Privacy Policy

Last updated: 25 September 2026

This Privacy Policy explains how Little Ones (“Little Ones”, “we”, “us” or “our”) collects, uses, stores and shares your personal data when you visit our website, use our services, make a purchase, communicate with us or otherwise interact with Little Ones (together, the “Services”).

For the purposes of this Privacy Policy, “you” and “your” refer to you as a user of our Services, whether you are a customer, website visitor or another individual whose personal data we process.

Depending on where you are located, our processing of personal data may be governed by applicable privacy and data protection laws, including:

• the General Data Protection Regulation (EU) 2016/679 (“EU GDPR”);

• applicable Dutch data protection and electronic communications legislation;

• the United Kingdom General Data Protection Regulation (“UK GDPR”);

• the UK Data Protection Act 2018;

• the Privacy and Electronic Communications Regulations 2003 (“PECR”); and

• the Data (Use and Access) Act 2025, where applicable.

Please read this Privacy Policy carefully.

1. Who Is Responsible for Your Personal Data?

Little Ones is the controller responsible for the personal data described in this Privacy Policy, unless otherwise stated.

Our contact details can be found at the end of this Privacy Policy.

Where required under applicable data protection law, we may appoint a representative in the United Kingdom or another relevant jurisdiction.

2. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our business, Services, technologies, legal requirements or privacy practices.

When we make changes, we will publish the updated Privacy Policy on our website and change the “Last updated” date at the top of this page.

Where required by law, we may also take additional steps to inform you of significant changes.

3. Personal Data We Collect

The personal data we collect depends on how you interact with Little Ones and our Services.

Information You Provide Directly

When you use our Services, place an order, create an account or contact us, we may collect information including:

• your name;

• email address;

• telephone number;

• billing address;

• delivery address;

• order information;

• purchase history;

• payment confirmation and transaction information;

• account information and login details, where applicable;

• returns, refunds and exchange information;

• customer service communications;

• marketing preferences; and

• any other information you choose to provide to us.

Certain information is necessary for us to process and fulfil your order.

If you do not provide information that is required to enter into or perform a contract with you, we may not be able to provide the relevant product or Service.

4. Information We Collect Automatically

When you visit or use our website, certain information may be collected automatically.

This may include:

• your IP address;

• browser type;

• device type;

• operating system;

• network information;

• pages viewed;

• referring website or URL;

• interactions with our website;

• approximate location derived from technical information such as your IP address;

• cookie identifiers; and

• other information about how you interact with our Services.

We may collect this information using cookies, pixels, tags and similar technologies.

Where consent is required by applicable law, non-essential tracking technologies will not be activated until you have provided the required consent.

5. Information We Receive from Third Parties

We may receive personal data from third parties that help us operate our business and provide our Services.

These may include:

Shopify

Our online store is operated using Shopify.

Shopify processes certain personal data in connection with the operation of our online store, checkout, account features, fraud prevention and other Shopify functionality.

Shopify may act as our processor in certain circumstances and may process personal data for its own purposes in other circumstances.

Payment Providers

Our payment providers process information necessary to complete payments.

Depending on the payment method you choose, this may include:

• payment card information;

• bank information;

• billing information;

• transaction information; and

• payment authentication information.

Complete payment card or banking information is generally processed directly by the relevant payment provider rather than stored by Little Ones.

Shipping and Fulfilment Providers

We may receive and share information with delivery, logistics and fulfilment providers where necessary to process and deliver orders.

Analytics, Advertising and Marketing Providers

Subject to applicable consent requirements, we may receive information from analytics, social media, advertising and marketing providers.

This information may help us:

• understand how our website is used;

• measure advertising performance;

• improve our Services;

• understand customer preferences; and

• show more relevant advertising.

6. How and Why We Use Your Personal Data

We only process personal data where we have an appropriate legal basis.

Depending on the circumstances, this may include:

• performance of a contract;

• compliance with a legal obligation;

• our legitimate interests;

• your consent; or

• another lawful basis permitted under applicable law.

Orders and Purchases

We use personal data to:

• process purchases;

• process payments;

• confirm orders;

• fulfil orders;

• arrange delivery;

• provide delivery updates;

• manage returns;

• manage exchanges;

• process refunds; and

• communicate with you about your purchase.

Our primary legal basis for this processing is the performance of our contract with you.

Customer Service

We process personal data to:

• respond to questions;

• deal with customer service requests;

• handle returns and complaints;

• resolve problems; and

• communicate with you about our Services.

Depending on the circumstances, this processing may be necessary to perform our contract with you or may be based on our legitimate interests in providing effective customer service.

Business Administration and Legal Obligations

We may process personal data to:

• maintain accounting and tax records;

• comply with legal obligations;

• manage our business;

• establish, exercise or defend legal claims;

• respond to lawful requests from authorities; and

• comply with regulatory requirements.

The applicable legal basis may be compliance with a legal obligation or our legitimate interests.

Security and Fraud Prevention

We may process personal data to identify, prevent, investigate or address:

• fraud;

• suspicious transactions;

• security incidents;

• abuse of our Services;

• illegal activities; and

• other threats to Little Ones, our customers or third parties.

We generally rely on our legitimate interests in protecting our customers, Services and business.

7. Marketing Communications

We may send you promotional emails, SMS messages or other direct marketing communications where this is permitted by applicable law.

European Union and Netherlands

Where prior consent is required under European or Dutch law, we will obtain your consent before sending electronic direct marketing.

Where applicable law permits us to contact existing customers about our own similar products or services without obtaining separate consent, we may do so provided you were given an appropriate opportunity to object or opt out.

United Kingdom

For customers in the United Kingdom, we comply with the UK GDPR and PECR.

We generally send electronic marketing to individuals where:

• you have given us valid consent; or

• the applicable existing-customer or “soft opt-in” exception applies.

Where we rely on the soft opt-in, this generally means that:

• we obtained your contact details during the sale or negotiation of a sale of our products or services;

• the marketing concerns our own similar products or services;

• you were given a clear opportunity to opt out when your details were collected; and

• you are given a clear opportunity to unsubscribe in each subsequent marketing message.

Where permitted under applicable UK data protection legislation, our processing of personal data for direct marketing may also be based on legitimate interests. This does not override any separate consent requirements under PECR.

Unsubscribing

You can unsubscribe from marketing communications at any time by using the unsubscribe link contained in our emails or by contacting us.

If you unsubscribe from marketing, we may still send you non-marketing communications, including messages relating to:

• orders;

• payments;

• deliveries;

• returns;

• refunds;

• security;

• your account; or

• customer service requests.

8. Cookies and Similar Technologies

We use cookies and similar technologies to operate our website and provide our Services.

Cookies may be used for purposes including:

• enabling essential website functionality;

• remembering your shopping cart;

• maintaining website security;

• remembering your preferences;

• analysing website performance;

• understanding how visitors use our website;

• measuring marketing performance; and

• providing personalised advertising.

Strictly Necessary Cookies

Certain cookies and similar technologies are necessary for our website to function.

Where permitted by applicable law, these technologies may be used without your consent.

Analytics, Advertising and Other Non-Essential Technologies

Where applicable law requires consent, analytics, advertising, tracking or other non-essential technologies will only be activated after you have provided valid consent.

You can accept, reject or manage these technologies through our cookie banner or cookie settings.

You can withdraw or change your consent at any time.

For users in the United Kingdom, certain limited storage or access technologies may qualify for an exemption from consent under PECR and applicable UK legislation.

Where such an exemption applies, we will only rely on it where the relevant legal requirements are satisfied.

We will not treat continued use of our website by itself as consent where positive consent is required.

9. Personalised Advertising

Where you consent to advertising or tracking technologies, we and our advertising partners may use certain information about your activity to provide or measure personalised advertising.

This may include information relating to:

• pages viewed;

• products viewed;

• purchases;

• advertising interactions;

• device identifiers; and

• cookie identifiers.

Where applicable law requires consent for these activities, we will request your consent before carrying them out.

You can change your advertising and cookie preferences through our cookie settings.

10. How We Share Personal Data

We may share personal data where necessary with third parties including:

• Shopify;

• payment processors;

• payment providers;

• shipping companies;

• fulfilment providers;

• logistics providers;

• IT and hosting providers;

• cloud service providers;

• customer support providers;

• analytics providers;

• advertising and marketing providers;

• accountants;

• auditors;

• legal advisers;

• insurers;

• regulators;

• public authorities; and

• law enforcement agencies where legally required.

We may also disclose personal data in connection with:

• a merger;

• acquisition;

• financing;

• restructuring;

• insolvency;

• sale of assets; or

• sale or transfer of all or part of our business.

Third parties may act as processors acting on our instructions or as independent controllers responsible for their own use of personal data.

We do not disclose personal data unless there is a lawful reason for doing so.

11. International Transfers

Because we work with international technology, payment, logistics and other service providers, personal data may be transferred to or processed in countries outside your country of residence.

European Economic Area

Where personal data protected by the EU GDPR is transferred outside the European Economic Area (“EEA”), we use a legally recognised transfer mechanism where required.

This may include:

• an adequacy decision;

• European Commission Standard Contractual Clauses;

• Binding Corporate Rules; or

• another legally permitted transfer mechanism.

Where required, additional safeguards may also be implemented.

United Kingdom

Where personal data protected by the UK GDPR is subject to a restricted transfer outside the United Kingdom, we use an appropriate transfer mechanism where required.

This may include:

• UK adequacy regulations;

• the UK International Data Transfer Agreement (“IDTA”);

• the UK Addendum to the European Commission Standard Contractual Clauses; or

• another transfer mechanism recognised under UK data protection law.

You may contact us for additional information regarding the safeguards used for international transfers where you have a legal right to receive such information.

12. Data Retention

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, unless a longer retention period is required or permitted by law.

When determining retention periods, we consider factors including:

• the nature of the information;

• the reason it was collected;

• our contractual obligations;

• applicable tax and accounting obligations;

• potential legal claims;

• fraud-prevention requirements;

• security requirements; and

• applicable statutory retention periods.

For example, order, invoice and transaction information may need to be retained for the period required by applicable accounting and tax laws.

Marketing information may be retained until you withdraw your consent, unsubscribe or otherwise object, subject to limited information we may retain to ensure that your opt-out preference continues to be respected.

When information is no longer required, we will delete, anonymise or otherwise securely dispose of it where appropriate.

13. Security

We use appropriate technical and organisational measures designed to protect personal data against:

• unauthorised access;

• accidental loss;

• destruction;

• alteration;

• misuse; and

• unlawful disclosure.

However, no method of electronic transmission or storage can be guaranteed to be completely secure.

If you create an account with us, you are responsible for keeping your login details and password confidential.

If you believe your account or personal information has been compromised, please contact us as soon as possible.

14. Children

Little Ones sells products intended for babies and children. However, our website, checkout and purchasing Services are intended to be used by adults.

We do not intentionally collect personal data directly from children where parental or guardian consent would be required by applicable law.

If you are a parent or legal guardian and believe that a child has provided personal data to us improperly, please contact us so that we can investigate and, where appropriate, delete the information.

Where UK data protection legislation requires us to consider the particular needs and rights of children in connection with an online service likely to be accessed by children, we will take those obligations into account.

15. Your Privacy Rights

Depending on the applicable law and your circumstances, you may have the following rights.

Right to Be Informed

You have the right to receive information about how we collect and use your personal data.

Right of Access

You may request confirmation of whether we process your personal data and request a copy of personal data we hold about you.

Right to Rectification

You may ask us to correct personal data that is inaccurate or complete data that is incomplete.

Right to Erasure

In certain circumstances, you may ask us to delete your personal data.

The right to erasure is not absolute. We may retain information where there is a lawful reason or legal obligation to do so.

Right to Restriction

In certain circumstances, you may ask us to restrict how we process your personal data.

Right to Data Portability

Where applicable, you may request certain personal data in a structured, commonly used and machine-readable format or request its transfer to another controller.

Right to Object

Where processing is based on legitimate interests, you may have the right to object based on your particular circumstances.

You have the right to object at any time to the processing of your personal data for direct marketing purposes.

If you object to direct marketing, we will stop processing your personal data for that purpose.

Right to Withdraw Consent

Where we rely on your consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing that took place before your consent was withdrawn.

Automated Decision-Making

You may have rights in relation to certain decisions made solely through automated processing that have legal or similarly significant effects on you.

Little Ones does not currently intend to make solely automated decisions about customers that produce legal or similarly significant effects unless we clearly inform you otherwise.

16. Exercising Your Rights

You can exercise your privacy rights by contacting us using the details provided below.

We may need to request information from you to verify your identity before fulfilling certain requests.

We will respond within the time period required by applicable law.

For requests made under the EU GDPR or UK GDPR, this will generally be within one month, subject to any lawful extension.

There is normally no fee for exercising your data protection rights. However, applicable law may permit a reasonable fee or allow us to refuse a request in limited circumstances, for example where a request is manifestly unfounded or excessive.

17. Privacy Complaints

If you have a concern or complaint about how Little Ones processes your personal data, you can contact us using the contact details below.

We will investigate privacy complaints appropriately.

United Kingdom

Where UK data protection law applies, we maintain a process for handling data protection complaints in accordance with applicable UK requirements.

We will:

• provide an appropriate way for you to raise a data protection complaint;

• acknowledge receipt of the complaint within 30 days;

• take appropriate steps to investigate the complaint;

• keep you appropriately informed about its progress; and

• communicate the outcome without undue delay.

You also have the right to raise a complaint with the UK supervisory authority:

Information Commissioner’s Office (ICO)
United Kingdom

European Union / Netherlands

If you are located in the European Economic Area, you also have the right to lodge a complaint with the competent data protection supervisory authority.

For Little Ones in the Netherlands, the relevant supervisory authority is:

Autoriteit Persoonsgegevens
Dutch Data Protection Authority

You may also be entitled to complain to the supervisory authority in the EEA country where you live, work or where the alleged infringement occurred.

18. Third-Party Websites

Our website may contain links to websites, applications or online services operated by third parties.

Little Ones is not responsible for the privacy, security or content practices of third-party websites.

If you follow a link to another website, we recommend reviewing that website's privacy information before providing personal data.

The inclusion of a third-party link does not necessarily mean that Little Ones endorses that third party or its services.

19. UK Representative

If Little Ones is required under Article 27 of the UK GDPR to appoint a representative in the United Kingdom, the contact details of that representative will be made available in this Privacy Policy or otherwise in an easily accessible manner.

20. Contact Us

If you have questions about:

• this Privacy Policy;

• how Little Ones uses your personal data;

• your privacy rights;

• a privacy complaint; or

• another data protection matter,

you can contact us at:

Little Ones
Email: info@littleones.co.uk
Legal entity: Little Ones, Rotterdam (NL)
Chamber of Commerce (KvK) number: 94694958

Where applicable, additional contact details for a UK representative or Data Protection Officer will also be provided.