Privacy and Cookie Policy
How AfterGlow Credit Limited collects, uses, stores and shares your personal data.
1. Who We Are
This privacy policy explains how AfterGlow collects, uses, stores and shares your personal data when you visit our website, sign up to our waitlist, express interest in partnering with us as a merchant, or (once our service launches) use our buy now pay later (“BNPL”) service.
AfterGlow is a UK-based beauty and wellness BNPL business. We act as the data controller for the personal data described in this policy, meaning we determine the purposes and means of processing your personal data.
Our details are as follows:
- Full legal name: AfterGlow Credit Limited
- Company number: [To be confirmed]
- Registered address: [To be confirmed]
- Data protection contact / DPO: [To be confirmed]
- Email: hello@afterglowcredit.com
If you have any questions about this privacy policy or how we handle your personal data, please contact us using the details set out above or in section 16 below.
2. Personal Data We Collect
We collect different categories of personal data depending on how you interact with us. We have set out below the types of personal data we collect in respect of each category of individual.
2.1 All website visitors
When you visit our website, we automatically collect certain technical and usage data, including:
- IP address (which may be truncated or anonymised depending on our analytics configuration);
- browser type and version, device type and operating system;
- pages visited, time spent on pages, clickstream data and referring URL; and
- cookie identifiers and similar technology data (see section 6 below).
2.2 Customer waitlist and sign-up
If you sign up to our customer waitlist or register your interest in our BNPL service, we collect:
- name;
- email address;
- any other information you voluntarily provide in the sign-up form (for example, beauty or wellness preferences); and
- date and time of registration, IP address.
2.3 Merchants and business partners
If you are a merchant or business expressing interest in partnering with AfterGlow, we collect:
- business contact name and job title;
- business email address and telephone number;
- business name, trading name and company registration number;
- business address and website URL;
- nature of products or services offered; and
- any other information you provide in the merchant enquiry or onboarding form.
2.4 BNPL customers (post-launch)
Once our BNPL service is operational, we will collect additional personal data from customers applying for and using the service. This will include:
- Identity data: full name, date of birth, title, and identity verification documents.
- Contact data: home address, email address and telephone number.
- Financial data: bank account details, payment card details, income information, employment status and credit history.
- Transaction data: details of purchases made using the BNPL service, payment history, repayment amounts and dates.
- Credit and affordability data: information obtained from credit reference agencies (“CRAs”), fraud prevention agencies and other databases used in credit and affordability assessments.
- KYC/AML data: information required to verify your identity and comply with anti-money laundering and counter-terrorist financing legislation.
- Technical data: device information, login data, browser fingerprint and similar technical identifiers.
- Profile data: your username or customer reference, purchase preferences and feedback.
- Marketing and communications data: your preferences in receiving marketing from us and your communication preferences.
Special category data: We do not intentionally collect special category personal data (such as data about health, ethnicity, religious beliefs or sexual orientation). While our service operates in the beauty and wellness sector, the fact that a customer uses a beauty or wellness BNPL service does not, of itself, reveal special category data. However, if you voluntarily provide information that constitutes special category data, we will process it only with your explicit consent and in accordance with applicable law.
3. How We Use Your Personal Data
We use your personal data for the purposes set out below. For each purpose, we have identified the lawful basis on which we rely under UK GDPR.
3.1 All website visitors
| Purpose | Lawful basis |
|---|---|
| Operating, maintaining and improving our website | Legitimate interests (maintaining and improving our online presence and understanding how visitors use our website) |
| Analysing website usage and traffic patterns | Legitimate interests (understanding website performance and user behaviour to improve our service); consent for non-essential cookies (see section 6) |
| Ensuring website security and preventing fraud or abuse | Legitimate interests (protecting our website, systems and users from security threats) |
| Complying with legal obligations (e.g. responding to lawful requests from regulators or law enforcement) | Legal obligation |
3.2 Customer waitlist and sign-up
| Purpose | Lawful basis |
|---|---|
| Managing your waitlist registration and communicating with you about our launch | Performance of a contract (or steps taken at your request prior to entering into a contract); alternatively, legitimate interests (managing and responding to expressions of interest in our service) |
| Sending you updates about the launch of the AfterGlow service | Legitimate interests (keeping interested individuals informed about a service they have expressed interest in); consent where required under PECR for electronic marketing |
| Sending you marketing communications about AfterGlow products and services | Consent (which you may withdraw at any time; see section 5) |
| Internal record-keeping and administration | Legitimate interests (maintaining accurate business records) |
3.3 Merchants and business partners
| Purpose | Lawful basis |
|---|---|
| Assessing and processing merchant partnership enquiries and applications | Legitimate interests (evaluating potential business relationships); steps necessary to enter into a contract |
| Communicating with merchant contacts about the AfterGlow platform and partnership opportunities | Legitimate interests (managing our business relationships and discussing commercial opportunities) |
| Merchant onboarding, due diligence and ongoing relationship management | Performance of a contract; legal obligation (where due diligence is required by law or regulation) |
| Sending B2B marketing communications about AfterGlow services to business contacts | Legitimate interests (promoting our services to businesses likely to have a genuine interest); consent where required |
3.4 BNPL customers (post-launch)
| Purpose | Lawful basis |
|---|---|
| Processing your BNPL application and providing the BNPL service | Performance of a contract (or steps taken at your request prior to entering into a contract) |
| Carrying out credit and affordability assessments | Performance of a contract; legal obligation (under consumer credit legislation and FCA rules); legitimate interests (responsible lending and assessing creditworthiness) |
| Identity verification (KYC) and anti-money laundering / counter-terrorist financing checks | Legal obligation (under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and related legislation) |
| Fraud prevention and detection | Legal obligation; legitimate interests (preventing and detecting fraud to protect our business and customers) |
| Sharing data with credit reference agencies and fraud prevention agencies | Performance of a contract; legal obligation; legitimate interests (responsible lending, fraud prevention and maintaining the integrity of the credit system) |
| Processing payments, managing repayments and administering your account | Performance of a contract |
| Communicating with you about your account, transactions and any arrears or defaults | Performance of a contract; legal obligation |
| Complying with regulatory requirements, including FCA rules and reporting obligations | Legal obligation |
| Sending you marketing communications about AfterGlow products and services | Consent (which you may withdraw at any time) |
| Exercising or defending legal claims | Legitimate interests (establishing, exercising or defending our legal rights) |
4. Lawful Bases: Further Information
Legitimate interests: Where we rely on legitimate interests as our lawful basis, we have carried out a balancing exercise to ensure that our interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interests (see section 13 below). If you wish to obtain further information about our balancing assessments, please contact us using the details in section 16.
Consent: Where we rely on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Automated decision-making: Our BNPL credit and affordability assessment process may involve automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you (for example, a decision to approve or decline your BNPL application). For further detail on your rights in relation to automated decision-making, see section 13 below.
5. Marketing Communications
We will only send you direct marketing communications by email, SMS or other electronic means where:
- you have given us your specific, informed and freely given consent to receive such communications; or
- you are an existing customer (or have negotiated to become one) and we are marketing our own similar products or services to you by email, and we gave you the opportunity to opt out when we first collected your details and in every subsequent communication (the “soft opt-in” under regulation 22 of the Privacy and Electronic Communications Regulations 2003 (“PECR”)).
In either case, you can opt out of receiving marketing communications at any time by:
- clicking the “unsubscribe” link in any marketing email;
- emailing us at hello@afterglowcredit.com; or
- contacting us using the details set out in section 16.
Where you opt out of marketing, this will not affect the lawfulness of any processing carried out before you opted out. We may still send you non-marketing communications which are necessary for the administration of your account or are required by law (for example, service notifications, transaction confirmations or regulatory communications).
B2B marketing: Where we send marketing communications to business contacts at merchant or partner organisations, we do so on the basis of our legitimate interests in promoting our services to businesses likely to have a genuine interest. Such contacts may opt out at any time using the methods described above.
7. Analytics and Website Tracking
We use Google Analytics 4 (GA4), provided by Google LLC, to understand how visitors interact with our website and to analyse website usage.
GA4 sets non-essential cookies (as described in section 6 above) and processes personal data. We will only activate GA4 with your consent via our cookie consent banner, unless it is configured to operate without cookies and processes only anonymised or aggregated data. AfterGlow has configured Google Analytics in accordance with ICO guidance, including the use of IP anonymisation where available.
Google processes personal data collected through GA4 as a data processor on AfterGlow's behalf and in accordance with our documented instructions. We have entered into an appropriate data processing agreement with Google in accordance with Article 28 UK GDPR.
8. Sharing Personal Data with Third Parties
We do not sell your personal data. We may share your personal data with the categories of third parties set out below, for the purposes described in this policy and only to the extent necessary.
8.1 Service providers (data processors)
We engage third-party service providers who process personal data on our behalf and in accordance with our documented instructions. We have entered into data processing agreements with each processor in accordance with Article 28 UK GDPR. These service providers include:
- Website hosting and infrastructure providers;
- Email service providers and CRM platforms;
- Analytics providers (see section 7);
- Cloud storage and IT service providers; and
- Customer support platforms.
8.2 Payment providers and technology partners
Where you use the AfterGlow BNPL service, your payment and transaction data may be shared with payment service providers and payment processors who facilitate transactions on our behalf.
These providers may act as independent data controllers or as joint controllers with us, depending on the nature of the processing. Where a provider acts as a data controller in its own right, its own privacy policy will apply to its processing of your personal data.
8.3 Advertising and analytics partners
Personal data collected through the advertising pixels and tags on our website (as described in section 6 above) may be shared with Meta Platforms Ireland Limited (Meta), Google LLC (Google), LinkedIn Ireland Unlimited Company (LinkedIn) and TikTok Information Technologies UK Limited (TikTok). These providers process personal data collected through their respective pixels and tags as independent data controllers for their own purposes, including ad measurement, optimisation and audience building. Their processing of your personal data is governed by their own privacy policies:
- Meta: www.facebook.com/privacy/policy
- Google: policies.google.com/privacy
- LinkedIn: www.linkedin.com/legal/privacy-policy
- TikTok: www.tiktok.com/legal/privacy-policy
8.4 Credit reference agencies (“CRAs”)
When you apply for our BNPL service, we will carry out credit and affordability checks. In doing so, we may share your personal data with, and receive personal data from, credit reference agencies. The CRAs will record our search on your credit file, whether or not your application proceeds.
The main CRAs used in the UK are Experian, Equifax and TransUnion. Each CRA has its own privacy notice explaining how it uses your personal data:
- Experian: www.experian.co.uk/crain
- Equifax: www.equifax.co.uk/crain
- TransUnion: www.transunion.co.uk/crain
8.5 Fraud prevention agencies
We may share your personal data with fraud prevention agencies and databases to help prevent fraud, money laundering and other financial crime. If fraud is detected, you could be refused certain services, finance or employment. Further details of how your personal data is used by fraud prevention agencies, and your data protection rights, are available from the relevant agency.
8.6 Regulators, law enforcement and legal advisers
We may share your personal data with:
- the Financial Conduct Authority (“FCA”) or other regulators, in connection with our regulatory obligations;
- the Information Commissioner's Office (“ICO”) in connection with data protection matters;
- HM Revenue & Customs or other tax authorities;
- law enforcement agencies, courts or tribunals where required by law or to exercise or defend legal claims; and
- our professional advisers (including legal, accounting and auditing advisers), subject to appropriate confidentiality obligations.
8.7 Other disclosures
We may also share your personal data:
- with any person to whom we propose to transfer all or substantially all of our business or assets (including in the event of a reorganisation, dissolution or liquidation);
- where we are required to do so by law, regulation, court order or other legal process; or
- to protect the rights, property or safety of AfterGlow, our customers, merchants or others.
9. KYC, AML, Fraud Prevention and Credit Checks
As a business operating in the consumer credit and BNPL sector, we are subject to legal and regulatory obligations requiring us to:
- verify your identity (Know Your Customer or “KYC” checks) before providing our BNPL service;
- carry out anti-money laundering (“AML”) and counter-terrorist financing checks as required by the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017;
- conduct credit and affordability assessments in accordance with FCA rules and responsible lending obligations; and
- check fraud prevention databases to prevent and detect fraud and financial crime.
These checks may involve:
- searching your record at CRAs and recording the search on your credit file;
- checking your details against fraud prevention databases;
- verifying your identity using electronic identity verification services;
- assessing your financial circumstances based on information you provide and information obtained from CRAs; and
- sharing information about your account and payment conduct with CRAs on an ongoing basis (including where you fail to make payments when due).
Automated decision-making in credit assessments: Our credit and affordability assessment process may involve solely automated decision-making, including profiling, as permitted by Article 22(2) UK GDPR on the grounds that the decision is necessary for entering into or performing a contract with you, and/or is authorised by applicable law. This means that a decision about whether to approve your BNPL application may be made by automated means without human involvement. You have the right to request human intervention, to express your point of view and to contest any such automated decision. See section 13 below for further details on your rights.
The lawful bases for these processing activities are: legal obligation (compliance with AML/KYC and FCA regulatory requirements); performance of a contract (steps necessary before and during the provision of the BNPL service); and legitimate interests (responsible lending, fraud prevention and the protection of our business and customers).
10. Data Retention
We retain your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law or regulation. When determining the appropriate retention period, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, whether we can achieve those purposes through other means, and applicable legal, regulatory and contractual requirements.
The following table summarises our general retention periods. Specific retention periods may vary depending on individual circumstances.
| Category of data | Retention period | Rationale |
|---|---|---|
| Website visitor / analytics data | Up to 26 months from date of collection (or as configured in our analytics tools) | Industry standard for analytics; adjusted in accordance with cookie consent |
| Waitlist / sign-up data | Until the individual unsubscribes or requests deletion, and for a reasonable period thereafter for record-keeping | Necessary to manage the waitlist and communicate with interested individuals |
| Merchant enquiry data | For the duration of the business relationship and for six years following its termination | Limitation period for contractual claims |
| BNPL customer data (transactional and account data) | For the duration of the customer relationship and for six years following the closure or settlement of the account | Limitation Act 1980 (six-year limitation period); FCA record-keeping requirements |
| Credit and affordability assessment data | For six years from the date of the decision or the closure of the account, whichever is later | Regulatory record-keeping; limitation periods; responsible lending obligations |
| KYC / AML records | For five years from the end of the business relationship (or longer where required by law or regulation) | Money Laundering Regulations 2017 (regulation 40) |
| Fraud prevention data | In accordance with the applicable fraud prevention agency's retention policy, and our own retention schedule | Regulatory requirements; legitimate interests in fraud prevention |
| Marketing consent records | For as long as the consent is relied upon, and for a reasonable period thereafter as evidence of consent | Accountability obligations under UK GDPR |
Where personal data is no longer required, we will securely delete or anonymise it in accordance with our data retention and disposal procedures.
11. International Transfers of Personal Data
We are based in the United Kingdom. Where we transfer personal data outside the United Kingdom, we ensure that appropriate safeguards are in place to protect your personal data in accordance with UK GDPR.
Some of our service providers and advertising partners, including Google, Meta, LinkedIn and TikTok, are headquartered outside the United Kingdom (principally in the United States) and may transfer personal data collected through our website to countries outside the UK. Where the United States is the destination, transfers may be made pursuant to the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, or under the UK IDTA or UK Addendum to the EU Standard Contractual Clauses.
Transfers to countries or territories that the UK Secretary of State has determined provide an adequate level of data protection (known as “adequacy regulations”) do not require additional safeguards. The UK currently recognises adequacy in respect of the EEA, and certain other jurisdictions.
Where we transfer personal data to a country or territory that is not covered by an adequacy decision, we rely on one or more of the following safeguards:
- UK International Data Transfer Agreement (“UK IDTA”) or the UK Addendum to the EU Standard Contractual Clauses - approved by the ICO under section 119A of the Data Protection Act 2018;
- Binding corporate rules (where applicable); and
- Derogations under Article 49 UK GDPR in limited circumstances (for example, where the transfer is necessary for the performance of a contract with you).
If you wish to obtain further details about the safeguards we have put in place for international transfers of personal data, please contact us using the details set out in section 16.
12. Data Security
We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures include:
- encryption of personal data in transit and at rest (where appropriate);
- access controls to limit access to personal data to authorised personnel on a need-to-know basis;
- regular security assessments and penetration testing;
- secure development practices for our website and systems;
- staff training on data protection and information security; and
- incident response and breach notification procedures.
While we take all reasonable precautions, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your personal data.
13. Your Rights Under UK GDPR
Under UK data protection law, you have the following rights in relation to your personal data. These rights are not absolute and are subject to certain exemptions and conditions.
| Right | Description |
|---|---|
| Right of access | You have the right to request a copy of the personal data we hold about you (a “subject access request” or “SAR”). We will respond within one month of receiving a valid request (or within a further two months where the request is complex or we have received multiple requests). |
| Right to rectification | You have the right to request that we correct any inaccurate personal data or complete any incomplete personal data. |
| Right to erasure | You have the right to request that we delete your personal data in certain circumstances (for example, where it is no longer necessary for the purpose for which it was collected). This right does not apply where we are required to retain data by law or regulation (for example, KYC/AML records or credit data). |
| Right to restriction of processing | You have the right to request that we restrict the processing of your personal data in certain circumstances (for example, while we verify the accuracy of your data following a challenge). |
| Right to data portability | You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to transmit that data to another controller, where the processing is based on consent or contract and is carried out by automated means. |
| Right to object | You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will stop processing your data for that purpose. |
| Rights in relation to automated decision-making and profiling | Where we make decisions based solely on automated processing (including profiling) that produce legal effects concerning you or similarly significantly affect you (such as BNPL credit decisions), you have the right to: (i) request human intervention; (ii) express your point of view; and (iii) contest the decision. See section 9 above for further details of our automated decision-making processes. |
| Right to withdraw consent | Where we rely on your consent as the lawful basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. |
To exercise any of your rights, please contact us using the details set out in section 16 below. We may ask you to verify your identity before acting on your request. We will not charge a fee for exercising your rights unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request.
14. Complaints
If you are dissatisfied with how we have handled your personal data or wish to make a complaint about our data protection practices, we encourage you to contact us first so that we can try to resolve the matter:
- By email: hello@afterglowcredit.com
We will acknowledge your complaint promptly and aim to respond substantively within 30 days.
15. The Information Commissioner's Office
If you are not satisfied with our response to your complaint, or if you believe that we are processing your personal data in a way that is not compliant with UK data protection law, you have the right to lodge a complaint with the Information Commissioner's Office (“ICO”). The ICO is the UK's independent supervisory authority for data protection.
Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk
We would, however, appreciate the opportunity to address your concerns before you approach the ICO, and we ask that you contact us in the first instance.
16. How to Contact Us
If you have any questions about this privacy policy, wish to exercise your data protection rights, or want to raise a concern about how we process your personal data, please contact us:
AfterGlow
Email: hello@afterglowcredit.com
17. Children's Data
Our website and services, including the BNPL service, are not intended for, or directed at, individuals under the age of 18. We do not knowingly collect personal data from children under 18.
If you are under 18, please do not provide any personal data to us through our website, waitlist, or any other means.
If we become aware that we have collected personal data from a child under 18, we will take steps to delete that data as soon as reasonably practicable. If you believe that we may have collected personal data from a child under 18, please contact us immediately using the details set out in section 16.
18. Changes to This Privacy Policy
We may update this privacy policy from time to time to reflect changes in our processing activities, legal or regulatory requirements, or business practices. Where we make material changes, we will notify you by:
- posting a prominent notice on our website;
- sending you a notification by email (where we hold your email address and it is appropriate to do so); and/or
- updating the “last updated” date at the top of this policy.
We encourage you to review this privacy policy periodically to stay informed about how we are protecting your personal data.
The version of this privacy policy published on our website is the current version.
See also our Website Terms and Conditions.