privacy policy

Privacy Policy

Overview

Our Privacy Policy explains in detail the types of personal data we collect about you when you interact with us, and how and why we then use that data. Fundamentally it all comes down to maximising your experience as a visitor to our site, or as a customer of ours, and to allow the smooth running of our own business processes. We'll attempt to explain this in the most accessible way we can here, but if you have any questions at all you're welcome to contact us at info@thisworks.com or phone 0208 543 3544.

Who we are and how to contact us

This Works Products Limited (we, us, our) is the controller responsible for your personal data. We are a company registered in England and Wales under company number 06959060 with our registered office at 5 Pemberton Row, London, England, EC4A 3BA, and we are registered with the Information Commissioners Office (ICO) under registration reference Z3059236. If you have any questions about this Privacy Policy or about how we handle your personal data, or if you wish to exercise any of your rights, you can contact our Data Protection Officer at privacy@thisworks.com or by writing to the registered office address above marked for the attention of the Data Protection Officer. For general queries you can also contact our Customer Service team at info@thisworks.com or on 0208 543 3544.

Legal Bases

We rely on a different lawful basis depending on what we are doing with your personal data: (a) processing and fulfilling your orders and processing payments, and providing customer service, refunds and handling complaints - performance of our contract with you; (b) sending you marketing by email, SMS or telephone - your consent, or where permitted the soft opt-in under the Privacy and Electronic Communications Regulations 2003 (PECR), which you can withdraw at any time; (c) personalising our marketing and product recommendations, and building a picture of what you like (profiling) - our legitimate interests in promoting our products and presenting offers relevant to you; (d) online advertising and retargeting using cookies and similar technologies - your consent, managed through our Privacy Preference Center on our website; (e) the Epsilon Abacus data pooling arrangement - your consent, which you give at the checkout and can withdraw at any time; (f) service and transactional messages and other communications required by law - compliance with our legal obligations and/or performance of our contract with you; and (g) meeting our legal, accounting, tax and product-safety obligations - compliance with our legal obligations. Where we rely on legitimate interests we have weighed our interests against your rights and freedoms through a legitimate interests assessment, and you can object at any time (see What are your rights below).

When do we collect your personal data?

As laid out in the legal bases above, we (either directly or through our service providers) only collect your personal data either to improve your experience as a customer of ours, if you've given us consent to contact you with details of latest offers and exclusives, or to allow the smooth running of our business operation (our legitimate interest). The data we store therefore is transactional in nature: the items you have bought, the dates of your orders, and billing, contact and delivery details. It is important to note we do not store any payment details. In order to allow us to do these things we will collect data on you:

• When you visit our website

• When you sign in to your Account on our website

• When you make a purchase from us, either on the website or via telephone

• When you engage with us on our social media accounts or through SMS/text

• When you contact our Customer Service team

• When you enter one of our competitions

• When you review one of our products or your recent orders

We keep your personal data only for as long as we need it. In particular: purchase and transactional data is retained while you remain a customer and afterwards for as long as needed to meet our legal, accounting, tax and product warranty and safety obligations, unless it is deleted or anonymised following an erasure request; customer account data is retained while your account remains active, unless deleted or anonymised following an erasure request; marketing list data is retained while you remain subscribed and until you unsubscribe, after which your details are suppressed so we do not contact you again; cookie and analytics data is retained for the periods set out in our Cookie Declaration; and competition entry data is retained for the duration of the promotion and then as needed for winner verification and prize fulfilment, unless you have opted into marketing, in which case it is retained on our marketing list. If you ask us to erase your data we will do so as quickly as practicable and within one month.

How and why do we use it?

• To allow us to process and fulfil your orders

• To process payments

• To respond to your queries, refund requests and any complaints

• With your consent we'll use your data to keep you informed of our latest news and products by email, text, mail, SMS/text and telephone. You can opt-out from any of these communications at any time.

• We'll use customer data to build a picture of who you are and what you like, to inform our business decisions and making your customer experience as relevant to you as we can. For example, emailing or sending an SMS/text to you with products we think you'll like based on purchasing or browsing history

• If you have visited our website and viewed particular products or pages, we might target you with relevant products or advertising after you've left the site either on Facebook, Instagram or Google for example. This relies on cookies and similar technologies managed through our Privacy Center on our website.

• Data pooling with Epsilon International UK Limited (trading as Epsilon Abacus). Data pools are groups of retailers who share information on what their customers buy. This pooled information is analysed to understand consumers' wider buying patterns. From this information customers are then sent offers that are deemed to be relevant based on their purchase history.

• We work with Epsilon International UK Limited (trading as Epsilon Abacus), which manages the Abacus Alliance on behalf of UK retailers. The participating retailers are active in the clothing, collectables, food & wine, gardening, gadgets & entertainment, health & beauty, household goods, and home interiors categories. We both share customer purchase data with, and receive prospect data from, the Abacus Alliance pool. Epsilon International UK Limited analyses this pooled information to help the retailers understand consumers’ wider buying patterns. From this information, retailers can tailor their communications, sending people suitable offers that should be of interest to them, based on what they like to buy. Our lawful basis for this data sharing is your consent, which you give at the checkout when you place your order and which you can withdraw at any time by contacting us. Where we obtain your details as a prospect from the Abacus Alliance pool, the source of that personal data is other participating retailers via Epsilon International UK Limited, as required by Article 14 UK GDPR.

• To send you communications required by law or necessary to inform you about changes to the services we provide. This would include legally required information related to your orders. Service messages won't contain promotional content and therefore would not require prior consent, unlike the marketing emails. Using data for these purposes ensures we comply with our legal obligations to you.

Website analytics and attribution

We use a third-party analytics and attribution platform which places a first-party pixel on thisworks.com to measure website and marketing performance, attribute sales and improve your experience. It collects pseudonymous data such as page views, events, browsing behaviour, conversions and related metadata, and acts as our processor, processing this data only on our instructions. Our lawful basis is your consent for the non-essential cookies and similar technologies involved (managed through our cookie preference center) and our legitimate interests in the resulting analytics. Where this involves transfers outside the UK, those transfers are protected by the UK Addendum to the EU Standard Contractual Clauses or an IDTA.

How do we share your personal data?

We will sometimes share personal data with trusted third parties. Some of these third parties act as our data processors, meaning they handle your data only on our instructions and under contract for the purposes of performing their specific services. These processors have obligations to you to ensure your data is respected and only used for the purposes they have been contracted to use it.

Examples of data processors would include IT companies that support our website and other business systems, delivery couriers, and email/marketing platforms such as Klaviyo. Other third parties, such as InPost, Rakuten and Klarna, act as independent data controllers who determine their own purposes and means of processing your personal data. Their own privacy notices apply to their processing of your data, and any requests you have about how they handle your information should be directed to them.

What are your rights?

Under applicable data protection law, you have the following statutory rights in relation to your personal data:

• Right of access (Article 15 UK GDPR): You have the right to request access to the personal data we hold about you, including a copy of that data.

• Right to rectification (Article 16 UK GDPR): You have the right to request the correction of your personal data where it is incorrect, out of date or incomplete.

• Right to erasure (Article 17 UK GDPR): You have the right to request the deletion of your personal data where there is no compelling reason for us to continue processing it, subject to any legal obligations requiring us to retain such data.

• Right to restriction of processing (Article 18 UK GDPR): You have the right to request that we restrict the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data or where you have objected to processing.

• Right to data portability (Article 20 UK GDPR): You have the right to request that we transfer your personal data to you or to another data controller in a structured, commonly used and machine-readable format, where the processing is based on your consent or on a contract and is carried out by automated means.

• Right to object (Article 21 UK GDPR): You have the right to object to the processing of your personal data where we are relying on our legitimate interests as the legal basis for processing, for reasons connected to your individual situation. We must then cease processing unless we have compelling legitimate grounds that override your interests, rights and freedoms. You also have the absolute right to object to the use of your personal data for direct marketing purposes at any time through all channels or selected channels, and we must always comply with such a request.

• Rights in relation to automated decision-making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where such processing is necessary for a contract, authorised by law, or based on your explicit consent.

• Right to withdraw consent: Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

• You have the right to request a copy of any information about you that This Works holds: contact info@thisworks.com or phone us on 0208 543 3544. To ask for your information to be amended, please update your online account if you have one, or contact our Customer Services team who will be able to do so for you.

• To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this Privacy Notice.

Delivery and fulfilment - InPost

When you choose InPost (or another courier) for delivery or returns, we share the personal data needed to fulfil your order and enable parcel collection and returns through InPost's locker network, namely your name, delivery address, email address, phone number, customer reference number, parcel identifiers and preferred collection point. InPost UK Limited acts as an independent controller in respect of this data (not as our processor) and processes it under its own privacy notice at https://inpost.co.uk/privacy-policy. Because InPost is an independent controller, you can exercise your data protection rights in relation to its processing directly with InPost. No special category (sensitive) data is shared.

International transfers

Some of the providers we work with are based outside the UK, including in the United States, and some operate globally. Where these providers act as our processors, handling your data on our instructions, they include our email and marketing platform, our product review and site search providers and our analytics and attribution providers (for example Klaviyo, Yotpo, Klevu, Elevar and Triple Whale). Other providers determine their own purposes and act as independent or joint controllers under their own terms and privacy notices, including Google, Meta (Facebook and Instagram), TikTok, Rakuten and Klarna. Where we transfer your personal data to a country that does not have UK adequacy status, we rely on an appropriate safeguard under Article 46 UK GDPR, typically the UK Addendum to the EU Standard Contractual Clauses or the International Data Transfer Agreement (IDTA) and, where a provider is certified, on its certification under the EU-US Data Privacy Framework and the UK Extension to it, together with appropriate technical and organisational measures such as encryption and pseudonymisation. Transfers within the EEA, or to other countries covered by UK adequacy regulations, rely on those adequacy regulations. You can ask us for details of the safeguards in place for any particular provider by contacting privacy@thisworks.com.

• You have the right to lodge a complaint with the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, helpline 0303 123 1113, ico.org.uk. However, we would welcome the opportunity to address your concerns before you approach the ICO, so please contact us first at info@thisworks.com or phone 0208 543 3544. You also have the right to complain to us directly about any matter relating to our handling of your personal data and to receive a response from us.

• If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act.

Profiling and automated decisions

We use profiling to personalise our marketing and product recommendations - for example, we analyse your purchase and browsing history to infer the products and offers likely to interest you, including retargeting you on platforms such as Facebook, Instagram and Google. The effect is that you may see more relevant marketing; this does not have any legal or similarly significant effect on you. We do not make solely automated decisions that produce legal or similarly significant effects on you, such as personalised pricing or automated credit or eligibility decisions. You can object to profiling for direct marketing at any time. If we introduce any qualifying automated decision-making in future, you will have the right to be informed, to make representations, to obtain human intervention and to contest the decision, in line with Articles 22A to 22D UK GDPR as inserted by the Data (Use and Access) Act 2025.

Third parties

Rakuten

Rakuten Advertising may collect personal information when you interact with our digital property, including IP addresses, digital identifiers, information about your web browsing and app usage and how you interact with our properties and ads. It uses this data for a variety of purposes, such as personalisation of offers or advertisements, analytics about how you engage with websites or ads and other commercial purposes, and acts as an independent controller in respect of such processing. For more information about the collection, use and sale of your personal data and to exercise your data protection rights directly with Rakuten, please use the below links.

Your Rights/Opt Out: https://rakutenadvertising.com/legal-notices/services-privacy-rights-request-form/

Klarna

In order to be able to offer you Klarna's payment options, we will pass to Klarna certain aspects of your personal information, such as contact and order details. Klarna acts as an independent controller in respect of this data, which it uses to carry out its own assessment of whether you qualify for their payment options and to tailor the payment options for you.

General information on Klarna you can find here. Your personal data is handled by Klarna in accordance with applicable data protection law and in accordance with the information in Klarna's privacy policy. For details on how to exercise your data protection rights directly with Klarna, please refer to their privacy policy.

TikTok Shop

When you purchase through our TikTok Shop, we receive order details from TikTok including your name, delivery address, contact details and order information. We use this data only to fulfil your order, process returns, provide customer service and for analytics. We do not receive your payment card details. You will receive marketing communications from us only if you have explicitly opted in. TikTok processes your data under its own privacy policy, which applies to your activity on the TikTok platform - see TikTok's Privacy Policy at https://www.tiktok.com/legal/privacy-policy.

WhatsApp Community

If you join our WhatsApp community, your phone number and display name will be visible to us. The community is announcement-only: only administrators can post, members cannot message the group, and member phone numbers are not visible to other members. We use this channel to share product updates and offers and to respond to queries. Messages are delivered via WhatsApp and are subject to WhatsApp's own privacy policy at https://www.whatsapp.com/legal/privacy-policy. You can leave at any time by exiting the group, and you can ask us to delete any data we hold about you by contacting privacy@thisworks.com.

Dataships

From time to time we may use Dataships to manage your marketing consent. When you check out, we share your contact details (name, email address and, where provided, phone number), your location/billing region and order details with Dataships so it can determine the correct marketing-consent option for your country and record your consent preferences. Your personal data is processed in line with Dataships' own privacy notice: https://www.dataships.io/privacy-center.

Children

Our website and products are intended for adults and are not directed at children. We do not knowingly market to, or collect personal data from, anyone under the age of 18. If you believe we hold personal data relating to a child, please contact us at privacy@thisworks.com and we will take appropriate steps to delete it.

Cookies notice

We use cookies and similar technologies on thisworks.com. Full details of the cookies we use, their purposes, how long they last and how to manage your preferences are set out in our separate Cookie Declaration. You can change your preferences at any time using the Privacy Preference Center on our website.

This Privacy Policy was last updated on 21 July 2026.