Privacy Policy
Last updated: 7 October 2026
We use your personal data to take and deliver your order and to look after you as a customer, and we only send marketing emails if you agree.
Who we are
HydraSpa Ltd, trading as TheDeepSoak, is the controller of your personal data. We are a private limited company registered in England and Wales, company number 16488108. Our registered office is 85 Great Portland Street, First Floor, London, W1W 7LT, United Kingdom.
We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For any privacy question, email team@thedeepsoak.com.
The data we collect
- Your name, email address and phone number.
- Your delivery and billing addresses.
- Your order details, such as products, prices and delivery option.
- Payment status, such as whether a payment was successful. We never see or store your full card number.
- Messages you send us and our replies.
- Device and browser data on our checkout pages, such as IP address, browser type and pages visited.
We collect this data from you when you place an order or contact us, and automatically when you use our checkout.
Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Taking payment, processing and delivering your order | Contract |
| Sending order confirmations, dispatch and tracking emails | Contract |
| Handling cancellations, returns, refunds and guarantee claims | Contract and legal obligation |
| Answering your questions and complaints | Contract and legitimate interests |
| Keeping accounting and tax records | Legal obligation |
| Preventing fraud and keeping our checkout secure | Legitimate interests |
| Measuring and improving our website and advertising | Consent, where required, otherwise legitimate interests |
| Sending marketing emails | Consent |
Where we rely on legitimate interests, we have weighed our interests against your rights. You can object at any time.
Who we share it with
We share your data only with service providers who help us run our business. They act on our instructions and must keep your data secure.
- Our e-commerce platform (Shopify), which hosts our checkout and stores order records.
- Payment providers: our card processor and PayPal, to take payment and prevent fraud. If you use PayPal Pay in 3, PayPal handles your application under its own privacy notice.
- Email service (Klaviyo), to send order emails and, only if you have agreed, marketing emails.
- Meta, for advertising measurement on our checkout, only where permitted by your cookie choices.
- Cloudflare, which hosts this website.
- Our fulfilment partner and couriers, to pack and deliver your order. They receive your name, delivery address, and contact details needed for delivery.
- Professional advisers and authorities, such as our accountants, or HMRC and law enforcement where the law requires it.
We do not sell your personal data.
International transfers
Some of our providers store or process data outside the UK. When this happens, we make sure your data is protected. We rely on UK adequacy regulations, or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
How long we keep it
| Data | How long |
|---|---|
| Order and accounting records | 6 years, as required by HMRC |
| Marketing email list | Until you unsubscribe |
| Customer service emails | 2 years from our last contact |
Marketing emails
We only send marketing emails if you have agreed to receive them. You can unsubscribe at any time using the link in any email, or by emailing us. Order and service emails are not marketing and will still be sent.
Your rights
You have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected (rectification);
- have your data deleted (erasure);
- restrict how we use your data;
- object to how we use your data;
- receive your data in a portable format (portability);
- withdraw your consent at any time, where we rely on consent.
To use any of these rights, email team@thedeepsoak.com. We will reply within one month. We may need to confirm your identity first. Some rights have limits, for example we must keep order records for tax purposes.
Automated decisions
We do not make decisions about you using only automated means that have a legal or similarly significant effect on you. Our payment providers may use automated checks to prevent fraud.
Security
We use trusted providers and appropriate technical and organisational measures to protect your data. Card payments are handled by our payment provider. We never see or store your full card number.
Children
Our website and products are not intended for anyone under 18. We do not knowingly collect data from children.
Cookies
For information about cookies, see our Cookie Policy.
Complaints
If you are unhappy with how we use your data, please contact us first and we will try to put it right.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk, telephone 0303 123 1113.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed.