Legal
Privacy Policy
This policy explains how Home Heatwear Ltd (trading as The Heat Robe) collects and uses your personal data under the UK GDPR and the Data Protection Act 2018.
Who we are
Home Heatwear Ltd is the data controller. Registered in England & Wales, company number 17056715. Contact: returns@theheatrobe.co.uk.
What we collect
- Contact and delivery details: name, delivery address, email, phone number.
- Order details: items purchased, order value, order history.
- Payment information: processed by our checkout provider. We do not see or store your full card details.
- Technical data: IP address, device and browser type, pages viewed (through analytics cookies where enabled).
How we use your data
- To process and fulfil your order (contract).
- To handle customer service, returns and warranty claims (contract / legitimate interests).
- To meet legal obligations such as tax and consumer law (legal obligation).
- To improve the site and, with your consent, send marketing emails you can unsubscribe from at any time (consent).
Who we share it with
- Our payment provider, to take payment securely.
- Delivery couriers, to ship your order.
- Shopify, our ecommerce and checkout provider. Your basket and order are processed on Shopify's systems, and payment is completed on a Shopify-hosted checkout page.
- Judge.me, our product review platform and processor. Where a review request is sent after purchase, the order and contact details needed to send it may be shared with Judge.me for that purpose only. If you choose to leave a review, the public name you provide and your review content may be displayed on our site. Retention and your data rights remain governed by this policy together with Judge.me's processor terms. See our Reviews Policy.
- Google (Google Analytics 4), our website analytics provider, but only where you have given analytics consent.
- Our email provider, acting as a processor on our behalf.
Google Analytics data may be processed outside the UK. Where that happens, transfers rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses together with Google's contractual data-protection terms. We use Google Analytics in its IP-anonymised configuration and do not use it for advertising or ad personalisation.
How long we keep it
Order and accounting records are kept for 6 years to meet UK tax rules. Marketing contact details are kept until you unsubscribe. Support enquiries are kept for up to 2 years.
Cookies and similar storage
We use strictly necessary cookies and browser storage to run the shop and, where you consent, Google Analytics cookies and first-party campaign-attribution storage to understand how the site is used and where visits came from. Analytics cookies and campaign-attribution storage are only set after you accept them. If you reject, the Google Analytics script is never loaded. If you withdraw consent after accepting, analytics collection stops and the Google Analytics cookies and attribution storage are deleted, although the script already downloaded in that page may stay in the browser’s memory until you reload or leave the page. Manage your choice at any time from the "Cookie settings" link in the footer. Our lawful basis for analytics is your consent.
| Name | Purpose | Category | Duration |
|---|---|---|---|
hr_consent | Stores your cookie preferences so we don't ask again. | Strictly necessary | 6 months |
heat-robe-cart (browser local storage, not a cookie) | Remembers items in your shopping bag between visits. | Strictly necessary | Until cleared by you or your browser |
thr-email-capture (browser local storage) | Records that you have already seen or used the discount email form, so we don’t show it again. If you submitted the form, the email address you entered is stored in this value in your own browser; it is not sent to us by this storefront. | Strictly necessary | Until cleared by you or your browser |
hr_attr_first / hr_attr_last (browser session and local storage) | Remembers which campaign or link brought you to the site, so the resulting order is credited correctly. Contains campaign labels and the referring website only — never personal details. Only written after you accept analytics cookies; before that the information is held in the page's memory for the current visit and is deleted again if you withdraw consent. | Analytics (consent only) | Session storage: until you close the browser tab. Local storage: until cleared by you or your browser |
_ga | Google Analytics — distinguishes visitors so we can count visits and see how the site is used. | Analytics (consent only) | 2 years |
_ga_<container> | Google Analytics — maintains the analytics session state. | Analytics (consent only) | 2 years |
The _ga cookies above are only created after you accept analytics cookies. If you separately accept advertising measurement, this storefront loads OpenAI's ChatGPT Ads Measurement Pixel, which sets the first-party __oppref cookie (an opaque ad-click reference, up to 30 days) and __obref cookie (a random browser reference, up to 365 days) and reports page, product, add-to-bag and checkout-start events so we can measure whether ads in ChatGPT led to visits and purchases. Where OpenAI's automatic advanced matching is enabled for our account, the Pixel may detect contact details entered on the site and send them to OpenAI as SHA-256 hashes rather than in plain text; hashed data is still personal data and is not anonymous. With advertising consent, those two references are also attached to your basket as hidden details so they reach the resulting Shopify order. If you withdraw advertising consent, the Pixel is told to stop, its cookies are deleted and the references are removed from your basket. Advertising measurement is never enabled by accepting analytics alone, and Google's advertising features, ad personalisation and ad data sharing remain switched off.
Checkout takes place on a Shopify-hosted page on a different address. Shopify sets its own cookies there to run the basket, checkout and fraud prevention. The analytics and advertising measurement choices you make in this site's banner are passed securely to Shopify checkout through Shopify's own consent mechanism, so you are not asked again there; if you have not chosen, all optional purposes are treated as declined. Changing your choice here applies to your next checkout. Shopify's handling is described in its own privacy and cookie notices. If you have accepted advertising measurement and arrived with an ad-click reference, a completed purchase is reported to OpenAI for ad measurement: the order total and currency, the opaque ad-click reference and a random event reference are sent, with no customer or order identifiers included in the request. Advertising measurement is not an email or marketing subscription.
Your rights
You have the right to access, rectify, erase, restrict or object to processing of your personal data, and the right to data portability. To exercise any of these, email returns@theheatrobe.co.uk.
You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.