Privacy Policy

This Privacy Policy explains how Marabusu Ltd collects, uses, stores, and protects your personal data when you use our website, place an order, create an account, contact us, or interact with our services.

For privacy questions or requests, contact us at support@marabusu.co.uk.

We may collect the following information:

• name
• email address
• phone number
• billing and shipping address
• order details
• payment status and transaction references
• account login details where you create an account
• customer support messages
• product reviews or wishlist activity
• marketing preferences
• technical information such as IP address, device information, browser type, cookie identifiers, and website usage data

We do not store full card numbers, card security codes, or full payment card details on our own systems.

We use your personal data to:

• process and deliver orders
• take and verify payments
• manage payment status, refunds, and transaction records
• provide customer support
• manage returns, refunds, store credit, and delivery issues
• create and manage customer accounts
• save your wishlist, reviews, addresses, and account preferences
• send order confirmations, delivery updates, refund updates, and service messages
• manage your communication preferences
• prevent fraud, abuse, and security issues
• improve website performance and customer experience
• send marketing emails only where you have opted in or where we are otherwise legally permitted to do so
• comply with legal, tax, accounting, and regulatory obligations

We use your personal data only where we have a lawful basis to do so. This may include:

• Contract - to process your order, deliver goods, manage returns, process payments, and provide customer support.
• Legal obligation - to keep accounting, tax, and business records.
• Legitimate interests - to prevent fraud, secure our website, improve our services, and respond to customer enquiries.
• Consent - for optional marketing emails, website analytics, session replay, and Meta advertising cookies and tracking.

You can withdraw consent at any time where we rely on consent.

Payments are handled by our payment provider, Stripe.

We do not store full card numbers, card security codes, or full payment card details on our own systems. Stripe processes payment information securely in accordance with its own privacy and security standards.

We may store payment status, Stripe transaction references, checkout session references, payment intent references, refund references, and limited payment information needed for order management, refunds, fraud prevention, customer support, and accounting.

We use appropriate technical and organisational safeguards to protect personal data.

We only share personal data where necessary to provide our services, operate our website, or meet legal obligations. This may include sharing data with:

• payment providers, such as Stripe
• website hosting, database, and infrastructure providers, such as Supabase or Vercel
• delivery and courier partners
• email and communication providers
• Google Customer Reviews, for an optional post-purchase survey invitation
• Google Analytics and Vercel, for website usage, shopping and performance measurement when you allow Analytics
• Sentry, for optional session replay when you allow Session Replay, as well as necessary error monitoring
• Meta Platforms (Facebook and Instagram), for advertising measurement and personalised advertising when you allow Marketing
• fraud prevention, security, and error monitoring tools
• accountants, legal advisers, insurers, or regulators where required

We do not sell your personal data.

Google Customer Reviews: where enabled, the confirmation page for a paid order sends Google our Merchant Center ID, your order reference, email address, delivery country and estimated delivery or collection date to display its optional survey invitation. This information is sent when the invitation loads, before you choose Yes or No. If you agree, Google can email you a survey after the estimated receipt date. This is separate from Scent Circle marketing emails, website analytics and our fragrance reviews. Declining the survey does not affect your order. See Google's Privacy Policy.

We use essential cookies required for core website functionality, such as basket, checkout, account login, security, and session management.

Our cookie banner gives you separate choices for Analytics, Session Replay and Marketing. These optional tools start only after you allow the relevant choice; rejecting them does not prevent you from shopping.

Analytics: Google Analytics measures website visits and shopping events, including product views, adds to bag, checkout starts and confirmed purchases. Events may include product details, quantities, prices, an order reference and campaign information. Our Google tag disables advertising personalisation and Google signals. Vercel Analytics and Speed Insights help measure website usage and performance. These tools may receive technical information such as browser, device and network details. We do not deliberately send your name, email, delivery address or payment card details in shopping analytics events.

Session Replay: with this choice enabled, Sentry may replay page interactions to help us diagnose problems. Text and input values are masked in the replay configuration. Replay is separate from necessary error monitoring and is not enabled on personal review-link pages.

Marketing: with this choice enabled, we use the Meta Pixel for Facebook and Instagram advertising measurement and personalised advertising. It sends page views and shopping events such as product views, adds to bag and checkout starts, with relevant product details, values and campaign information. Meta may also receive cookie identifiers and technical information, and may combine this with information it already holds about you. This applies to eligible browsing activity, whether or not you arrived through one of our adverts. The Pixel is blocked on account, login, admin, review and order confirmation pages and URLs with unrecognised query parameters. See Meta's Privacy Policy for how Meta uses information.

Ad sales and subscription measurement: when you allow the current Marketing choice, Marabusu may associate the visit's broad ad source and configured advertising-link ID with your paid order or first Scent Circle email request. We also record approximate device and browser categories (for example, mobile and Instagram's in-app browser) and when you gave consent. For checkout, this optional information passes through Stripe checkout metadata and is saved only after payment is verified. Subscription reporting distinguishes a request from its first email confirmation. Private attribution records reference the order or subscription; our reporting dashboard returns aggregate counts and values, not customer details. We do not send these order or subscription associations to Meta. Refusing this measurement does not affect purchasing or email subscription. A reload, a new visit or another device may lose attribution. Changing your preferences stops new associations, and does not remove records already collected; you can contact us about your data rights.

Aggregate shopping totals: separately, we count daily landing-page visits, product views, adds to bag and checkout starts, grouped by product, broad arrival source such as Instagram or Google, and advertising links we have configured. We distinguish broad landing-page types, whether an add came from a product card or product-page button, and approximate device and in-app browser categories. A campaign tag identifies an advertising link, not a visitor. These counter requests do not send cookies, full page URLs or referrer URLs, and arbitrary campaign text is not stored. The aggregate tables store totals without visitor, account, device or IP identifiers or raw browser headers, so they cannot follow an individual shopper across pages or link a campaign to an individual order. Requests still pass through our hosting and security services, which receive normal network information such as IP addresses for delivery and abuse prevention. These totals also include activity from browsers that reject optional cookies.

Aggregate checkout diagnostics: we also count fixed problem categories reported by the browser, such as an unavailable bag item, a failed availability check, a checkout setup problem or delayed payment confirmation. These daily totals are grouped by broad arrival source, configured advertising link and approximate device and browser category. The diagnostic tables contain no customer details, product or order references, payment data, full URLs, error messages or visitor identifiers. These reports use the same cookie-free counter requests and hosting/security safeguards described above; they do not send diagnostic events to advertising providers.

You can accept or reject all optional choices, or save them separately. Use Cookie Preferences in the footer to change or withdraw consent at any time; this stops future optional tracking for the choices you switch off. It does not undo information already sent to providers. Marketing cookies are separate from subscribing to our marketing emails.

We only send marketing emails where you have opted in or where we are otherwise legally permitted to do so.

You can unsubscribe from marketing emails at any time by:

• using the unsubscribe link in any marketing email;
• updating your communication preferences in your Marabusu account; or
• contacting us at support@marabusu.co.uk.

Service emails, such as order confirmations, delivery updates, refund updates, account messages, and important policy or security notices, are not marketing emails and may still be sent where necessary.

Marketing preference changes may take a short time to update across our systems.

We keep personal data only for as long as needed for the purposes described in this policy.

Order, transaction, refund, store credit, tax, and accounting records may be kept for the period required by law.

Customer support messages, account information, marketing preferences, and technical records are kept only as long as necessary for business, legal, security, and customer service purposes.

When personal data is no longer needed, we will delete, anonymise, or securely retain it where legally required.

Some of our service providers may process data outside the United Kingdom.

Where this happens, we will rely on appropriate safeguards where required by data protection law.

Depending on the circumstances, you may have the right to:

• request access to your personal data
• ask us to correct inaccurate data
• request deletion of your data
• restrict or object to certain processing
• request a copy of your data in a portable format
• withdraw consent where processing is based on consent
• object to direct marketing

To make a request, contact us at support@marabusu.co.uk.

We may need to verify your identity before responding to certain requests.

If you have concerns about how we use your personal data, please contact us first so we can try to resolve the issue.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator.

You can contact the ICO at ico.org.uk or by calling 0303 123 1113.

We may update this Privacy Policy from time to time.

Material changes will be posted on this page with an updated revision date.