Privacy policy

Last updated: 23 September 2026

This Privacy Policy explains how S Luca of Musselburgh Limited ("we", "us" or "our") collects, uses, stores and protects personal information when you:
- visit or use our website at https://lucasicecream.co.uk/ (the "Website")
- purchase products from us
- contact us by telephone, email or other means
- otherwise interact with us in connection with our products and services

1. Who we are
We are S Luca of Musselburgh Limited, a company registered in Scotland under company number SC296884.
Our registered office is:
32–34 High Street
Musselburgh
East Lothian
EH21 7AG
United Kingdom
Our trading name is S Luca Ice Cream

For the purposes of UK data protection law, we are generally the data controller of the personal information we process about you. We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) and other applicable data protection and privacy legislation.

2. How to contact us
You can contact us regarding our Privacy Policy via:
Email: hello@s-luca.co.uk
Post: S Luca Limited, 32–34 High Street, Musselburgh, East Lothian, EH21 7AG

3. What personal information we collect
Depending on how you interact with us, we may collect and use the following types of personal information:
- your name
- postal and delivery addresses
- email address
- telephone number
- details of products you purchase or enquire about
- information contained in correspondence or communications you send to us
- payment and transaction information necessary to process your purchase
- information relating to customer enquiries, complaints or requests
- technical information about your use of our Website, such as IP address, browser type and device information, where collected
- information obtained through cookies or similar technologies, where applicable
- any other personal information that you choose to provide to us

We will only collect personal information that is relevant and necessary for the purposes described in this Privacy Policy.

4. How we use your personal information
We may use your personal information for the following purposes:

- Processing and fulfilling orders
We may use your name, contact details, delivery address, order information and relevant payment or transaction information to:
- process and administer your order
- arrange delivery or collection
- communicate with you about your order
- process payments and refunds
- deal with queries, complaints and returns
- maintain appropriate records of transactions

Where necessary to perform a contract with you, the relevant processing will generally be based on Article 6(1)(b) UK GDPR.

- Responding to enquiries
If you contact us, we may use the information you provide to respond to your enquiry, provide information about our products or services and maintain a record of our communications. Depending on the circumstances, the lawful basis may be contract, legitimate interests or consent. We determine the appropriate lawful basis for each processing activity before carrying it out.

- Managing our business
We may use personal information where necessary to:
- administer and operate our business
- maintain business and accounting records
- manage payments and financial transactions
- protect our Website, systems and business against fraud, misuse or security threats
- establish, exercise or defend legal claims
- comply with our legal and regulatory obligations

Depending on the purpose, the lawful basis may be legitimate interests, legal obligation or another lawful basis permitted by the UK GDPR. Where we rely on legitimate interests, we will only do so where the processing is necessary and our interests are not overridden by your interests, rights and freedoms.

- Marketing
Where permitted by law, we may use your contact details to send you information about our products, services, offers or other marketing communications. Where consent is required, we will ask for your consent before sending the relevant marketing communications.

For electronic marketing such as marketing emails and text messages, PECR generally requires specific consent unless a relevant exception applies, such as the limited "soft opt-in" for existing customers. Marketing communications must also provide an appropriate means of opting out.

You can object to direct marketing at any time, and this right is absolute.

5. Our lawful bases for processing
Data protection law requires us to have a lawful basis for processing personal information. Depending on the circumstances, we may rely on one or more of the following lawful bases:
- Contract – where processing is necessary to enter into or perform a contract with you, such as processing an order
- Legal obligation – where we need to process information to comply with a legal requirement
- Legitimate interests – where processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms
- Consent – where you have given valid consent to a specific use of your personal information
- Vital interests – where processing is necessary to protect someone's vital interests, where applicable

The lawful basis depends on the particular processing activity. We do not rely on a single lawful basis for all processing. The UK GDPR requires organisations to identify and document their lawful basis and explain it in their privacy information.

6. Who we share your personal information with
We may share personal information where reasonably necessary for the purposes described in this Privacy Policy. This may include sharing information with:
- payment service providers
- delivery and courier providers
- website, hosting and IT service providers
- email, communications and customer-service providers
- professional advisers, such as accountants, auditors, lawyers and insurers
- government bodies, regulators, law enforcement agencies or courts where we are legally required or permitted to do so
- other service providers who process personal information on our behalf.

Where another organisation processes personal information for us, we will take appropriate steps to ensure that it is required to protect that information and process it only in accordance with our instructions and applicable law.

7. International transfers
Some of our service providers may process personal information outside the United Kingdom. Where we make a restricted transfer of personal information outside the UK, we will ensure that the transfer is permitted under applicable data protection law. This may include relying on UK adequacy regulations, appropriate safeguards such as the UK's International Data Transfer Agreement or UK Addendum, or another lawful transfer mechanism. Where required, we will provide further information about the relevant safeguards and how you can obtain a copy of them.

8. How long we keep your personal information
We will not keep personal information for longer than is reasonably necessary for the purposes for which it was collected. The length of time we retain information will depend on factors including:
- the purpose for which we collected it
- whether you continue to have a relationship with us
- whether we have a legal or regulatory obligation to retain it
- whether we need it to establish, exercise or defend legal claims
- our legitimate business and record-keeping requirements.

For example, transaction and accounting records may need to be retained for a period required by applicable tax and accounting legislation. Where we cannot specify an exact retention period, we will use appropriate criteria to determine how long the information should be retained. Privacy information should explain either the retention period or the criteria used to determine it.

9. Cookies and similar technologies
Our Website may use cookies and similar technologies. Some cookies may be strictly necessary for the Website to operate—for example, technologies required for security, shopping-basket functionality or other services that you have specifically requested.

Where consent is required for non-essential cookies or similar technologies, we will ask for your consent before using them and provide appropriate controls for accepting or rejecting them. Continuing to browse a website is not, by itself, sufficient consent for non-essential cookies.

Our Cookie Policy, where applicable, will provide further information about the cookies and similar technologies used on the Website.

10. Links to third-party websites
Our Website may contain links to third-party websites, plug-ins, applications or services. If you follow a link to a third-party website or use a third-party service, that organisation may collect and use information about you under its own privacy policy. We do not control the privacy practices of third parties and are not responsible for their privacy policies or practices. We recommend that you review the privacy information provided by any third-party website or service before providing personal information.

11. Your data protection rights
Subject to applicable law and certain exemptions, you may have rights in relation to your personal information, including:
- The right to be informed about how your personal information is used
- The right of access to your personal information and certain supplementary information
- The right to rectification of inaccurate or incomplete personal information
- The right to erasure of your personal information in certain circumstances
- The right to restriction of processing in certain circumstances
- The right to object to certain processing, including an absolute right to object to direct marketing
- The right to data portability in certain circumstances, allowing you to receive certain personal information in a structured, commonly used and machine-readable format
- Rights relating to automated decision-making and profiling, where applicable

These rights are not all absolute and may depend on the particular circumstances and the lawful basis on which we process your information. If you wish to exercise a right, please contact us using the details in section 2. We may need to request information from you to verify your identity before dealing with your request.

12. Your right to object to direct marketing
You have an absolute right to object to the processing of your personal information for direct marketing purposes. You can exercise this right at any time by contacting us or by using the unsubscribe facility included in our marketing communications. If you object to direct marketing, we will stop using your personal information for that purpose, subject to any limited processing necessary to maintain a record of your objection.

13. Automated decision-making and profiling
We do not currently intend to make decisions about you based solely on automated processing, including profiling, where those decisions produce legal effects or similarly significant effects on you.

14. Keeping your information secure
We take appropriate technical and organisational measures to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. However, no website, electronic transmission or storage system can be guaranteed to be completely secure. We will investigate and respond to personal data breaches in accordance with our legal obligations.

15. Information obtained from other sources
In some circumstances, we may receive personal information from sources other than you—for example, from service providers or other organisations where this is lawful. Where required by law, we will provide you with appropriate privacy information explaining the source of the information and how we use it. The UK GDPR generally requires privacy information to be provided when information is collected from the individual and, where information is obtained from elsewhere, within the applicable period, normally no later than one month.

16. Children's personal information
Our Website and services are not intended to knowingly collect personal information from children except where this is necessary and lawful in connection with our products or services. If you believe that a child has provided us with personal information in circumstances where this was not appropriate, please contact us using the details in section 2.

17. Complaints
If you have concerns about the way we have handled your personal information, we would appreciate the opportunity to investigate and resolve your concerns in the first instance. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection. You can find information about making a data protection complaint on the ICO's website.

18. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our business, the Website, our services, technology or applicable data protection law. When we make changes, we will update the "Last updated" date at the top of this Privacy Policy. Where appropriate, we will provide additional notice of significant changes.