Privacy Policy

Last updated: 22 August 2026

At MOB & Ko, we care about your privacy and want you to feel confident about how we collect, use and protect your personal information.

This Privacy Policy explains what information we collect when you visit our website, shop with us, create an account, complete one of our quizzes, join our professional programme, interact with our marketing or contact us.

MOB & Ko is operated by KO'D COSMETICS LIMITED, company number 15168937.

For the purposes of UK data protection law, KO'D COSMETICS LIMITED is the data controller responsible for your personal information.

Trading name: MOB & Ko
Company: KO'D COSMETICS LIMITED
Company number: 15168937
Business address: Hoddesdon Enterprise Centre, 7 Pindar Road, Hoddesdon, EN11 0FJ
Email: info@mobandko.com

If you have any questions about this Privacy Policy or how we use your personal information, please contact us using the email address above.

1. The Information We Collect

Depending on how you interact with MOB & Ko, we may collect the following information.

Identity and Contact Information

This may include:

• Your name

• Email address

• Telephone number

• Billing address

• Delivery address

• Date of birth

• Social media handles

• Account details

• Gift card recipient name and email address

Order and Transaction Information

This may include:

• Products purchased

• Order history

• Order value

• Returns and refund information

• Delivery information

• Payment method

• Transaction references

• Gift card purchases

• In-person purchases made through Shopify POS

We do not generally receive or retain your full payment card details. Payments are processed securely by our payment providers.

Account and Profile Information

If you create an MOB & Ko customer account, we may collect:

• Login and account information

• Saved addresses

• Purchase history

• Preferences

• Date of birth

• Loyalty information

• Rewards and membership information

Marketing Information

We may collect:

• Email marketing preferences

• SMS marketing preferences

• Marketing consent records

• Details of when and how you subscribed

• Your interactions with our emails and marketing messages

• Products you have viewed or shown an interest in

• Purchase history used to personalise marketing

• Advertising audience information

Website and Device Information

When you use our website, we may automatically collect information including:

• IP address

• Device type

• Browser type

• Operating system

• Website activity

• Pages viewed

• Products viewed

• Referring website or source

• Approximate location derived from your IP address

• Cookie identifiers

• Advertising identifiers

• Interactions with our website and advertising

We use Shopify analytics, Google Analytics and other technologies to help us understand how our website is being used.

Quiz and Product Recommendation Information

If you complete an MOB & Ko product or brush recommendation quiz powered by RevenueHunt, we may collect information about:

• Your makeup preferences

• Products you use

• Product or brush needs

• Beauty preferences

• Your answers to quiz questions

• Your contact information if you choose to provide it

You may also have the option to provide information about allergies or skin sensitivity.

Providing allergy and skin sensitivity information is optional and you can complete our quiz without providing it.

Where this information reveals information about your health, it may be treated as special category personal data under data protection law. We will only use this information for personalised product recommendations where you have given us separate, explicit consent.

You can withdraw that consent at any time by contacting us at info@mobandko.com.

Withdrawing your consent will not affect the lawfulness of processing that took place before you withdrew it.

Reviews, Photos and Videos

When you leave a review through Judge.me, we may collect:

• Your name

• Email address

• Review

• Rating

• Photographs

• Videos

• Other content you choose to submit

Reviews and associated content may be displayed on our website and, where permitted under the terms or permissions under which you submitted the content, may also be used in MOB & Ko social media, organic marketing, paid advertising and other promotional material.

MOB Pro Information

If you apply for MOB Pro or another professional MOB & Ko programme, we may collect information such as:

• Your name

• Contact details

• Business name

• Profession

• Website

• Social media profiles

• Professional identification

• Proof of qualification

• Evidence of professional status

• Membership information

We use this information to assess eligibility and administer professional memberships and benefits.

Competition and Giveaway Information

If you enter an MOB & Ko competition or giveaway, we may collect:

• Name

• Email address

• Telephone number

• Social media handle

• Competition entry

• Delivery details if you win

• Other information required to administer the promotion

Entering a competition does not automatically subscribe you to marketing.

Where we invite you to join our email or SMS marketing list as part of a competition, this will be presented separately and, where required, will be optional.

Customer Service Information

If you contact us by email, Shopify Inbox or through our social media channels, we may collect and retain:

• Your contact information

• Your messages

• Order information

• Complaint or enquiry details

• Photographs or evidence you provide

• Records of our correspondence with you

Our preferred contact method for customer service and privacy requests is info@mobandko.com.

2. How We Collect Your Information

We collect personal information:

• Directly from you when you purchase from us

• When you create an account

• When you join our loyalty programme

• When you complete a quiz

• When you join MOB Pro

• When you subscribe to marketing

• When you enter a competition

• When you leave a review

• When you contact us

• When you purchase from us at an event or pop-up

• When you provide your details at an event or trade show

• Through Meta or TikTok lead forms

• Automatically through our website, cookies and similar technologies

• Through advertising and analytics platforms

• Through our payment and ecommerce providers

We may occasionally receive information about you from another person.

For example, if somebody purchases a digital gift card for you, they may provide us with your name and email address so that we can deliver the gift card.

3. How and Why We Use Your Information

Under UK data protection law, we need a lawful basis for using personal information.

Depending on the activity, we may rely on:

Contract
Where using your information is necessary to provide something you have ordered or requested.

Legal obligation
Where we are required to keep or process information to comply with the law, including tax and accounting requirements.

Legitimate interests
Where using information is reasonably necessary for the operation and growth of MOB & Ko and does not override your rights and interests.

Consent
Where you have actively agreed to a particular use of your information.

Explicit consent
Where required for certain special category information, such as optional quiz answers that reveal information about allergies or skin sensitivity.

We may use your personal information for the following purposes.

To Process and Deliver Orders

We use your information to:

• Process orders

• Take payment

• Deliver products

• Send order confirmations

• Provide delivery updates

• Manage returns and refunds

• Manage gift cards

• Provide customer service

Our usual lawful basis is contract.

To Manage Customer Accounts

We use your information to create and manage customer accounts, save account preferences, display previous orders and provide account features.

Our usual lawful basis is contract and, where appropriate, our legitimate interests in providing and improving our customer experience.

To Operate Our Loyalty Programme

We may use purchase, account, birthday and engagement information to manage loyalty points, rewards, birthday benefits and other membership benefits through Appstle.

Our lawful basis may be contract where you have joined the programme and legitimate interests where appropriate.

To Provide Personalised Product Recommendations

We use answers provided through RevenueHunt to recommend products or brushes that may suit your preferences.

For ordinary beauty preference information, our basis may be consent, contract or our legitimate interests, depending on how you use the quiz.

Where your answers reveal health information such as allergies or skin sensitivities, we rely on your explicit consent.

To Communicate With You

We may contact you about:

• Orders

• Payments

• Deliveries

• Returns

• Account activity

• Customer service enquiries

• Product or service information you have specifically requested

These are service communications rather than marketing communications.

Our lawful basis will usually be contract or legitimate interests.

Email and SMS Marketing

Where permitted, we may use Klaviyo to send:

• New product announcements

• Offers and promotions

• Brand news

• Product education

• Personalised recommendations

• Birthday messages or rewards

• Back-in-stock messages

• Other MOB & Ko marketing

We may also operate automated Klaviyo flows, including:

• Welcome communications

• Abandoned cart reminders

• Browse abandonment communications

• Post-purchase communications

• Customer win-back campaigns

• Personalised recommendations

Where consent is required, we will ask you to actively opt in.

We intend to provide separate options for email and SMS marketing so you can choose how you would like to hear from us.

We may also contact existing customers about similar MOB & Ko products where UK electronic marketing rules allow us to do so without separate consent.

You can unsubscribe from email marketing at any time using the unsubscribe option in our emails.

You can opt out of SMS marketing using the opt-out instructions included within our messages.

You can also contact us at info@mobandko.com.

Opting out of marketing will not stop essential service communications relating to an order or your account.

Advertising and Personalisation

We may use information about customers and website visitors to:

• Personalise advertising

• Measure advertising performance

• Create customer audiences

• Create similar or lookalike audiences

• Understand how customers interact with our marketing

• Avoid showing irrelevant advertising

• Measure conversions

• Improve our advertising campaigns

This may involve platforms including Meta, TikTok and Google.

Where this activity relies on advertising cookies, tracking pixels or similar technologies, we will obtain consent where required.

For some other advertising activities involving existing customer information, we may rely on our legitimate interests where permitted by law and where those interests are not overridden by your rights.

Analytics and Website Improvement

We use analytics to understand:

• How people find MOB & Ko

• Which pages and products are popular

• How customers navigate the site

• The performance of our marketing

• Website problems

• Customer behaviour in aggregate

• How we can improve our customer experience

This includes Shopify analytics and Google Analytics.

Where analytics involve non-essential cookies or similar technologies, we will obtain consent where required.

Fraud Prevention and Security

We may use Shopify fraud analysis and other security information to identify suspicious transactions, protect our customers and protect MOB & Ko against fraud.

Our lawful basis is generally our legitimate interests in preventing fraud, protecting our business and maintaining secure ecommerce operations.

Accounting, Tax and Legal Requirements

We may use and retain transaction and customer information where required for:

• Bookkeeping

• Accounting

• Tax

• Audit

• Legal claims

• Regulatory compliance

• Fraud prevention

We use Xero and may share relevant information with our accountants, bookkeepers and professional advisers.

Our lawful basis is usually legal obligation or legitimate interests.

4. Cookies, Pixels and Similar Technologies

Our website uses cookies and similar technologies.

Some cookies are necessary for the website to function, including technologies required for checkout, security and account functionality.

Other cookies and technologies may be used for:

• Analytics

• Advertising

• Personalisation

• Conversion tracking

• Understanding website behaviour

• Measuring campaign performance

These may include technologies provided by:

• Shopify

• Google Analytics

• Google Ads

• Meta

• TikTok

Where required by law, we will not place or access non-essential cookies or similar tracking technologies until you have made your choice through our cookie consent tool.

You can change your cookie preferences using the cookie settings available on our website.

Please see our Cookie Policy for more detailed information about the cookies and similar technologies we use.

5. Who We Share Your Information With

We do not sell or rent your personal information.

However, we work with trusted third parties that help us operate MOB & Ko.

Depending on the service, these companies may act as processors handling data on our instructions or as independent controllers responsible for their own use of personal information.

Ecommerce and Website

Shopify
We use Shopify to operate our ecommerce website, customer accounts, Shopify Inbox, analytics, checkout and Shopify POS.

Payments

Depending on the payment method you select, information may be shared with payment providers including:

• Shopify Payments

• PayPal

• Klarna

• Clearpay

• Apple Pay

• Google Pay

Payment providers may process your information under their own privacy policies.

Email and SMS

Klaviyo
We use Klaviyo for customer email marketing, marketing automation and, in the future, SMS marketing.

Reviews

Judge.me
We use Judge.me to collect and display customer reviews, including customer-submitted photographs and videos.

Loyalty and Subscriptions

Appstle
We use Appstle in connection with our loyalty and rewards programme and may use Appstle for subscription or recurring purchase functionality in the future.

Product Recommendations

RevenueHunt
We use RevenueHunt to provide our product and brush recommendation quiz.

Advertising

We may share or process information through:

• Meta

• TikTok

• Google Ads

This may include advertising audiences, campaign measurement and conversion information where permitted.

Analytics

We use:

• Shopify analytics

• Google Analytics

Delivery

Royal Mail
We share the information necessary to deliver your order, such as your name, delivery address and relevant contact information.

Accounting

Xero
We may process order and transaction information through Xero for accounting and financial administration.

Relevant information may also be shared with our accountant, bookkeeper, legal advisers and other professional advisers.

Cloud Storage and Business Tools

We use services including:

• Google Drive

• Canva

• Dropbox

• WeTransfer

• Figma

These tools are primarily used for internal business and design purposes. Personal information may occasionally be processed within them where necessary for our business operations.

Agencies and Contractors

Authorised freelancers, agencies and contractors may have limited access to personal information where necessary to provide services to MOB & Ko, including:

• Klaviyo and email marketing support

• Paid advertising

• Shopify development

• Website maintenance

We expect third parties handling personal information on our behalf to protect it appropriately and to use it only for the relevant purpose.

Business Transactions

If MOB & Ko or KO'D COSMETICS LIMITED is involved in a merger, acquisition, restructuring, investment, financing or sale of all or part of the business, personal information may be disclosed as part of that transaction where lawful.

6. International Transfers

MOB & Ko is based in the United Kingdom, but some of the companies we use operate internationally or may process information in countries outside the UK.

As a result, your personal information may sometimes be transferred outside the United Kingdom.

Where UK data protection rules relating to international transfers apply, we will take appropriate steps to protect your information.

Depending on the destination and provider, these protections may include:

• UK adequacy regulations

• Approved contractual safeguards

• The UK International Data Transfer Agreement

• The UK Addendum to approved standard contractual clauses

• Other lawful transfer mechanisms

You can contact us at info@mobandko.com if you would like further information about safeguards relating to your personal information.

7. How Long We Keep Your Information

We do not keep personal information for longer than we reasonably need it.

Our typical retention periods are:

Orders and Transactions

Order, payment and transaction records are generally retained for up to six years from the end of the relevant financial year, or longer where required by law.

Customer Accounts

Account information is generally retained while your account remains active.

If an account is closed or becomes inactive, we will generally review it for deletion or anonymisation after two years, although transaction information may need to be retained separately for longer.

Customer Service

Routine customer service correspondence is generally retained for up to two years after an enquiry has been resolved.

We may keep information for longer if it relates to an ongoing complaint, dispute, fraud investigation or legal claim.

Marketing

Marketing information is generally retained while you remain subscribed or while we have another lawful reason to use it.

We periodically review inactive marketing profiles and will delete or anonymise information where we no longer have a reasonable need to retain it.

If you unsubscribe, we may retain limited information such as your email address, telephone number and opt-out status on a suppression list so that we can respect your request not to receive marketing.

Quiz Information

General quiz responses are normally retained for no longer than reasonably necessary to provide recommendations and personalise your experience.

We will generally review quiz information after 12 months.

Where allergy or skin sensitivity information amounts to special category health information, we will generally retain it for no longer than 12 months, unless you withdraw your explicit consent sooner or there is another lawful reason requiring its retention.

Competitions and Giveaways

Information relating to non-winning entrants is generally retained for up to six months after the competition ends, unless the individual has separately opted into marketing.

Information relating to winners may be retained for up to six years where necessary for tax, accounting, prize fulfilment, fraud prevention or legal purposes.

MOB Pro

MOB Pro application and membership information is generally retained while your professional membership is active and for up to two years afterwards, unless we need to retain particular records for longer for legal or administrative reasons.

Reviews and User Content

Reviews, photographs and videos may be retained while the review remains published or while we continue to have a legitimate business reason and appropriate rights to use the content.

Analytics and Cookies

Retention periods for analytics, advertising and cookie information vary depending on the technology used, our configuration settings and the purpose of processing.

We regularly review our retention arrangements and may delete or anonymise information earlier where it is no longer required.

8. Automated Processing and Profiling

We use technology to help personalise and operate parts of the MOB & Ko customer experience.

This may include:

• RevenueHunt product recommendations

• Klaviyo customer segmentation

• Automated marketing flows

• Personalised marketing

• Advertising audience creation

• Shopify fraud analysis

These systems may use information about your interests, purchases or behaviour to make recommendations or identify patterns.

We do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects on you unless we have a lawful basis to do so and provide any safeguards required by law.

9. Your Data Protection Rights

Depending on the circumstances, UK data protection law may give you the right to:

Access Your Information

You can ask us for a copy of the personal information we hold about you.

Correct Your Information

You can ask us to correct inaccurate or incomplete information.

Delete Your Information

In certain circumstances, you can ask us to delete personal information we hold about you.

This right is not absolute. For example, we may still need to retain transaction records to meet legal or tax obligations.

Restrict Processing

In certain circumstances, you can ask us to restrict how we use your information.

Data Portability

In certain circumstances, you can ask us to provide information you have given us in a structured, commonly used and machine-readable format or transfer it to another organisation.

Withdraw Consent

Where we rely on consent, you can withdraw that consent at any time.

This includes:

• Email marketing consent

• SMS marketing consent

• Cookie consent

• Explicit consent relating to optional allergy or skin sensitivity quiz information

Withdrawal will not affect processing that was lawful before consent was withdrawn.

Object to Processing

You have the right to object to our use of your personal information for direct marketing at any time.

You may also have the right to object where we rely on legitimate interests, depending on the circumstances.

To exercise any of these rights, contact:

info@mobandko.com

We may need to ask for information to confirm your identity before processing certain requests.

There is normally no charge for exercising your rights, although the law allows fees or refusal in certain limited circumstances.

10. Marketing Choices

You are always in control of whether you receive MOB & Ko marketing.

You can:

• Unsubscribe from emails using the unsubscribe option in our emails

• Opt out of SMS marketing using the instructions provided in the message

• Change cookie preferences through our website

• Contact us at info@mobandko.com

Where we collect marketing consent, we keep appropriate records of when, where and how that consent was provided.

Submitting your information to place an order, enter a competition, receive a gift card, complete a quiz or contact customer service does not automatically mean you have consented to marketing.

11. Meta and TikTok Lead Forms

We may collect information through lead forms hosted by platforms such as Meta and TikTok.

Where the purpose of a lead form is marketing, we will clearly explain this and obtain any consent required before using the information for email or SMS marketing.

Submitting a lead form will not be treated as marketing consent unless the form and surrounding information clearly establish that you have agreed to receive that type of marketing.

12. Information Collected at Events and Pop-Ups

MOB & Ko may collect personal information at events, pop-ups and trade shows.

This may include information collected:

• When you purchase a product

• Through Shopify POS

• When you request information

• When you enter a competition

• When you voluntarily sign up for marketing

Information required to process an in-person purchase will not automatically be used for marketing unless we have an appropriate lawful basis to do so.

13. Children and Young People

Our website is available to a broad audience and is not specifically designed or marketed as a children's service.

We recognise that younger customers may be interested in beauty and cosmetics and will take additional care when processing personal information relating to children or young people.

Where consent is legally required from a parent or guardian because of a customer's age, we will seek appropriate consent before carrying out the relevant processing.

We do not knowingly use children's personal information for inappropriate profiling or direct marketing.

If you are a parent or guardian and believe that a child has provided us with personal information inappropriately, please contact info@mobandko.com.

14. Security

We take reasonable technical and organisational measures to protect personal information from:

• Loss

• Misuse

• Unauthorised access

• Disclosure

• Alteration

• Destruction

Access to personal information is limited to people who reasonably need it for their role.

Employees, contractors, agencies and service providers with access to personal information are expected to maintain appropriate confidentiality and security.

No internet or electronic storage system can be guaranteed to be completely secure, but we work with established service providers and review our practices to reduce risk.

15. Social Media

If you contact or interact with MOB & Ko through Instagram, Facebook, TikTok or another social media service, both MOB & Ko and the relevant platform may process information about your interaction.

Social media companies operate under their own privacy policies and may independently determine how they use information collected through their services.

16. Digital Gift Cards

If you purchase a digital gift card for another person, you may provide us with that person's name and email address.

We will use their details to deliver or administer the gift card.

Receiving a gift card does not automatically subscribe the recipient to MOB & Ko marketing.

If you provide another person's details to us, please ensure you are entitled to provide that information for the intended purpose.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes to our business

• New products or services

• Changes to the technology we use

• New legal requirements

• Changes to how we process personal information

The latest version will be published on our website and the "Last updated" date at the top of this policy will be changed.

Where a change materially affects how we use your personal information, we will take reasonable steps to bring that change to your attention where required.

18. Complaints

If you have concerns about how MOB & Ko has handled your personal information, we would appreciate the opportunity to help resolve the issue first.

Please contact:

info@mobandko.com

You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's data protection regulator.

Making a complaint to us first does not affect your right to contact the ICO.

19. Contact Us

For questions about this Privacy Policy, requests relating to your personal information or to exercise your data protection rights, please contact:

MOB & Ko
KO'D COSMETICS LIMITED
Company number: 15168937
Hoddesdon Enterprise Centre
7 Pindar Road
Hoddesdon
EN11 0FJ

Email: info@mobandko.com