This Privacy Policy explains how Hatch Beauty Limited, a company registered in England and Wales under company number 11177047, whose registered office is at 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom, trading as Phase Zero Makeup ("Phase Zero", "we", "us", "our"), collects, uses, shares and protects your personal information.
Hatch Beauty Limited is the data controller for the personal information described in this policy.
It applies when you:
- use phasezeromakeup.com or any country-specific version of it, or any Phase Zero application (the "Site");
- buy from us, whether through the Site or through a marketplace or social commerce channel where we sell;
- sign up for our emails, our mobile messaging programme, our loyalty or creator programmes, or a waitlist;
- interact with our content, adverts or social media accounts; or
- contact our Customer Care team.
It also covers information we hold about suppliers, creators, business contacts and other individuals we deal with.
Please read it alongside our Terms and Conditions.
1. Children
You must be at least 18 to register an account, opt in to our mobile messaging programme, or place an order. The Site is not directed at children and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us their information, email hello@phasezeromakeup.com and we will delete it.
2. Information we collect
| Identity and contact information | Name, title, email address, mobile and other telephone numbers, delivery and billing addresses, date of birth where you provide it. |
| Account and profile information | Username and password, order history, wishlist and saved items, shade and product preferences, responses to our shade finder and surveys, loyalty or rewards status, creator programme details. |
| Transaction information | Products purchased, order value, payment method type, delivery details, returns and refunds, and the last four digits and expiry of a payment card. We do not hold your full card number. |
| Payment information | Payment card and bank details are collected and processed directly by our payment providers. We receive confirmation of payment and limited card metadata, not full card details. |
| Mobile messaging information | Your mobile number, the fact and record of your opt-in and its date, source and wording, message delivery status, opt-out requests, and your replies to our messages. See section 5. |
| Technical information | IP address, device identifiers, browser type and version, operating system, time zone and approximate location derived from IP, language, and login data. |
| Usage information | Pages viewed, products viewed and searched for, time on site, referral source, clicks, cart activity, and how you interact with our emails and messages. |
| Marketing and communications information | Your marketing preferences and consents by channel, and your subscription status. |
| Contact history | Records of your contact with us by email, live chat, web form, social media, telephone or text, including recordings or transcripts where applicable. |
| User content | Reviews, ratings, photographs, videos, competition entries and social posts you submit or tag us in. |
| Social information | Information shared with us if you link a social media account or interact with us on a social platform. |
We do not deliberately collect special category data such as health information. If you tell us about a skin sensitivity or allergy so that we can advise you, we process that information with your consent and only for that purpose.
3. How we collect your information
Directly from you, when you create an account, place an order, join our email or mobile messaging lists, enter a competition or survey, join the tester or creator programme, leave a review, or contact Customer Care.
Automatically, through cookies, pixels, tags, SDKs and server logs as you use the Site. See section 7.
From third parties, including our payment providers, fulfilment partners, marketplaces where you have bought from us, advertising and analytics providers, review platforms, and fraud prevention services.
4. How we use your information and our legal bases
| Purpose | Information used | Legal basis (UK/EU) |
| Processing and delivering your order, taking payment and issuing refunds | Identity and contact, transaction, payment | Performance of a contract |
| Sending service messages such as order confirmations, dispatch and delivery updates, by email or text | Identity and contact, transaction, mobile messaging | Performance of a contract |
| Creating and managing your account | Account and profile, identity and contact | Performance of a contract |
| Providing customer care, handling returns, and responding to your questions | Contact history, transaction, identity and contact | Performance of a contract; legitimate interests |
| Sending marketing by email, text or post | Identity and contact, marketing preferences, profile, mobile messaging | Consent, or legitimate interests where you have bought from us and have not opted out |
| Personalising the Site and our recommendations | Profile, usage, technical | Consent (where cookie-based); legitimate interests |
| Online advertising and measurement | Technical, usage, identity and contact (hashed) | Consent |
| Improving our products, site and service, and understanding customer preferences | Usage, transaction, profile, contact history | Legitimate interests |
| Fraud prevention, security, and verifying identity | Identity and contact, payment, technical, transaction | Legitimate interests; legal obligation |
| Meeting tax, accounting and other legal obligations | Transaction, identity and contact | Legal obligation |
| Establishing, exercising or defending legal claims | Any relevant category | Legitimate interests |
Where we rely on legitimate interests, those interests are running and growing our business, providing an efficient and personalised customer experience, developing our products, preventing fraud and abuse, and keeping our systems secure. We balance those interests against your rights and only proceed where they are not overridden.
5. Mobile information, text messaging and RCS
This section explains how we handle information connected with our SMS, MMS and RCS messaging programme.
We do not sell your mobile information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors who provide support services on our behalf — such as Klaviyo, which sends our messages, and our customer service and fraud prevention providers — is permitted solely so that those services can be delivered to you. All other categories of data sharing described in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
When you opt in, we record your mobile number together with the date, time, source and wording of your consent, and we keep that record for as long as you remain subscribed and for a reasonable period afterwards in order to demonstrate compliance.
We use your mobile number to send you the messages described in section 12 of our Terms and Conditions, including marketing, restock and launch alerts, cart reminders, order and delivery updates, and customer care replies. Where RCS is available on your device and network, we may receive delivery and read receipts and information about your interactions with rich message content, which we use to measure and improve our messaging.
You can opt out at any time by replying STOP to any message, by emailing hello@phasezeromakeup.com, or by updating your preferences in "My Account". Reply HELP for assistance. Message and data rates may apply. Message frequency varies. Consent to receive marketing messages is not a condition of purchase.
6. Who we share your information with
We do not sell your personal information for money. Subject always to the mobile information restriction in section 5, we share personal information with the following categories of recipient so that we can run our business and provide our products and services:
- Ecommerce and hosting platform — Shopify, which hosts our store and processes orders.
- Payment providers — Shopify Payments (powered by Stripe), PayPal, and the other providers displayed at checkout, which process payments and carry out fraud screening.
- Fulfilment, warehousing and delivery partners — including ShipBob and the carriers that deliver your order.
- Marketing and messaging platforms — Klaviyo, which sends our email, SMS and RCS communications on our behalf.
- Advertising and analytics providers — including Meta, Google and TikTok, for measurement and for showing you relevant advertising. See section 7.
- Reviews and user content platforms — which collect and publish reviews on our behalf.
- Marketplaces and sales channels — where you buy from us through them.
- Professional advisers and service providers — including accountants, lawyers, IT and security providers, and agencies working on our behalf.
- Fraud prevention and credit reference agencies — where necessary to prevent and detect fraud.
- Law enforcement, regulators and government bodies — where we are required to disclose information by law, or to protect our rights or the safety of others.
- Acquirers — if we merge with, are acquired by, or reorganise with another business, in which case your information may transfer as part of that transaction.
All service providers act on our instructions under a written contract and may only use your information for the purposes we specify. We may also share aggregated, de-identified information that cannot be used to identify you.
7. Cookies, advertising and tracking
We use cookies and similar technologies — including pixels, tags, web beacons and device identifiers — to run the Site, remember your preferences and basket, measure performance, and deliver and measure advertising.
Advertising cookies allow us and our partners to show you Phase Zero adverts on other websites and apps, including through Meta, Google and TikTok, and to measure whether those adverts led to a visit or purchase. This may involve sharing hashed identifiers, such as an encrypted version of your email address, with those platforms so that they can match activity to an account. Under some laws this counts as "sharing" or "selling" your personal information for advertising purposes, even though no money changes hands.
You can manage cookies through the cookie banner or preferences link on the Site, and through your browser settings. Blocking some cookies will affect how the Site works. For more detail on the specific cookies we use, see our Cookie Policy.
8. International transfers
We are based in the United Kingdom and our customers, suppliers and service providers are located in several countries, including the United States. Your personal information may therefore be transferred to and stored in countries whose data protection laws differ from those of the UK or the European Economic Area.
Where we transfer personal information out of the UK or EEA, we rely on an adequacy decision where one applies, or otherwise put in place appropriate safeguards, normally the UK International Data Transfer Agreement or Addendum, or the European Commission's Standard Contractual Clauses, together with additional measures where needed. You can request a copy of the safeguards we use by emailing hello@phasezeromakeup.com.
9. How long we keep your information
We keep personal information only as long as we need it for the purposes set out in this policy.
- Account information — while your account is open, and for a reasonable period afterwards.
- Order and transaction records — for at least six years from the end of the relevant financial year, to meet UK tax and accounting requirements.
- Marketing and messaging consents and opt-outs — for as long as you are subscribed, and afterwards as needed to honour your opt-out and demonstrate compliance.
- Customer care correspondence — normally for up to three years.
- Cookie and analytics data — for the retention periods set out in our cookie settings.
We may keep information for longer where necessary to resolve a dispute, prevent fraud, or comply with a legal or regulatory obligation.
10. Security
We take appropriate technical and organisational measures to protect your information against unauthorised access, loss, misuse or alteration. These include encryption of data in transit using TLS, access controls, and restricting access to those who need it.
Payments are processed by our payment providers under their own PCI DSS-compliant security arrangements. We do not store full payment card numbers.
Where you have a password for the Site, you are responsible for keeping it confidential. Please do not share it. No system is completely secure, but we will notify you and the relevant regulator where we are legally required to do so following a personal data breach.
11. Your rights — United Kingdom and European Economic Area
If you are in the UK or EEA you have the right to:
- access a copy of the personal information we hold about you;
- have inaccurate information corrected;
- ask us to delete your information where we no longer have grounds to hold it;
- restrict our processing in certain circumstances;
- object to processing based on our legitimate interests, and to object at any time to direct marketing;
- receive certain information in a portable, machine-readable format, or have it transferred to another controller;
- withdraw consent at any time where we rely on consent, without affecting processing carried out before you withdrew it; and
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
To exercise any of these rights, email hello@phasezeromakeup.com. We will respond within one month, and will tell you if we need longer because the request is complex. There is no fee, though we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive. We may ask you to verify your identity first.
12. Your rights — California and other US states
If you are a resident of California, you have rights under the California Consumer Privacy Act as amended by the CPRA. Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have broadly equivalent rights.
These include the right to:
- Know what categories of personal information we have collected, the sources, the purposes, and the categories of third party we disclose it to;
- Access a copy of the specific pieces of personal information we hold about you;
- Delete personal information we hold about you, subject to exceptions;
- Correct inaccurate personal information;
- Opt out of the sale or sharing of your personal information, including sharing for cross-context behavioural advertising;
- Limit the use of sensitive personal information, though we do not use sensitive personal information for purposes requiring this option; and
- Non-discrimination for exercising any of these rights. We will not deny you goods or services, charge you a different price, or provide a different quality of service because you exercised a privacy right.
The categories of personal information we have collected in the past 12 months are those listed in section 2. We collect them from the sources in section 3, for the purposes in section 4, and disclose them to the categories of recipient in section 6.
We do not sell personal information for money, and we do not knowingly sell or share the personal information of consumers under 16. We do share personal information with advertising partners for cross-context behavioural advertising as described in section 7, which is treated as "sharing" under the CPRA.
To opt out of the sale or sharing of your personal information, you can do any of the following:
- adjust your cookie and tracking preferences using the privacy settings available on our Site;
- enable a Global Privacy Control (GPC) signal in your browser or through a browser extension. We treat a GPC signal as a valid opt-out request for the browser and device that sends it, and we action it automatically without requiring you to do anything further; or
- email us at hello@phasezeromakeup.com and we will process your request.
We will action an opt-out request within 15 business days and will not ask you to create an account in order to make one.
You may use an authorised agent to make a request on your behalf, provided you give them written permission and we can verify their authority.
Mobile information: as stated in section 5, we do not share mobile opt-in data or consent with any third party for marketing or promotional purposes, and text messaging originator opt-in data and consent are excluded from all data sharing described in this policy.
13. Marketing preferences
You will receive marketing from us where you have asked for it, or where you have bought from us and have not opted out.
You can stop marketing at any time by:
- updating your preferences in the "My Account" area of the Site;
- clicking "unsubscribe" in any marketing email;
- replying STOP to any text or RCS message; or
- emailing hello@phasezeromakeup.com.
Each channel is managed separately, so unsubscribing from email does not stop text messages, and vice versa. Opting out of marketing will not stop service messages about an order you have placed.
We will obtain your express consent before sharing your personal information with any third party for that third party's own marketing purposes.
14. Links to other sites
Our Site links to sites we do not control, including social media platforms and the sites of our partners. This policy does not apply to them. Please read their privacy policies before providing them with your information.
15. Changes to this policy
We may update this policy from time to time. Any changes will be posted on this page with a revised "Last updated" date, and where the changes are significant we will notify you by email or through the Site. Please check back periodically.
16. How to contact us and how to complain
For any question about this policy, or to exercise your rights:
Hatch Beauty Limited t/a Phase Zero Makeup
27 Old Gloucester Street
London WC1N 3AX
United Kingdom
Email: hello@phasezeromakeup.com
If you are in the UK and are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. If you are in the EEA, you can complain to your national data protection authority. We would appreciate the chance to address your concerns before you approach the regulator.