PRIVACY POLICY

LAST UPDATED: OCTOBER 2026

1. Introduction

At We and Mrs Jones Limited, trading as RUM (“RUM”, “we”, “us” or “our”), we are committed to protecting your personal data and respecting your privacy.

You must be 18 or older to purchase our products and services and/or create an account, unless otherwise permitted by law. This website is not intended for children, and we do not knowingly collect personal data relating to children.

Please also refer to our Terms of Sale and any other terms and conditions that apply to your use of our website, products or services.

2. Who We Are

This website is operated by We and Mrs Jones Limited, trading as RUM, a company registered in England and Wales under company number 14234634, with its registered office at:

Bellarmine House
14 Upper Church Street
Chepstow
Monmouthshire
NP16 5EX
United Kingdom

For the purposes of applicable data protection legislation, We and Mrs Jones Limited is the data controller of your personal data where we determine the purposes and means of processing your personal data.

References in this Privacy Policy to “us”, “we” or “our” refer to We and Mrs Jones Limited, trading as RUM.

Where another company or third-party service provider acts as an independent data controller for its own processing activities, the relevant organisation will be responsible for explaining how it processes your personal data through its own privacy notice.

3. Contact Us

If you have questions about this Privacy Policy, wish to exercise any of your data protection rights, or have a complaint about how we use your personal data, you can contact us using the contact details provided on our website.

You may also contact us by post at:

Data Protection Officer / Privacy Team
We and Mrs Jones Limited
Bellarmine House
14 Upper Church Street
Chepstow
Monmouthshire
NP16 5EX
United Kingdom

Where we provide a specific privacy or data protection contact email address or privacy request form, this may also be used to submit requests.

For customer service enquiries that are not related to privacy or data protection, please contact RUM Customer Care using the contact details provided on our website.

4. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business, the services we provide, the way we process personal data, or applicable legal and regulatory requirements.

If we make material changes that may significantly affect your rights, we may provide additional notice, for example by email or through our website.

We recommend that you review this Privacy Policy periodically to remain informed about how we use your personal data.

5. When We Will Collect Your Personal Data

We may collect personal data about you when you:

use our website or any RUM app or digital service, including through cookies and similar technologies;
create or manage an account;
purchase products or services from us, whether online or in person;
contact Customer Care or otherwise communicate with us;
submit surveys, reviews or other feedback;
participate in competitions, events, promotions, campaigns or other activities organised by or on behalf of RUM;
interact with our marketing or advertising, including advertising on third-party platforms;
interact with our social media pages or mention RUM publicly, subject to your settings and the policies of the relevant platform;
provide information when signing up to receive communications from us;
provide information in connection with a product enquiry, complaint, return, refund or other customer service matter; or
otherwise provide personal information to us.

Cookies and Similar Technologies

We use cookies and similar technologies on our website and, where applicable, our apps and digital services.

These technologies may be used for purposes including website functionality, security, analytics, personalisation, advertising and measuring the effectiveness of our marketing.

For more information, please see our Cookie Policy. You can manage your cookie preferences through our cookie management tool and/or your browser or device settings.

Our website may not currently respond to “Do Not Track” browser signals.

Sensitive Personal Data

We may collect and use certain personal data that is treated under data protection laws as special category data or sensitive personal data, but only where an appropriate condition under applicable UK data protection law applies.

For example, this may include information relating to allergies, skin sensitivities or other information that you voluntarily provide to us in connection with our products or services, where such information is necessary and lawful to process.

Where we rely on your explicit consent to process such information, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before you withdrew your consent.

Where we are required to process or retain information to comply with a legal obligation, we may continue to do so even if you withdraw consent.

6. How We Use Your Personal Data and Our Legal Bases

The table below summarises the categories of personal data we may process, the purposes for which we may use it and the legal bases we may rely upon.

Data Category	What Data We May Use	Why We Use It	Legal Basis
Identity & Contact Details	Name, email address, postal address, telephone number and account credentials	Account creation and management; order processing; authentication; customer service; service communications	Contract; Legitimate Interests
Transactional Information	Purchases, payment method, billing details, order history, refunds and returns	Processing transactions; fraud prevention; accounting; auditing; customer service	Contract; Legal Obligation; Legitimate Interests
Order & Delivery Information	Name, delivery address, order details and recipient information	Processing and delivering orders	Contract
Preferences & Profile Information	Preferences, interests, questionnaire responses and information you provide about your requirements	Personalisation; recommendations; improving customer experience	Legitimate Interests; Consent
Product & Service Information	Information relating to products purchased, used or considered	Customer support; product recommendations; product development; safety and compliance	Contract; Legitimate Interests; Legal Obligation
Technical & Usage Information	IP address, device identifiers, cookie identifiers, browser and operating system information, logs, session data, language, referrer and website usage	Security; performance; analytics; personalisation; fraud detection	Legitimate Interests; Consent where required
Location Information	Approximate location derived from IP address and, where expressly enabled, precise location	Location-based content; analytics; fraud prevention and security	Legitimate Interests; Consent where required
Customer Care & Communications	Emails, messages, correspondence, call recordings where applicable and customer service records	Responding to requests; complaint handling; quality assurance; training and service improvement	Contract; Legitimate Interests
Marketing & Communications	Contact details, communication preferences and purchase or browsing activity	Marketing communications; tailored offers; events and promotions	Consent; Legitimate Interests where permitted
Surveys & Feedback	Survey responses, reviews, ratings and competition submissions	Improving products and services; customer satisfaction analysis; research	Consent; Legitimate Interests
Social Media & Public Profile	Social media handles, profile information, public posts and interactions with RUM accounts	Community engagement; social listening; customer support; marketing where permitted	Legitimate Interests; Consent where required
User-Generated Content	Reviews, photographs, videos, comments and other content you submit	Publishing content; marketing where permitted; product and service improvement	Consent; Legitimate Interests
CCTV & In-Store Surveillance	Video recordings where CCTV or similar systems are operated at our premises	Security; safety; loss prevention; incident investigation	Legitimate Interests; Legal Obligation where applicable
Behavioural Information	Browsing behaviour, product views, searches, wishlists and purchase activity	Personalisation; analytics; product development; targeted marketing	Legitimate Interests; Consent where required
Advertising & Cross-Device Information	Device identifiers, hashed identifiers and browsing information	Personalised advertising; campaign measurement; audience management	Consent where required; Legitimate Interests where permitted
AI-Powered Experiences	Prompts, text, images or other information submitted to AI-enabled tools and resulting outputs	Providing requested features; recommendations; customer service; analytics; security	Consent; Legitimate Interests
Event & Image Data	Photographs and videos taken at events or submitted by you	Marketing and promotional activities; event administration	Consent; Legitimate Interests where applicable

Anonymised and Aggregated Data

We may anonymise or aggregate personal data so that it can no longer reasonably be used to identify you.

We may use anonymised or aggregated information for analytics, testing, research, reporting and service improvement.

AI-Enabled Features and Chatbots

We may offer AI-enabled features, including chatbots or virtual assistants, to help you interact with RUM and our services more efficiently.

For example, these features may be used to answer questions, provide product or service information, support customer care queries or provide personalised recommendations.

When you use these features, we may process the information you choose to provide in your prompts, including text and, where the feature permits, images, together with related interaction data such as the date and time of the interaction, device information, session identifiers and the content of our responses.

We may use this information to provide the relevant feature, improve our services and maintain security.

Please do not include unnecessary personal data in prompts and do not provide special category data, confidential information or other sensitive information unless we specifically request it and have an appropriate lawful basis for processing it.

AI-generated outputs may be inaccurate or incomplete and should not necessarily be relied upon without appropriate review.

Where particular AI-enabled features involve additional processing, retention periods or third-party technology providers, we may provide additional information at the point you use the feature and/or in the applicable feature terms.

Automated Decision-Making

We may use automated tools to help operate our services, including for fraud prevention, security, analytics and personalisation.

We do not generally make decisions about you that produce legal effects or similarly significant effects based solely on automated processing.

Where applicable law gives you rights in relation to automated decision-making, we will provide the information and safeguards required by law.

App Permissions

Where we operate an app, we may process device and usage information and, where you enable the relevant permission, location information.

This information may be used to operate app features, including notifications, maintain performance, improve our services and provide requested functionality.

You can manage app permissions through your device settings.

Email Marketing and Analytics

If you choose to receive marketing emails from us, our email marketing providers may collect information about your engagement with those emails, such as whether an email was opened or links were clicked.

We may use analytics tools, including cookies and similar technologies, to:

measure the effectiveness of our marketing;
understand how visitors use our website and digital services;
improve our products and services;
tailor recommendations and content; and
deliver and measure advertising.

For more information and to manage your choices, please see our Cookie Policy.

Basket Reminders

Where you have an account and have opted in to receive marketing communications, we may send reminders about products left in your basket or otherwise abandoned during the purchasing process.

You can opt out of marketing communications at any time using the unsubscribe mechanism provided in our communications or by contacting us.

7. Sharing Your Personal Data

We may share your personal data with trusted third parties where necessary and lawful to operate our business and provide our products and services.

These may include:

Service Providers: We may share personal data with third parties who process personal data on our behalf, including hosting providers, IT providers, analytics providers, payment processors, delivery and fulfilment providers, customer service platforms, fraud prevention providers, marketing providers and technology providers.
Payment Providers: Where you make a purchase, relevant personal and payment information may be shared with payment service providers to process your transaction securely.
Delivery Providers: We may share your name, delivery address, contact information and relevant order details with couriers, postal services and other fulfilment providers so that your order can be delivered.
Marketing and Advertising Providers: Where lawful and subject to your choices, we may work with marketing and advertising partners to deliver advertising, measure campaigns, understand audiences and improve our marketing.
Fraud Prevention and Security Providers: We may share information with specialist providers to detect and prevent fraud, misuse, criminal activity and security threats.
Professional Advisers: We may disclose information to our lawyers, accountants, auditors, insurers and other professional advisers where reasonably necessary.
Regulators and Authorities: We may disclose personal data to regulators, law enforcement agencies, courts or other authorities where required by law or where necessary to protect our rights, safety or property or to prevent fraud or criminal activity.
Business Transactions: We may disclose or transfer relevant personal data in connection with a merger, acquisition, restructuring, sale of assets or other corporate transaction, subject to appropriate safeguards.

Where third-party service providers process personal data on our behalf, we require them to process the data only in accordance with our instructions where required by law, to maintain appropriate security measures and to maintain confidentiality.

Profiling and Personalised Advertising

We may analyse information about how you use our website and services, including products you view or purchase and how you interact with our communications.

This may help us understand customer preferences, measure marketing effectiveness and provide more relevant content, offers and advertising.

Depending on your choices and applicable law, this may involve the use of cookies and similar tracking technologies and/or sharing certain identifiers, including hashed identifiers, with advertising or social media partners.

You can manage relevant preferences through our cookie management tool and, where available, through settings on third-party platforms.

Advertising on Third-Party Platforms

We may run advertising campaigns on third-party platforms such as Facebook, Instagram, Google, TikTok, Snapchat or Pinterest.

Where permitted by law and subject to your choices, we may share certain identifiers, such as a hashed email address or telephone number, so that the relevant platform can match the information to its users.

This may enable us to:

show advertisements to existing customers; and/or
reach new audiences with similar characteristics.

We do not receive the identity of individuals who form part of a lookalike audience unless they engage with our advertising.

We do not share personal data collected directly from you on our website with third parties for their own direct marketing purposes unless you have consented or another lawful basis applies.

Information We Receive From Third Parties

We may receive information about you from third parties, including advertising partners, competition partners, review platforms, social media platforms and other publicly available sources, subject to applicable law and your settings.

Where you interact with RUM on social media or mention us publicly, we and third-party analytics providers may process information from publicly available posts to understand engagement, improve our services and manage customer support.

Where lawful, we may combine information received from third parties with information you provide directly to us.

Marketing Service Providers

We may share limited information with selected marketing service providers that support us with audience insights, segmentation, campaign measurement and optimisation.

Where appropriate, we may use measures such as hashing, encryption and pseudonymisation before sharing information.

These providers may be able to combine the information we provide with other information they hold in order to provide services to us, subject to contractual restrictions and appropriate safeguards.

8. International Transfers of Your Personal Data

Some of our service providers may be located outside the United Kingdom.

As a result, it may be necessary for personal data that we collect from you to be transferred to or accessed from countries outside the UK in order for us to provide our products and services.

Where your personal data is transferred outside the UK, we will take steps to ensure that an appropriate level of protection is provided in accordance with applicable UK data protection law.

Depending on the circumstances, this may include:

transferring personal data to a country recognised by the UK as providing an adequate level of protection;
implementing appropriate contractual safeguards;
using the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses (SCCs), where appropriate; and/or
relying on another lawful transfer mechanism permitted by applicable law.

Some international transfers may be necessary to provide particular services.

9. Security and Retention

Security

We are committed to ensuring that your personal data is secure.

We use appropriate physical, technical, organisational, contractual and managerial measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures may include access controls, encryption, secure systems and appropriate security procedures.

Our employees and contractors who have access to personal data are required to respect the confidentiality and security of that information.

However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Retention

We will only keep your personal data for as long as we have a lawful and legitimate reason to do so.

The length of time we retain personal data will depend on factors including:

the purpose for which we collected it;
whether you continue to use our services;
our legal and regulatory obligations;
whether we need the information to resolve disputes or enforce our agreements; and
applicable limitation periods.

For example, we may retain order and transaction records for as long as necessary for legal, tax and accounting purposes.

In many cases, this may be for up to six years after the end of the relevant financial year in which the transaction took place, although different retention periods may apply depending on the nature of the information and the applicable legal requirements.

When we are no longer required to retain your personal data, we will delete it or anonymise it so that you can no longer be identified from it.

Third-Party Links

Our website may contain links to websites, applications or services operated by third parties.

We do not control these third-party websites or services and they will generally be governed by their own privacy policies and terms and conditions.

You should review the privacy notices and terms and conditions of any third-party websites or services that you use.

10. Your Marketing Choices

We may contact you by email, post, SMS, WhatsApp, push notification or other permitted channels about our products, services, offers, promotions and events, subject to your marketing preferences and applicable law.

How Can I Unsubscribe From Marketing Communications?

Emails: You can unsubscribe by clicking the “unsubscribe” link in any marketing email we send you.
Text Messages: You can follow the instructions provided in any SMS message we send you.
WhatsApp: Where applicable, you can follow the opt-out instructions provided through the relevant communication or contact us.
Push Notifications: Where applicable, you can manage your preferences and disable push notifications through the relevant app or your device settings.
Other Marketing: We may include marketing material in parcels, order communications or other permitted communications where allowed by law.

You may also be able to manage your marketing preferences through your online account.

You can opt out of marketing communications at any time using the methods above or by contacting us.

Please note that you may continue to receive communications for a short period after changing your preferences while our systems are updated.

Opting out of marketing communications will not generally stop service communications that are necessary to fulfil an order or provide a service you have requested, such as order confirmations, delivery updates, account notifications or responses to customer service enquiries.

11. Your Rights in Relation to Your Personal Data

Subject to certain exceptions and limitations under applicable data protection law, you may have the following rights in relation to the personal data we hold about you:

Right to be informed: You have the right to receive clear, transparent and understandable information about how we use your personal data. This is one of the reasons we provide this Privacy Policy.
Right of access: You have the right to request access to the personal data we hold about you.
Right of rectification: You have the right to request that inaccurate, incomplete or outdated personal data is corrected or updated.
Right to restriction of processing: In certain circumstances, you have the right to ask us to restrict the processing of your personal data.
Right to erasure: In certain circumstances, you have the right to ask us to delete your personal data. This is sometimes referred to as the “right to be forgotten”. This is not an absolute right and we may have lawful grounds for retaining certain information.
Right to object: You may have the right to object to certain processing of your personal data, including processing based on our legitimate interests.
Right to object to direct marketing: You have the right to object to or opt out of direct marketing at any time.
Right to data portability: In certain circumstances, you have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format and to request that it be transferred to another organisation.
Right to withdraw consent: Where we process your personal data based on consent, you have the right to withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.
Rights relating to automated decision-making: Where applicable, you may have rights in relation to decisions made solely through automated processing that produce legal or similarly significant effects.

If you wish to exercise any of these rights, please contact us using the contact details provided in this Privacy Policy.

We may need to request additional information to verify your identity before processing your request. This is a security measure intended to ensure that personal data is not disclosed to the wrong person.

We will respond to valid requests within the time period required by applicable law.

Your Right to Complain

If you have concerns about how we have used your personal data, we would appreciate the opportunity to resolve your concern directly.

However, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent regulator for data protection.

Further information is available from the ICO's website.

You may also have the right to contact a relevant data protection authority in another country where applicable.

To submit a privacy request, please use the contact details provided at the beginning of this Privacy Policy.

We may require proof of your identity and full details of your request before we process it.

We and Mrs Jones Limited, trading as RUM
Company number: 14234634
Registered in England and Wales
Registered Office: Bellarmine House, 14 Upper Church Street, Chepstow, Monmouthshire, NP16 5EX, United Kingdom