • Meta, including Meta Pixel; and
  • TikTok, including TikTok Pixel.

F. Email and communication providers

We may use service providers to send transactional messages, discount codes, newsletters and customer-service communications.

G. Professional advisers

We may disclose information to accountants, legal advisers, insurers, auditors or other professional advisers where reasonably necessary.

H. Authorities and legal recipients

We may disclose information where required by law, court order or a lawful request, or where necessary to protect our legal rights or the safety of others.

I. Business transactions

If DIFFLS LTD is reorganised, sold, merged or transfers part of its business, relevant information may be disclosed to professional advisers and prospective or actual buyers, subject to appropriate confidentiality and legal safeguards.

We do not sell your personal information in the ordinary meaning of selling customer lists for money.

7. INTERNATIONAL DATA TRANSFERS

Some of our providers may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we take steps intended to ensure that appropriate safeguards are in place. These may include:

  • Transfers to countries recognised as providing adequate protection;
  • The UK International Data Transfer Agreement;
  • The UK Addendum to approved standard contractual clauses; or
  • Another lawful transfer mechanism.

You may contact us for more information about safeguards relevant to your information.

8. HOW LONG WE KEEP INFORMATION

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, fraud-prevention and dispute-resolution requirements.

In general:

  • Order, invoice, payment and accounting records may be retained for up to six years or longer where required by law;
  • Customer-service and complaint records are retained for as long as necessary to resolve the issue and manage possible claims;
  • Marketing information is kept until you unsubscribe, withdraw consent or object, although we may retain a minimal suppression record so that we do not contact you again;
  • Cookie and advertising identifiers are retained according to the duration of the relevant technology and your preferences; and
  • Security records are retained for a proportionate period based on the nature of the risk.

We periodically review information and delete or anonymise it where it is no longer needed.

9. HOW WE PROTECT INFORMATION

We use reasonable technical and organisational measures intended to protect personal information against:

  • Unauthorised access;
  • Loss;
  • Misuse;
  • Alteration;
  • Disclosure; and
  • Destruction.

No online system is completely secure, and we cannot guarantee absolute security. You should take reasonable care to protect your own account, device and payment information.

10. YOUR DATA-PROTECTION RIGHTS

Depending on the circumstances, you may have the right to:

  • Ask for confirmation that we process your information;
  • Request access to your personal information;
  • Ask us to correct inaccurate or incomplete information;
  • Ask us to erase information;
  • Ask us to restrict processing;
  • Object to processing based on legitimate interests;
  • Object to direct marketing at any time;
  • Request transfer of certain information in a portable format;
  • Withdraw consent where processing is based on consent; and
  • Complain about how we use your information.

Some rights are subject to legal conditions and exemptions.

To exercise a right, contact hello@diffls.com. We may need to verify your identity before responding.

11. MARKETING CHOICES

You can stop marketing emails at any time by:

You may continue to receive essential service messages relating to an order, payment, delivery, return, account security or legal matter.

You can manage analytics and advertising choices through our cookie-preference controls.

12. AUTOMATED DECISION-MAKING AND PROFILING

Advertising and analytics providers may use information to create audience groups, measure advertisements or predict interests.

We do not intend to make decisions about you based solely on automated processing that produce legal or similarly significant effects.

13. CHILDREN

Our products and websites are not directed specifically at children, and orders should be placed by an adult capable of entering into a contract.

If you believe a child has provided personal information to us inappropriately, contact hello@diffls.com.

14. THIRD-PARTY LINKS

Our websites may link to third-party websites or services. We are not responsible for their privacy practices. You should review the privacy information provided by those third parties.

15. CHANGES TO THIS POLICY

We may update this Privacy Policy when our services, providers or legal obligations change.

The updated version will be published with a revised “Last updated” date. Where appropriate, we may provide additional notice of material changes.

16. CONTACT AND COMPLAINTS

Please contact us first if you have a question or complaint about your personal information:

Email: hello@diffls.com

DIFFLS LTD
Company number: 16285040
Registered in England and Wales
Registered office: Office 5889, 58 Peregrine Road, Ilford, England, IG6 3SZ

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection.