Privacy Policy
Privacy Policy
Last updated on 5 August 2026.
1. Who we are
We are Esska Shoes Limited ("us/we") and we control the Esska website.
We are an English company with registered company number: 05825485 and our registered office is at Esska, Unit 7 Roslin Square, Roslin Road, London, England, W3 8DH.
We are the data controller responsible for your personal information and we are registered at the UK Information Commissioner's Office with registration number ZA868604.
The following laws apply to the protection of your personal data when you shop on our website or contact us, depending on where you live:
• United Kingdom: the UK GDPR as defined in the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019, the Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003.
• European Union: Regulation (EU) 2016/679 (the General Data Protection Regulation) and any applicable local laws.
• United States (California): the California Consumer Privacy Act (CCPA).
• Canada: the Personal Information Protection and Electronic Documents Act (PIPEDA).
• Australia: the Australian Privacy Principles (APPs) under the Privacy Act 1988.
• Any other country: the applicable data protection laws and regulations in your country of residence.
2. About this policy
This Privacy Policy explains what personal data we collect about you when you shop, browse, or otherwise contact us, why we collect it, how we use and protect it, who we share it with, and the rights you have over it. It applies to our website, our store, and any other way you interact with us.
Our contact details: Esska Shoes Limited, Unit 7 Roslin Square, Roslin Road, London, England, W3 8DH — support@esska.co.uk — +44 (0) 2088111155.
For anything relating specifically to how we handle your data, or to exercise any of your rights, please write to our Data Protection Officer at dataprotection@esska.co.uk, or by post to the address above marked FAO: The Data Protection Officer.
3. What personal data we collect and when
3.1 Information you give us
We collect the following categories of information about you:
• Identifiers: title, name and surname, date of birth, gender, email address, contact phone number(s), billing and delivery address(es).
• Commercial information: purchase and order history, shoe size, reasons for cancelling or returning an order, gift card and voucher use.
• Financial information: payment details, processed securely by our third-party payment providers — we do not store full card numbers.
• Account information: login details and preferences, where you create an account with us.
• Communications: information you provide when contacting our Customer Services Team, entering competitions or prize draws, completing surveys, or leaving a review.
• Images: photographs or footage of you, including CCTV footage captured in our store.
• Information you post on social media, where you allow social media platforms to share it with us.
We collect this information when you register on or use our website, contact us by phone or email, enter an event, prize draw or competition, complete a survey or leave a review, complete any form for transactional or other purposes, buy products or gift cards, visit our store, cancel or return an order, or when a third party has your permission to share your information with us.
3.2 Information we collect automatically
When you visit our website, we and our third-party partners automatically collect certain information using cookies and similar tracking technologies — see our full Cookies Policy for detail. The categories we collect include:
• Device information: IP address, browser type and version, operating system, unique device identifiers.
• Usage patterns: pages visited, time spent on pages, referral source, navigation paths and click data.
• General location, derived from your IP address.
• Cookies, web beacons/pixels, and analytics or tracking scripts used to understand website performance and manage our advertising. The tools we use for this are: Google Analytics, Google Ads, Google's Global Site Tag (gtag.js), Google Conversion Tracking, Microsoft Clarity, and Ahrefs Analytics.
• Appikon Back in Stock, which collects your email address if you sign up for a restock alert on a sold-out product.
• Help Scout, our customer support tool, which may set cookies and log details of your enquiries when you contact us through the site.
You can adjust your browser or device settings at any time to limit or disable cookies, though some site features may not work properly as a result.
3.3 Sensitive personal data
We do not collect sensitive personal information (for example health data, racial or ethnic origin, political opinions, religious beliefs, genetic or biometric data, or sexual orientation). If a specific service ever required us to collect this type of data, we would clearly explain the purpose and obtain your explicit consent, or rely on another lawful basis permitted under applicable data protection law, before doing so.
4. How we use your personal data and our legal basis for doing so
We only use your personal data where we have a valid legal basis to do so. The table below sets out our main purposes and the corresponding legal basis:
• To handle your orders, deliver products, and process payments and refunds, including fraud prevention — performance of a contract, and legitimate interests (fraud prevention).
• To personalise your shopping experience, including tailored online ads and promotions — legitimate interests and/or consent; where we rely on legitimate interests we have carried out a balancing test to ensure this does not override your rights and freedoms.
• To send you marketing communications about our products and offers — consent, obtained through clear opt-in mechanisms such as checkboxes that are not pre-ticked. You can withdraw this at any time.
• To respond to your queries, refund requests, and complaints, and to keep a record of your contact with us — performance of a contract and legitimate interests (good customer service).
• For statistical, analytical, or survey purposes to improve our website and services — legitimate interests and/or consent for non-essential cookies.
• To detect, prevent, and investigate fraud or other illegal activity — legitimate interests and legal obligation.
• To process entries to a competition, promotion, or prize draw — performance of a contract; any additional purposes will be set out in that competition's specific terms and conditions.
• To comply with our legal and regulatory obligations, such as tax and accounting requirements, or where we are required to share data with law enforcement — legal obligation.
• To enable trusted third parties to carry out technical, logistical, or other business functions on our behalf (for example order fulfilment or advertising) — legitimate interests, subject to those parties agreeing to handle your data in line with this policy.
5. Who else sees your personal data
5.1 Service providers
We share your personal data with trusted third parties who need it to perform a specific function for us. We only give them the data they need, they may only use it as instructed, and they must have appropriate safeguards in place and delete your data once that function is complete or when we stop working with them.
• Shopify powers our online store. You can read the Shopify privacy policy.
• Klaviyo manages our email and SMS marketing. You can read the Klaviyo Privacy Policy.
• Klarna and Clearpay, where selected as a payment method, each process your data independently as a separate controller, in accordance with the Klarna privacy policy and the Clearpay privacy policy respectively.
• Shipping partners — depending on your order and delivery destination, this may include Royal Mail, DHL Parcel UK, UPS, or FedEx — receive your name, delivery address, and contact details in order to deliver your order.
• Returns partners, including SWAP where applicable, process your return through their online portal and receive relevant order details to do so; your return is then delivered by one of the couriers named above.
• Analytics and advertising tools — Google Analytics, Google Ads, Google's Global Site Tag (gtag.js), Google Conversion Tracking, Microsoft Clarity, and Ahrefs Analytics — help us understand website performance and manage our advertising — see our Cookies Policy for detail.
• Appikon Back in Stock, used for restock email alerts, and Help Scout, used for customer support.
5.2 Shopify enhanced services and data sharing
In addition to processing your data to operate our store, Shopify may also process your data to provide enhanced services, which can include services based on your interactions with other merchants and with Shopify. Your information may therefore be shared with Shopify and selected third parties, who may be located in other countries, to provide these services.
If you are a resident of certain US states, some of these enhanced services may be considered “sharing” or “targeted advertising” under applicable state privacy laws, and you have the right to opt out via Shopify's opt-out page.
If you are a resident of the UK, EEA, or Switzerland, we are required to obtain your consent before showing you personalised ads based on your activity in our store, with other merchants, or with Shopify. You can withdraw this consent at any time through Shopify's Privacy Portal.
5.3 Business transfers
If Esska is involved in a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will provide notice before your data is transferred and becomes subject to a different privacy policy.
5.4 Legal requirements and protecting our business
We may disclose your personal data where we believe in good faith that this is necessary to comply with a legal obligation (such as a court order or request from law enforcement), to protect and defend our rights or property, to investigate suspected wrongdoing, to protect the personal safety of users or the public, or to protect against legal liability.
5.5 Aggregated and de-identified data
We may share aggregated or de-identified information that cannot reasonably be used to identify you, for example to understand overall shopping trends.
6. Where your data is stored and international transfers
Some of our partners and third parties who receive your personal data are based outside the UK and European Economic Area. Where this happens, we take steps to ensure your data continues to receive an appropriate level of protection, including relying on the UK's International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, as applicable, or transferring data only to countries recognised as providing an adequate level of protection.
By providing your personal data to us, you understand that it may be transferred, stored, and processed outside your country of residence in this way.
7. How we protect and store your data
7.1 Data security
It is our duty to protect your personal data, and we do this by following our internal data management policies and industry-standard technical and organisational measures, including:
• Encryption of data in transit using SSL/TLS (HTTPS).
• Access controls that restrict data to authorised personnel only.
• Data minimisation — we only collect what we need.
• Regular reviews of our security practices.
• Staff training on data protection and security.
While we use commercially reasonable means to protect your personal data, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
7.2 Data retention
We only keep your personal data for as long as necessary for the purpose it was collected, subject to any legal requirement to retain it for longer (for example tax or accounting purposes). Once it is no longer needed, we will securely delete it or anonymise it.
8. Children's data
To shop with us online, you must be over 16 years old, and we do not knowingly collect personal data from children under 16. We encourage parents and guardians to monitor their children's internet use and to instruct children never to provide personal data to us. If you believe a child has provided us with personal data without appropriate consent, please contact us and we will take steps to remove it.
9. Your data protection rights
Depending on where you live, you have some or all of the following rights over your personal data:
Right to be informed — this Privacy Policy, together with our Cookies Policy, is intended to satisfy this right.
• Right of access — you can ask us what data we hold about you.
• Right to rectification — you can ask us to correct information that is incorrect, incomplete, or out of date.
• Right to erasure — you can ask us to delete your personal data where processing was based on consent that you have withdrawn. This does not apply to data we are legally required to keep, such as transaction records.
• Right to restrict processing — where we process your data on the basis of legitimate interest, you can ask us to stop, and we will do so unless we have an overriding legitimate reason to continue.
• Right to object — you can stop us sending you marketing at any time, by using the unsubscribe link in any marketing email, disabling push notifications in your device settings, or contacting our Customer Services Team or Data Protection Officer directly.
• Right to data portability — you can ask for a copy of your data in a portable format, or ask us to transmit it to another controller where technically feasible.
• Rights relating to automated decision-making — you have the right not to be subject to a decision based solely on automated processing, including profiling, that produces a legal or similarly significant effect on you. We do not currently make any such decisions about you.
To exercise any of these rights, write to our Data Protection Officer at dataprotection@esska.co.uk, or by post to Esska, Unit 7 Roslin Square, Roslin Road, London, England, W3 8DH. Requests for access should include your full name, address, email, phone number, and specific details of what you are requesting, so we can verify your identity. We will respond within 30 days, or contact you to request further information first. If we refuse a request — for example because it is unreasonable — we will explain why.
Please note you may continue to receive some communications for a short period after changing your preferences, while our systems update, and that this policy does not apply once you follow a link to a third-party website — please check their privacy terms separately.
9.1 Additional rights for Canadian residents (PIPEDA)
If you are resident in Canada, PIPEDA gives you similar rights to access and correct your personal data, and to challenge our compliance with applicable privacy law. We are accountable for personal data under our control, and we limit our collection, use, and disclosure of it to what is reasonable for the purposes we've identified in this policy.
9.2 Additional rights for Australian residents (APPs)
If you are resident in Australia, the Australian Privacy Principles give you rights to access and correct your personal information, and set out how we may collect, use, and disclose it, including in relation to direct marketing. You can opt out of direct marketing at any time using the methods described above.
10. How to complain
Your first port of call should be our Data Protection Officer, using the contact details in Section 2. If you're still not satisfied, you have the right to lodge a complaint with your local supervisory authority:
• United Kingdom: the Information Commissioner's Office — 0303 123 1113, or www.ico.org.uk/concerns.
• European Union: the data protection authority in your EU member state.
• Canada: the Office of the Privacy Commissioner of Canada (OPC).
• Australia: the Office of the Australian Information Commissioner (OAIC).
• Any other country: the relevant data protection regulator in your country of residence.
11. Links to other websites
Our website may contain links to other websites that we do not operate. If you click a third-party link, you will be taken to that site, and this policy will no longer apply. We strongly advise you to review the privacy policy of every site you visit — we have no control over, and no responsibility for, the content or privacy practices of third-party sites.
12. Special provisions for California residents (CCPA)
This section supplements the rest of this Privacy Policy and applies only if you are a resident of California.
In addition to the categories listed in Section 3, we may also collect: commercial information including your purchase preferences; geolocation data; and internet or electronic network activity such as browsing history, search history, and interactions with our website, app, or advertisements — together with any inferences we draw from this to reflect your shopping preferences. This information may come from our business partners, vendors, or your social media account.
As a California resident, you have the right to request access to, and deletion of, the specific categories of personal data we hold about you, to the extent permitted under the CCPA, up to twice every 12 months. To exercise these rights, contact support@esska.co.uk; any response will cover the 12-month period preceding your request. We will not discriminate against you, including by offering inferior products or different pricing, for exercising any of these rights.
Esska does not sell or disclose your personal data to third parties for their own direct marketing purposes, so there is no sale to opt out of.
13. Changes to this policy
We may update this Privacy Policy from time to time as we develop our business and services. We will post any changes on this page and update the “Last updated” date above; for significant changes, we will also bring these to your attention directly, for example by email. Please check back here periodically for the latest version.
To see our separate Cookies Policy, please visit our website.
14. Other
Any numbering in this document is for convenience only.