UK GDPR / Data (Use and Access) Act 2025 — reflecting changes in force from 5 February 2026
Who we are
Urban Merchants Ltd (“we”, “us”, “our”) is a UK-based gourmet food and wine retailer. We are the data controller for personal information collected through urbanmerchants.co.uk and our related services (B2B portal, marketing communications, customer support).
For customers based in the EU, purchases made via our EU storefront are subject to EU GDPR; UK customers are subject to UK GDPR as described in this policy.
What information we collect
- Account & order data: name, delivery/billing address, email, phone number, order history.
- Payment data: processed via our payment provider; we do not store full card details.
- Marketing data: email address and preferences if you opt in to our newsletter or “Join the Club.”
- Website usage data: via cookies and analytics (see Section 6).
- Customer service data: any information you provide when contacting us.
Why we process your data (lawful basis)
| Purpose | Lawful basis |
|---|---|
| Fulfilling and delivering your order | Contract |
| Responding to enquiries | Contract / legitimate interests |
| Sending marketing emails (with consent) | Consent |
| Fraud prevention and security | Legal obligation / legitimate interests |
| Improving our website and services | Legitimate interests |
New in 2026 — Recognised Legitimate Interests:
The Data (Use and Access) Act 2025 introduced a limited, defined list of purposes (e.g. safeguarding, crime prevention, national security) where organisations can rely on a “recognised legitimate interest” without a full balancing test. This is unlikely to apply to Urban Merchants’ day-to-day retail processing, but we note it here for completeness and will update this section if it becomes relevant (e.g. fraud detection).
Information from other sources
We may also receive personal information about you from various third parties that we engage in order to assist us with providing products and/or services to you, including:
- delivery and address information from our carriers who deliver products to you;
- information on your account, payment and credit history, including information from credit bureaus and sources we use to process payments.
If we request that you do so and you fail to provide information to us, we may be prevented from exercising our rights and obligation and, in particular, we may be prevented from providing the products and/or services that you have asked us to provide. For example, if you fail to provide us with your full address details, it may not be possible for us to fulfil your delivery, or if you fail to provide us with your payment details then we will not be able to process payments for our products and cannot therefore supply them to you.
How we use your personal information
We use your personal information for the following purposes:
- to register you as a new customer;
- to respond to your enquiries and complaints, and to manage our relationship with you;
- to handle orders, deliver items and process payments;
- to communicate with you about updates, orders, products, services and promotional offers;
- to update our records and maintain any online account you may have with us;
- to administer and protect our business and this site, including to prevent or detect fraud or abuses of our Website;
- for market research, reporting, analysis and modelling so as to improve the products and services we provide;
- to comply with our financial record keeping obligations;
- to use data analytics to improve our website, products, services and user experiences; and
- to enable third parties to carry out technical, logistical or other functions on our behalf.
By law, when processing your personal information we are required to have a ‘legal basis’ to do so. A legal basis is essentially a legal justification for processing your personal information. The legal basis we use to process your personal information will generally be one or more of the following:
- to enable us to perform the contracts that we have with you to supply you with products and/or services;
- where it is necessary for our legitimate interests in administering and managing our relationship with you, providing you with products and/or services, and running our business lawfully and effectively; or
- to enable us to comply with a legal or regulatory obligation.
Sometimes we may ask for your consent to use your information for particular purposes (e.g. to send you marketing communications). Where we do so, this consent will be our legal basis for our use of the information. You can withdraw your consent at any time and we will then stop processing your information for that purpose. If you wish to withdraw your consent, then please contact us using the details at the end of this notice.
For more information on the specific legal basis we are relying on in relation to any of the individual processing activities we have highlighted above, please contact us using the contact details at the end of this notice.
How do we use your personal information for marketing purposes?
If you are an existing customer or you have consented to receiving marketing communications by [email, web or text] we may send you information on any offers, events or news about our products and/or services that we believe may be of interest to you. Please note, if you do not choose to receive this information, we will be unable to keep you informed of any offers, events or news regarding our products and services.
We may also send you information on any offers, events or news about our products and/or services that we believe may be of interest to you by post.
If you agree to us doing so, we may also use Google Customer Match. This service matches a list of email addresses we hold to users signed in with Google in order to allow the display of personalised advertising on your internet browser.
You can ask us to stop sending you marketing messages (whether by email, web, text or post) or using Google Customer Match at any time by sending a request to info@urbanmerchants.co.uk
Automated decision-making
We do not currently use fully automated decision-making that produces legal or similarly significant effects on customers. If this changes (e.g. automated fraud-risk scoring at checkout), we will update this policy to reflect the reformed rules on automated decision-making introduced by the 2025 Act, including your right to request human review.
When do we share your personal information?
We only share your personal information with our other offices, our agents or third parties where necessary so that they can assist us in providing products and/or services to you.
Where we share your personal information with third parties who process your information on our behalf, they will only process your information on our instructions and we will remain responsible for ensuring that it is protected and processed lawfully.
Where we share your personal information with third parties who process it for their own purposes (such as government bodies), those third parties will have their own legal obligations to protect your information and you will have legal rights that you can enforce directly against them.
In particular, we may share your personal information with third parties for the following purposes:
- we may need to share your personal information to other companies who we engage to perform functions on our behalf including; fulfilling orders, delivering packages, sending customer communications, analysing data, processing payments and providing customer services. They will have access to personal information needed to perform their functions, but may not use it for other purposes
- if we sell, transfer or merge parts of our business or our assets, or seek to acquire another business or merge with them, we may share your personal information with the other party to the transaction;
- where it is necessary to prevent fraud or reduce credit risk, we may share your personal information with other companies and organisations; and
- where requested or if we consider that it is reasonably required, we may share your personal information with government bodies, regulatory bodies or law enforcement organisations so that they can carry out their legal functions.
In some circumstances, you will receive notice before we share your personal information with third parties and you will have the opportunity to choose not to share your information.If you would like further information about the third parties with whom we share your personal information then please contact us on the details at the end of this notice.
How do we use cookies?
A cookie is a text-only string of information that a website transfers to the cookie file of the browser on your computer’s hard disk so that the website can remember who you are. A cookie will typically contain the name of the domain from which the cookie has come, the ‘lifetime’ of the cookie, and a value, usually a randomly generated unique number. When you visit our Website we send you a cookie.
We use cookies for:
- Essential site functionality (cart, checkout, account login)
- Analytics (to understand site usage and improve the shopping experience)
- Marketing (if you’ve opted in)
Change in 2026:
Certain low-risk analytics cookies may now qualify for a consent exemption under the updated rules. We will only rely on this exemption where the ICO’s guidance confirms it applies, and essential/marketing cookies will continue to require your consent as before.
The cookies we use are set out in the table below.
| Purpose | Provider | Expiry | Cookie |
| Statistics | |||
| Registers a unique ID that is used to generate statistical data on how the visitor uses the website. | Google Analytics | 2 years | _ga |
| Used by Google Analytics to throttle request rate. | Google Analytics | Session | _gat |
| Registers a unique ID that is used to generate statistical data on how the visitor uses the website. | Google Analytics | Session | _gid |
| Marketing | |||
| Used by the social networking service, LinkedIn, for tracking the use of embedded services. | 2 years | bcookie | |
| Used by the social networking service, LinkedIn, for tracking the use of embedded services. | 2 years | bscookie | |
| Registers a unique ID on mobile devices to enable tracking based on geographical GPS location. | YouTube | Session | GPS |
| Used by Facebook to register impressions on pages with the Facebook login button. | Session | impression.php/# | |
| Used by the social networking service, LinkedIn, for tracking the use of embedded services. | Session | lidc | |
| Registers a unique ID that identifies a returning user’s device. The ID is used for targeted ads. | 6 months | NID | |
| Tries to estimate the users’ bandwidth on pages with integrated YouTube videos. | YouTube | 179 days | VISITOR_INFO1_LIVE |
| Registers a unique ID to keep statistics of what videos from YouTube the user has seen. | YouTube | Session | YSC |
| Generic | |||
| Implied Consent EU Cookie and Privacy Update Notice | urbanmerchants.co.uk | 1 year | um_pp_notice_accepted |
You can accept or decline ‘cookies’ by modifying the setting in your browser. Please note that if you disable ‘cookies’ you may not be able to use all the features of our Website.
How do we keep your information secure?
We employ security measures to prevent unauthorised access to information that we collect online and through POS. We use a secure online order form for all purchases made via the Website. All data transmitted via this form (including credit card details) is 128bit encrypted so it is transmitted securely. To verify this, when placing an order using the Website a padlock will appear in your browser. It is normally in the status bar, towards the right hand side, in the address bar of your browser window. You can double-click this padlock to verify that the secure certificate has been issued to the Website.
Our security is certified by the certificate provider “Let’s Encrypt”
Please note that email correspondence with us is in free format text and cannot be encrypted. Accordingly please do not send any sensitive information such as credit card details or passwords via email.
We use computer safeguards such as firewalls and data encryption, and we enforce physical access controls to our buildings and files to keep this data safe. We only authorise access to employees who need it to carry out their job responsibilities.
International transfers (UK & EU)
Because Urban Merchants operates both a UK site and an EU-facing site, personal data may be transferred between the UK and EU. This is currently permitted without additional safeguards, as the European Commission renewed its UK “adequacy decision” in December 2025 (valid until December 2031), meaning the EU recognises UK data protection law as providing equivalent protection.
Data retention
We retain order and account data for as long as necessary to fulfil orders, meet tax/accounting obligations, and handle any disputes, after which it is securely deleted or anonymised.
Details of the retention period for different aspects of your personal information are available in our data retention policy, detailed in the table below and covering all key databases held by Urban Merchants Ltd.
| Ref | Type of Data | Details | Purpose of data | Review Period | Retention Period or Criteria |
| 1 | Personal Details | Eg Name, Address, Title, Gender | To support email and whitemail marketing, customer reporting and analytics | 12 months | 5 years |
| 2 | Contact Details | Eg Billing Address, Delivery address, email address and phone number | To support email marketing & customer reporting | 12 months | 5 years |
| 3 | Image Data | Eg CCTV images, photographs if taken during an event and you have not objected to this | For security and PR | 12 months | 5 years |
| 4 | Financial | Eg Payment card details | To provide financial information with regard to purchases as well as to support fraud prevention | 12 months | 7 years |
| 5 | Transactional Data | Eg order information, product purchased, total cost, payment information, billing and delivery information | To support transactional queries, customer and product reporting & analytics | 36 months | 7 years |
| 6 | Technical Data | Eg Internet Protocol (IP) address, login data, browser type and version, time-zone setting and location, browser plug-in types and versions, operating system and platform and other technology devices used to access the website, geographical location, length of visit, number of pages viewed | To support online reporting & analytics as well as operational information | 12 months | 5 years |
| 7 | Profile Data | Eg Order history, preferences, feedback on survey and response, | To support reporting, analytics and personalisation of marketing activity | 12 months | 5 years |
| 8 | Marketing Data | Eg Preferences in receiving marketing and communications | To support marketing activity | 12 months | 3 years |
| 9 | Instore Data | Eg products purchased, amount spent, payment information | To support transactional queries, customer and product reporting & analytics | 12 months | 7 years |
Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion (“right to be forgotten”)
- Object to processing based on legitimate interests or for direct marketing
- Data portability
- Withdraw consent at any time (for marketing)
Subject Access Requests (SARs):
We aim to respond within one calendar month. Under the reformed rules in force from February 2026, the response clock may be paused (“stop-the-clock”) while we reasonably request further information to confirm your identity or clarify the scope of your request.
Contact us
For any privacy queries or to exercise your rights, contact:
Address: Urban Merchants Ltd, 29 West Market Building, Smithfield, London EC1A 9PS
Email: contact@urbanmerchants.co.uk
Changes to this policy
We will update this policy as UK data protection law continues to evolve under the Data (Use and Access) Act 2025 commencement schedule. Last reviewed: July 2026.